activesupport vulnerable to Denial of Service via large XML document depth (GHSA-j96r-xvjq-r9pg)
Published: 2017-10-24T18:33:36Z
Aliases: CVE-2015-3227
Severity: MODERATE · CWE: 

The (1) `jdom.rb` and (2) `rexml.rb` components in Active Support in Ruby on Rails before 4.1.11 and 4.2.x before 4.2.2, when JDOM or REXML is enabled, allow remote attackers to cause a denial of service (SystemStackError) via a large XML document depth.

Affected packages:
package: ecosystem: RubyGems
name: activesupport
ranges: type: ECOSYSTEM
events: introduced: 0
fixed: 4.1.11
package: ecosystem: RubyGems
name: activesupport
ranges: type: ECOSYSTEM
events: introduced: 4.2.0
fixed: 4.2.2