CVE-2024-47889 Affecting rubygem-actionmailer package, versions *


Severity

Recommended
0.0
low
0
10

Based on Red Hat Enterprise Linux security rating.

Threat Intelligence

EPSS
0.05% (19th percentile)

Do your applications use this vulnerable package?

In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.

Test your applications
  • Snyk IDSNYK-RHEL7-RUBYGEMACTIONMAILER-8224193
  • published16 Oct 2024
  • disclosed15 Oct 2024

Introduced: 15 Oct 2024

CVE-2024-47889  (opens in a new tab)
CWE-1337  (opens in a new tab)

How to fix?

There is no fixed version for RHEL:7 rubygem-actionmailer.

NVD Description

Note: Versions mentioned in the description apply only to the upstream rubygem-actionmailer package and not the rubygem-actionmailer package as distributed by RHEL. See How to fix? for RHEL:7 relevant fixed versions and status.

Action Mailer is a framework for designing email service layers. Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the block_format helper in Action Mailer. Carefully crafted text can cause the block_format helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. As a workaround, users can avoid calling the block_format helper or upgrade to Ruby 3.2. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 requires Ruby 3.2 or greater so is unaffected.

CVSS Base Scores

version 3.1