CVE-2009-1904: Medium severity ruby-lang Ruby vulnerability
The BigDecimal library in Ruby 1.8.6 before p369 and 1.8.7 before p173 allows context-dependent attackers to cause a denial of service (application crash) via a string argument that represents a large number, as demonstrated by an attempted conversion to the Float data type.
Affected Software
Remediation
Patch Available
Patch Available
Patch Available
Event History
Frequently Asked Questions
What is the severity of CVE-2009-1904?
CVE-2009-1904 is considered a denial of service vulnerability due to application crashes caused by large string arguments.
How do I fix CVE-2009-1904?
To fix CVE-2009-1904, upgrade to Ruby versions 1.8.6 p369 or higher, or 1.8.7 p173 or higher.
What versions of Ruby are affected by CVE-2009-1904?
CVE-2009-1904 affects Ruby versions 1.8.6 before p369 and 1.8.7 before p173.
What kind of attack is possible with CVE-2009-1904?
CVE-2009-1904 allows context-dependent attackers to exploit a vulnerability that can crash the application.
Is CVE-2009-1904 associated with a specific data type?
Yes, CVE-2009-1904 is particularly associated with attempts to convert large string representations of numbers to the Float data type.