CVE-2014-6438: High severity ruby vulnerability
Published Sep 6, 2017
·Updated
The URI.decodewwwformcomponent method in Ruby before 1.9.2-p330 allows remote attackers to cause a denial of service (catastrophic regular expression backtracking, resource consumption, or application crash) via a crafted string.
Affected Software
1 affected component
ruby-lang Ruby<=1.9.2
Remediation
Event History
Sep 6, 2017
CVE Published
via MITRE·09:00 PM
Data Sourced
via MITRE·09:00 PM
Description
Frequently Asked Questions
1
What is the severity of CVE-2014-6438?
CVE-2014-6438 has a severity rating that indicates a denial of service risk due to catastrophic backtracking in regular expressions.
2
How do I fix CVE-2014-6438?
To fix CVE-2014-6438, upgrade Ruby to version 1.9.2-p330 or later.
3
What types of attacks are possible with CVE-2014-6438?
CVE-2014-6438 allows for denial of service attacks through crafted string inputs that exploit regular expression vulnerabilities.
4
Which versions of Ruby are affected by CVE-2014-6438?
CVE-2014-6438 affects all versions of Ruby before 1.9.2-p330.
5
Can CVE-2014-6438 lead to application crashes?
Yes, CVE-2014-6438 can cause application crashes due to resource consumption from crafted input.