CVE-2016-0751: High severity ruby on rails vulnerability

Q: What is the severity of CVE-2016-0751?

CVE-2016-0751 is classified as a denial of service vulnerability in affected Ruby on Rails versions.

Q: How do I fix CVE-2016-0751?

To fix CVE-2016-0751, you should upgrade to Action Pack version 5.x, 4.2.5.1, 4.1.14.1, or 3.2.22.1.

Q: Which versions of Ruby on Rails are affected by CVE-2016-0751?

CVE-2016-0751 affects Ruby on Rails versions prior to 3.2.22.1, 4.0.x prior to 4.1.14.1, 4.1.x prior to 4.1.14.1, 4.2.x prior to 4.2.5.1, and 5.x prior to 5.0.0.beta1.1.

Q: What could an attacker do with CVE-2016-0751?

An attacker could exploit CVE-2016-0751 to cause a denial of service condition by manipulating the MIME type cache.

Q: Is upgrading to the latest version sufficient to mitigate CVE-2016-0751?

Yes, upgrading to the recommended versions will effectively mitigate the vulnerability associated with CVE-2016-0751.

Published Feb 16, 2016

Updated

actionpack/lib/actiondispatch/http/mimetype.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header.

Affected Software

71 affected componentsFixes available

rubygems/actionpack>=4.0.0<=4.1.14.0

4.1.14.1

rubygems/actionpack<=3.2.22.0

3.2.22.1

rubygems/actionpack>=4.2.0<=4.2.5.0

4.2.5.1

rubyonrails Rails=4.0.0

rubyonrails Rails=4.0.0-beta

rubyonrails Rails=4.0.0-rc1

rubyonrails Rails=4.0.0-rc2

rubyonrails Rails=4.0.1

rubyonrails Rails=4.0.1-rc1

rubyonrails Rails=4.0.1-rc2

rubyonrails Rails=4.0.1-rc3

rubyonrails Rails=4.0.1-rc4

rubyonrails Rails=4.0.2

rubyonrails Rails=4.0.3

rubyonrails Rails=4.0.4

rubyonrails Rails=4.0.5

rubyonrails Rails=4.0.6

rubyonrails Rails=4.0.6-rc1

rubyonrails Rails=4.0.6-rc2

rubyonrails Rails=4.0.6-rc3

rubyonrails Rails=4.0.7

rubyonrails Rails=4.0.8

rubyonrails Rails=4.0.9

rubyonrails Rails=4.0.10

rubyonrails Rails=4.0.10-rc1

rubyonrails Rails=4.1.0

rubyonrails Rails=4.1.0-beta1

rubyonrails Rails=4.1.1

rubyonrails Rails=4.1.2

rubyonrails Rails=4.1.2-rc1

rubyonrails Rails=4.1.2-rc2

rubyonrails Rails=4.1.2-rc3

rubyonrails Rails=4.1.3

rubyonrails Rails=4.1.4

rubyonrails Rails=4.1.5

rubyonrails Rails=4.1.6-rc1

rubyonrails Rails=4.1.7

rubyonrails Rails=4.1.8

rubyonrails Rails=4.1.9

rubyonrails Rails=4.1.10

rubyonrails Rails=4.1.12

rubyonrails Rails=4.1.13

rubyonrails Rails=4.2.0-beta1

rubyonrails Rails=4.2.0-beta2

rubyonrails Rails=4.2.0-beta3

rubyonrails Rails=4.2.0-beta4

rubyonrails Rails=4.2.0-rc1

rubyonrails Rails=4.2.0-rc2

rubyonrails Rails=4.2.0-rc3

rubyonrails Rails=4.2.1

rubyonrails Rails=4.2.1-rc1

rubyonrails Rails=4.2.1-rc2

rubyonrails Rails=4.2.1-rc3

rubyonrails Rails=4.2.1-rc4

rubyonrails Rails=4.2.2

rubyonrails Rails=4.2.3

rubyonrails Rails=4.2.3-rc1

rubyonrails Rails=4.2.4

rubyonrails Rails=4.2.4-rc1

rubyonrails Rails=4.2.5

rubyonrails Rails=4.2.5-rc1

rubyonrails Rails=4.2.5-rc2

rubyonrails Rails=5.0.0-beta1

rubyonrails ruby on Rails<=3.2.22

rubyonrails ruby on Rails=4.0.10-rc2

rubyonrails ruby on Rails=4.0.11

rubyonrails ruby on Rails=4.0.11.1

rubyonrails ruby on Rails=4.0.12

rubyonrails ruby on Rails=4.0.13

rubyonrails ruby on Rails=4.0.13-rc1

rubyonrails ruby on Rails=4.1.11

Event History

Feb 16, 2016

CVE Published

via MITRE·02:00 AM

Data Sourced

via MITRE·02:00 AM

Description

Oct 24, 2017

Advisory Published

06:33 PM

Frequently Asked Questions

What is the severity of CVE-2016-0751?

CVE-2016-0751 is classified as a denial of service vulnerability in affected Ruby on Rails versions.

How do I fix CVE-2016-0751?

To fix CVE-2016-0751, you should upgrade to Action Pack version 5.x, 4.2.5.1, 4.1.14.1, or 3.2.22.1.

Which versions of Ruby on Rails are affected by CVE-2016-0751?