NetSight
IP …
medium5.0

CVE-2014-0082

actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text opt…

Impact

actionpack/lib/action_view/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.

Affected products

VendorProductAffected versions
RubyonrailsRails
Versions 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5
RubyonrailsRuby On Rails
through 3.2.16
Versions 3.0.4, 3.2.14, 3.2.15

Weakness classification

CWE-20

References