CVE-2015-3227: Medium severity suse linux vulnerability
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 3.2.22, 4.1.x before 4.1.11, and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
Other sources
The (1) jdom.rb and (2) rexml.rb components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.
— MITRE
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2015-3227?
CVE-2015-3227 is classified as a denial of service vulnerability that can lead to a SystemStackError.
How do I fix CVE-2015-3227?
To fix CVE-2015-3227, upgrade Ruby on Rails to version 4.1.11 or 4.2.2 and later.
Which versions of Ruby on Rails are affected by CVE-2015-3227?
CVE-2015-3227 affects Ruby on Rails versions prior to 4.1.11 and 4.2.x before 4.2.2.
Can CVE-2015-3227 be exploited remotely?
Yes, CVE-2015-3227 can be exploited remotely by sending a large XML document that causes a denial of service.
What components of Ruby on Rails are vulnerable in CVE-2015-3227?
The vulnerable components are jdom.rb and rexml.rb in the Active Support library.