Action Mailer Gem on Ruby block_format redos

Summaryinfo

A vulnerability was found in Action Mailer Gem on Ruby. It has been classified as problematic. The impacted element is the function block_format. Performing a manipulation results in redos. This vulnerability is identified as CVE-2024-47889. There is not any exploit available. Upgrading the affected component is recommended.

Detailsinfo

A vulnerability, which was classified as problematic, was found in Action Mailer Gem on Ruby (unknown version). This affects the function block_format. The manipulation with an unknown input leads to a redos vulnerability. CWE is classifying the issue as CWE-1333. The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. This is going to have an impact on availability. The summary by CVE is:

Action Mailer is a framework for designing email service layers. Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the block_format helper in Action Mailer. Carefully crafted text can cause the block_format helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. As a workaround, users can avoid calling the `block_format` helper or upgrade to Ruby 3.2. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 requires Ruby 3.2 or greater so is unaffected.

It is possible to read the advisory at github.com. This vulnerability is uniquely identified as CVE-2024-47889 since 10/04/2024. Technical details of the vulnerability are known, but there is no available exploit. The attack technique deployed by this issue is T1449.003 according to MITRE ATT&CK.

The vulnerability scanner Nessus provides a plugin with the ID 209307 (actionmailer Ruby Library 3.x < 6.1.7.9 / 7.0.x < 7.0.8.5 / 7.1.x < 7.1.4.1 / 7.2.x < 7.2.1.1 DoS (CVE-2024-47889)), which helps to determine the existence of the flaw in a target environment.

Upgrading eliminates this vulnerability.

The vulnerability is also documented in the vulnerability database at Tenable (209307). Be aware that VulDB is the high quality source for vulnerability data.

Productinfo

Type

• Ruby Gem

Name

• Action Mailer Gem

CPE 2.3info

• 🔍

CPE 2.2info

• 🔍

CVSSv4info

CVSSv3info

CVSSv2info

Exploitinginfo

Threat Intelligenceinfo

Countermeasuresinfo

Timelineinfo

Sourcesinfo

Entryinfo

Be aware that VulDB is the high quality source for vulnerability data.

Discussion