Rails ActionMailer ReDoS in block_format (v3.0-7.2.1.1) - upgrade
CVE-2024-47889 Published on October 16, 2024
Action Mailer is a framework for designing email service layers. Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the block_format helper in Action Mailer. Carefully crafted text can cause the block_format helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. As a workaround, users can avoid calling the `block_format` helper or upgrade to Ruby 3.2. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 requires Ruby 3.2 or greater so is unaffected.
Weakness Type
What is a ReDoS Vulnerability?
The product uses a regular expression with an inefficient, possibly exponential worst-case computational complexity that consumes excessive CPU cycles. Some regular expression engines have a feature called "backtracking". If the token cannot match, the engine "backtracks" to a position that may result in a different token that can match. Backtracking becomes a weakness if all of these conditions are met:
CVE-2024-47889 has been classified to as a ReDoS vulnerability or weakness.
Products Associated with CVE-2024-47889
You can be notified by email with stack.watch whenever vulnerabilities like CVE-2024-47889 are published in these products:
Affected Versions
rails:- Version >= 3.0.0, < 6.1.7.9 is affected.
- Version >= 7.0.0, < 7.0.8.5 is affected.
- Version >= 7.1.0, < 7.1.4.1 is affected.
- Version >= 7.2.0, < 7.2.1.1 is affected.
- Version 3.0.0 and below 6.1.7.9 is affected.
- Version 7.0.0 and below 7.0.8.5 is affected.
- Version 7.1.0 and below 7.1.4.1 is affected.
- Version 7.2.0 and below 7.2.1.1 is affected.
Vulnerable Packages
The following package name and versions may be associated with CVE-2024-47889
| Package Manager | Vulnerable Package | Versions | Fixed In |
|---|---|---|---|
| rubygems | actionmailer | >= 3.0.0, < 6.1.7.9 | 6.1.7.9 |
| rubygems | actionmailer | >= 7.0.0, < 7.0.8.5 | 7.0.8.5 |
| rubygems | actionmailer | >= 7.1.0, < 7.1.4.1 | 7.1.4.1 |
| rubygems | actionmailer | >= 7.2.0, < 7.2.1.1 | 7.2.1.1 |
Exploit Probability
EPSS (Exploit Prediction Scoring System) scores estimate the probability that a vulnerability will be exploited in the wild within the next 30 days. The percentile shows you how this score compares to all other vulnerabilities.