CVE-2015-4411
Publicada em · Atualizada em
Aviso por e-mail quando ela entrar no KEV, ganhar PoC pública ou subir de nota.
3Vexday Risk Score
Sem sinal de exploração. Nenhum artefato público de exploração conhecido até agora.
ssvc Trackepss 6.4%
The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410.
Produtos afetados
n/a · n/aReferências
http://lists.fedoraproject.org/pipermail/package-announce/2015-July/161964.htmlhttp://lists.fedoraproject.org/pipermail/package-announce/2015-July/161987.htmlhttps://bugzilla.redhat.com/show_bug.cgi?id=1229706https://github.com/mongodb/bson-ruby/commit/976da329ff03ecdfca3030eb6efe3c85e6db9999https://github.com/mongodb/bson-ruby/commit/fef6f75413511d653c76bf924a932374a183a24f#diff-8c8558c185bbb548ccb5a6d6ac4bfee5R191https://github.com/mongodb/bson-ruby/compare/7446d7c6764dfda8dc4480ce16d5c023e74be5ca...28f34978a85b689a4480b4d343389bf4886522e7https://github.com/mongoid/moped/commit/dd5a7c14b5d2e466f7875d079af71ad19774609b#diff-3b93602f64c2fe46d38efd9f73ef5358R24https://homakov.blogspot.ru/2012/05/saferweb-injects-in-various-ruby.htmlhttps://sakurity.com/blog/2015/06/04/mongo_ruby_regexp.htmlhttps://seclists.org/oss-sec/2015/q2/653https://security-tracker.debian.org/tracker/CVE-2015-4411https://www.securityfocus.com/bid/75045