CVE-2014-0082: Input Validation
Published Feb 20, 2014
·Updated
actionpack/lib/actionview/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.
Affected Software
103 affected components
rubyonrails Rails=3.0.0
rubyonrails Rails=3.0.0-beta
rubyonrails Rails=3.0.0-beta2
rubyonrails Rails=3.0.0-beta3
rubyonrails Rails=3.0.0-beta4
rubyonrails Rails=3.0.0-rc
rubyonrails Rails=3.0.0-rc2
rubyonrails Rails=3.0.1
rubyonrails Rails=3.0.1-pre
rubyonrails Rails=3.0.2
rubyonrails Rails=3.0.2-pre
rubyonrails Rails=3.0.3
rubyonrails Rails=3.0.4-rc1
rubyonrails Rails=3.0.5
rubyonrails Rails=3.0.5-rc1
rubyonrails Rails=3.0.6
rubyonrails Rails=3.0.6-rc1
rubyonrails Rails=3.0.6-rc2
rubyonrails Rails=3.0.7
rubyonrails Rails=3.0.7-rc1
rubyonrails Rails=3.0.7-rc2
rubyonrails Rails=3.0.8
rubyonrails Rails=3.0.8-rc1
rubyonrails Rails=3.0.8-rc2
rubyonrails Rails=3.0.8-rc3
rubyonrails Rails=3.0.8-rc4
rubyonrails Rails=3.0.9
rubyonrails Rails=3.0.9-rc1
rubyonrails Rails=3.0.9-rc2
rubyonrails Rails=3.0.9-rc3
rubyonrails Rails=3.0.9-rc4
rubyonrails Rails=3.0.9-rc5
rubyonrails Rails=3.0.10
rubyonrails Rails=3.0.10-rc1
rubyonrails Rails=3.0.11
rubyonrails Rails=3.0.12
rubyonrails Rails=3.0.12-rc1
rubyonrails Rails=3.0.13
rubyonrails Rails=3.0.13-rc1
rubyonrails Rails=3.0.14
rubyonrails Rails=3.0.16
rubyonrails Rails=3.0.17
rubyonrails Rails=3.0.18
rubyonrails Rails=3.0.19
rubyonrails Rails=3.0.20
rubyonrails Rails=3.1.0
rubyonrails Rails=3.1.0-beta1
rubyonrails Rails=3.1.0-rc1
rubyonrails Rails=3.1.0-rc2
rubyonrails Rails=3.1.0-rc3
rubyonrails Rails=3.1.0-rc4
rubyonrails Rails=3.1.0-rc5
rubyonrails Rails=3.1.0-rc6
rubyonrails Rails=3.1.0-rc7
rubyonrails Rails=3.1.0-rc8
rubyonrails Rails=3.1.1
rubyonrails Rails=3.1.1-rc1
rubyonrails Rails=3.1.1-rc2
rubyonrails Rails=3.1.1-rc3
rubyonrails Rails=3.1.2
rubyonrails Rails=3.1.2-rc1
rubyonrails Rails=3.1.2-rc2
rubyonrails Rails=3.1.3
rubyonrails Rails=3.1.4
rubyonrails Rails=3.1.4-rc1
rubyonrails Rails=3.1.5
rubyonrails Rails=3.1.5-rc1
rubyonrails Rails=3.1.6
rubyonrails Rails=3.1.7
rubyonrails Rails=3.1.8
rubyonrails Rails=3.1.9
rubyonrails Rails=3.1.10
rubyonrails Rails=3.2.0
rubyonrails Rails=3.2.0-rc1
rubyonrails Rails=3.2.0-rc2
rubyonrails Rails=3.2.1
rubyonrails Rails=3.2.2
rubyonrails Rails=3.2.2-rc1
rubyonrails Rails=3.2.3
rubyonrails Rails=3.2.3-rc1
rubyonrails Rails=3.2.3-rc2
rubyonrails Rails=3.2.4
rubyonrails Rails=3.2.4-rc1
rubyonrails Rails=3.2.5
rubyonrails Rails=3.2.6
rubyonrails Rails=3.2.7
rubyonrails Rails=3.2.8
rubyonrails Rails=3.2.9
rubyonrails Rails=3.2.10
rubyonrails Rails=3.2.11
rubyonrails Rails=3.2.12
rubyonrails Rails=3.2.13
rubyonrails Rails=3.2.13-rc1
rubyonrails Rails=3.2.13-rc2
rubyonrails Rails=3.2.15
rubyonrails Rails=3.2.15-rc3
rubyonrails ruby on Rails<=3.2.16
rubyonrails ruby on Rails=3.0.4
rubyonrails ruby on Rails=3.2.14
rubyonrails ruby on Rails=3.2.14-rc1
rubyonrails ruby on Rails=3.2.14-rc2
rubyonrails ruby on Rails=3.2.15-rc1
rubyonrails ruby on Rails=3.2.15-rc2
Event History
Feb 20, 2014
CVE Published
via MITRE·11:00 AM
Data Sourced
via MITRE·11:00 AM
Description
Data Sourced
via NVD·03:27 PM
DescriptionSeverityWeaknessAffected Software
Frequently Asked Questions
1
What is the severity of CVE-2014-0082?
CVE-2014-0082 has a severity rating indicating a denial of service vulnerability that can lead to memory consumption.
2
How do I fix CVE-2014-0082?
To fix CVE-2014-0082, upgrade to Action Pack in Ruby on Rails version 3.2.17 or later.
3
What versions of Ruby on Rails are affected by CVE-2014-0082?
CVE-2014-0082 affects Ruby on Rails 3.x versions prior to 3.2.17.
4
Can CVE-2014-0082 be exploited remotely?
Yes, CVE-2014-0082 allows remote attackers to exploit the vulnerability and potentially cause denial of service.
5
What component of Ruby on Rails is impacted by CVE-2014-0082?
CVE-2014-0082 impacts the Action View component in Ruby on Rails.