CVE-2015-7581: High severity ruby on rails vulnerability

Q: What is the severity of CVE-2015-7581?

CVE-2015-7581 has been classified as a moderate severity vulnerability due to its potential for causing denial of service through excessive caching and memory consumption.

Q: How do I fix CVE-2015-7581?

To fix CVE-2015-7581, you should upgrade Ruby on Rails to version 4.2.5.1 or later for the 4.x series, or to version 5.0.0.beta1.1 or later for the 5.x series.

Q: What versions of Ruby on Rails are affected by CVE-2015-7581?

The affected versions include Ruby on Rails 4.x prior to 4.2.5.1 and 5.x prior to 5.0.0.beta1.1.

Q: What type of attack does CVE-2015-7581 facilitate?

CVE-2015-7581 facilitates a denial of service attack by allowing remote attackers to exploit wildcard controller routes.

Q: Are there any workarounds for CVE-2015-7581?

There are no official workarounds for CVE-2015-7581, and upgrading to the patched versions is the recommended solution.

Published Feb 16, 2016

Updated

actionpack/lib/actiondispatch/routing/routeset.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard controller route.

Affected Software

42 affected componentsFixes available

rubygems/actionpack>=4.0.0<=4.2.5.0

4.2.5.1

rubyonrails Rails=4.0.0

rubyonrails Rails=4.0.0-beta

rubyonrails Rails=4.0.0-rc1

rubyonrails Rails=4.0.0-rc2

rubyonrails Rails=4.0.1

rubyonrails Rails=4.0.1-rc1

rubyonrails Rails=4.0.1-rc2

rubyonrails Rails=4.0.1-rc3

rubyonrails Rails=4.0.1-rc4

rubyonrails Rails=4.0.2

rubyonrails Rails=4.0.3

rubyonrails Rails=4.0.4

rubyonrails Rails=4.0.5

rubyonrails Rails=4.0.6

rubyonrails Rails=4.0.6-rc1

rubyonrails Rails=4.0.6-rc2

rubyonrails Rails=4.0.6-rc3

rubyonrails Rails=4.0.7

rubyonrails Rails=4.0.8

rubyonrails Rails=4.0.9

rubyonrails Rails=4.0.10-rc1

rubyonrails Rails=4.1.0

rubyonrails Rails=4.1.0-beta1

rubyonrails Rails=4.1.1

rubyonrails Rails=4.1.2

rubyonrails Rails=4.1.2-rc1

rubyonrails Rails=4.1.2-rc2

rubyonrails Rails=4.1.2-rc3

rubyonrails Rails=4.1.3

rubyonrails Rails=4.1.4

rubyonrails Rails=4.1.5

rubyonrails Rails=4.1.6-rc1

rubyonrails Rails=4.1.7

rubyonrails Rails=4.1.8

rubyonrails Rails=4.2.0-beta1

rubyonrails Rails=4.2.1

rubyonrails Rails=4.2.2

rubyonrails Rails=4.2.3

rubyonrails Rails=4.2.4

rubyonrails Rails=4.2.5

rubyonrails Rails=5.0.0-beta1

Event History

Feb 16, 2016

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Oct 24, 2017

Advisory Published

06:33 PM

Frequently Asked Questions

What is the severity of CVE-2015-7581?

CVE-2015-7581 has been classified as a moderate severity vulnerability due to its potential for causing denial of service through excessive caching and memory consumption.

How do I fix CVE-2015-7581?

To fix CVE-2015-7581, you should upgrade Ruby on Rails to version 4.2.5.1 or later for the 4.x series, or to version 5.0.0.beta1.1 or later for the 5.x series.

What versions of Ruby on Rails are affected by CVE-2015-7581?