CVE-2024-41128

一、漏洞信息
 漏洞编号：[CVE-2024-41128](https://nvd.nist.gov/vuln/detail/CVE-2024-41128)
 漏洞归属组件：[rubygem-actionpack](https://gitee.com/src-openeuler/rubygem-actionpack)
 漏洞归属的版本：5.2.3,5.2.4.4,6.1.4.1,7.0.4,7.0.7
 CVSS V3.0分值：
  BaseScore：0.0 None
  Vector：CVSS：3.0/
 漏洞简述：
  Action Pack is a framework for handling and responding to web requests. Starting in version 3.1.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatch. Carefully crafted query parameters can cause query parameter filtering to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to version 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. One may use Ruby 3.2 as a workaround. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.
 漏洞公开时间：2024-10-17 02:15:06
 漏洞创建时间：2024-10-17 02:31:06
 漏洞详情参考链接：
  https://nvd.nist.gov/vuln/detail/CVE-2024-41128
<details>
<summary>更多参考(点击展开)</summary>

| 参考来源 | 参考链接 | 来源链接 |
| ------- | -------- | -------- |
| security-advisories.github.com | https://access.redhat.com/security/cve/cve-2024-41128 |  |
| security-advisories.github.com | https://bugzilla.redhat.com/show_bug.cgi?id=2319036 |  |
| security-advisories.github.com | https://github.com/rails/rails/commit/27121e80f6dbb260f5a9f0452cd8411cb681f075 |  |
| security-advisories.github.com | https://github.com/rails/rails/commit/b0fe99fa854ec8ff4498e75779b458392d1560ef |  |
| security-advisories.github.com | https://github.com/rails/rails/commit/b1241f468d1b32235f438c2e2203386e6efd3891 |  |
| security-advisories.github.com | https://github.com/rails/rails/commit/fb493bebae1a9b83e494fe7edbf01f6167d606fd |  |
| security-advisories.github.com | https://github.com/rails/rails/security/advisories/GHSA-x76w-6vjr-8xgj |  |
| suse_bugzilla | http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2024-41128 | https://bugzilla.suse.com/show_bug.cgi?id=1231730 |
| suse_bugzilla | https://bugzilla.redhat.com/show_bug.cgi?id=2319036 | https://bugzilla.suse.com/show_bug.cgi?id=1231730 |
| redhat_bugzilla | https://hackerone.com/scyoon | https://bugzilla.redhat.com/show_bug.cgi?id=2319036 |
| debian |  | https://security-tracker.debian.org/tracker/CVE-2024-41128 |
| ruby |  | https://github.com/rubysec/ruby-advisory-db/gems/actionpack/CVE-2024-41128.yml |
| ruby |  | https://discuss.rubyonrails.org/t/cve-2024-41128-possible-redos-vulnerability-in-query-parameter-filtering-in-action-dispatch/87699 |
| ruby |  | https://github.com//rails/rails/security/advisories/GHSA-x76w-6vjr-8xgj |
| github_advisory | https://github.com/rails/rails/security/advisories/GHSA-x76w-6vjr-8xgj | https://github.com/advisories/GHSA-x76w-6vjr-8xgj |

</details>

漏洞分析指导链接：
  https://gitee.com/openeuler/cve-manager/blob/master/cve-vulner-manager/doc/md/manual.md
 漏洞数据来源:
  openBrain开源漏洞感知系统
 漏洞补丁信息：
  <details>
<summary>详情(点击展开)</summary>

| 影响的包 | 修复版本 | 修复补丁 | 问题引入补丁 | 来源  |
| ------- | -------- | ------- | -------- | --------- |
|  |  | https://github.com/rails/rails/commit/27121e80f6dbb260f5a9f0452cd8411cb681f075 |  | security-advisories.github.com |
|  |  | https://github.com/rails/rails/commit/b0fe99fa854ec8ff4498e75779b458392d1560ef |  | security-advisories.github.com |
|  |  | https://github.com/rails/rails/commit/b1241f468d1b32235f438c2e2203386e6efd3891 |  | security-advisories.github.com |
|  |  | https://github.com/rails/rails/commit/fb493bebae1a9b83e494fe7edbf01f6167d606fd |  | security-advisories.github.com |

</details>

二、漏洞分析结构反馈
 影响性分析说明：
  Action Pack是一个用于处理和响应web请求的框架。从版本3.1.0开始，在版本6.1.7.9、7.0.8.5、7.1.4.1和7.2.1.1之前，Action Dispatch的查询参数过滤例程中可能存在ReDoS漏洞。精心设计的查询参数可能会导致查询参数筛选花费意外的时间，从而可能导致DoS漏洞。所有运行受影响版本的用户应升级到6.1.7.9、7.0.8.5、7.1.4.1或7.2.1.1版本，或立即应用相关补丁。可以使用Ruby 3.2作为解决方法。Ruby 3.2对此问题有缓解措施，因此使用Ruby 3.2或更高版本的Rails应用程序不受影响。Rails 8.0.0.beta1依赖于Ruby 3.2或更高版本，因此不受影响。
 openEuler评分：
  3.7
 Vector：CVSS：3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:L
 受影响版本排查(受影响/不受影响)：
  1.master(7.0.7):受影响
2.openEuler-20.03-LTS-SP4(5.2.4.4):受影响
3.openEuler-22.03-LTS-SP1(6.1.4.1):受影响
4.openEuler-22.03-LTS-SP3(6.1.4.1):受影响
5.openEuler-22.03-LTS-SP4(6.1.4.1):受影响
6.openEuler-24.03-LTS(7.0.7):受影响
7.openEuler-24.03-LTS-Next(7.0.7):受影响

修复是否涉及abi变化(是/否)：
  1.master(7.0.7):否
2.openEuler-20.03-LTS-SP4(5.2.4.4):否
3.openEuler-22.03-LTS-SP1(6.1.4.1):否
4.openEuler-22.03-LTS-SP3(6.1.4.1):否
5.openEuler-22.03-LTS-SP4(6.1.4.1):否
6.openEuler-24.03-LTS(7.0.7):否
7.openEuler-24.03-LTS-Next(7.0.7):否

原因说明：
  1.master(7.0.7):
2.openEuler-20.03-LTS-SP4(5.2.4.4):
3.openEuler-22.03-LTS-SP1(6.1.4.1):
4.openEuler-22.03-LTS-SP3(6.1.4.1):
5.openEuler-22.03-LTS-SP4(6.1.4.1):
6.openEuler-24.03-LTS(7.0.7):
7.openEuler-24.03-LTS-Next(7.0.7):
8.openEuler-24.03-LTS-SP1:

三、漏洞修复
安全公告链接：https://www.openeuler.org/zh/security/safety-bulletin/detail/?id=openEuler-SA-2024-2411

src-openEuler/rubygem-actionpack
Closed

Content Risk Flag

Comments (12)

src-openEuler/rubygem-actionpackClosed .gitee-modal { width: 500px !important; }

Content Risk Flag

CVE-2024-41128

Comments (12)

Search

src-openEuler/rubygem-actionpack
Closed