{"id":"CVE-2015-3225","published":"2015-07-26T22:00:00Z","modified":"2024-08-06T05:39:32Z","title":"lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other…","vendor":null,"product":null,"tier":"tail","description":{"text":"lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used with Ruby on Rails 3.x and 4.x and other products, allows remote attackers to cause a denial of service (SystemStackError) via a request with a large parameter depth.","provenance":"source","from":"CVE.org"},"cvss":null,"epss":{"score":0.07991,"percentile":0.94719,"provenance":"source"},"cwes":[],"references":[{"url":"http://lists.opensuse.org/opensuse-updates/2015-07/msg00043.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-07/msg00044.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://rhn.redhat.com/errata/RHSA-2015-2290.html","tags":["vendor-advisory","x_refsource_REDHAT"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-August/165180.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"https://github.com/rack/rack/blob/master/HISTORY.md","tags":["x_refsource_CONFIRM"]},{"url":"https://groups.google.com/forum/message/raw?msg=rubyonrails-security/gcUbICUmKMc/qiCotVZwXrMJ","tags":["mailing-list","x_refsource_MLIST"]},{"url":"http://www.debian.org/security/2015/dsa-3322","tags":["vendor-advisory","x_refsource_DEBIAN"]},{"url":"http://lists.opensuse.org/opensuse-updates/2015-07/msg00040.html","tags":["vendor-advisory","x_refsource_SUSE"]},{"url":"http://www.securityfocus.com/bid/75232","tags":["vdb-entry","x_refsource_BID"]},{"url":"http://lists.fedoraproject.org/pipermail/package-announce/2015-August/164173.html","tags":["vendor-advisory","x_refsource_FEDORA"]},{"url":"http://openwall.com/lists/oss-security/2015/06/16/14","tags":["mailing-list","x_refsource_MLIST"]}],"priority":{"score":18.9,"factors":[{"name":"EPSS percentile","points":18.94}]},"affected":[{"ecosystem":"RubyGems","package":"rack","vulnerableRanges":[">=1.5.0, <1.5.4",">=1.6.0, <1.6.2",">=1.4.0, <1.4.6"],"patched":["1.5.4","1.6.2","1.4.6"],"from":["GHSA-rgr4-9jh5-j4j6"],"provenance":"source"}],"euvd":{"id":"EUVD-2017-0302","exploited":false,"provenance":"source"}}