CVE-2016-0751
A flaw was found in the way the Action Pack component performed MIME type lookups. Since queries were cached in a global cache of MIME types, an attacker could use this flaw to grow the cache indefinitely, potentially resulting in a denial of service.
Find out more about CVE-2016-0751 from the MITRE CVE dictionary dictionary and NIST NVD.
CVSS v2 metrics
| Base Score | 4.3 |
|---|---|
| Base Metrics | AV:N/AC:M/Au:N/C:N/I:N/A:P |
| Access Vector | Network |
| Access Complexity | Medium |
| Authentication | None |
| Confidentiality Impact | None |
| Integrity Impact | None |
| Availability Impact | Partial |
Find out more about Red Hat support for the Common Vulnerability Scoring System (CVSS).
Red Hat Security Errata
| Platform | Errata | Release Date |
|---|---|---|
| Red Hat Software Collections for Red Hat Enterprise Linux 7 (rh-ror41-rubygem-actionpack) | RHSA-2016:0296 | 2016-02-24 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 (ruby193-rubygem-actionpack) | RHSA-2016:0455 | 2016-03-15 |
| Red Hat Software Collections for Red Hat Enterprise Linux 7 (ror40-rubygem-actionpack) | RHSA-2016:0454 | 2016-03-15 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 (rh-ror41-rubygem-actionpack) | RHSA-2016:0296 | 2016-02-24 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 (ror40-rubygem-actionpack) | RHSA-2016:0454 | 2016-03-15 |
| Red Hat Software Collections for Red Hat Enterprise Linux 6 (ruby193-rubygem-actionpack) | RHSA-2016:0455 | 2016-03-15 |
Affected Packages State
| Platform | Package | State |
|---|---|---|
| Red Hat Subscription Asset Manager 1 | ruby193-rubygem-actionpack | Will not fix |
| Red Hat Subscription Asset Manager 1 | rubygem-actionpack | Will not fix |
Acknowledgements
Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Aaron Patterson of Red Hat as the original reporter.Mitigation
Use following code to monkey-patch mime types cache and disable caching.
require 'action_dispatch/http/mime_type'
Mime.const_set :LOOKUP, Hash.new { |h,k|
Mime::Type.new(k) unless k.blank?
}
Alternatively perform filtering of mime types in the Accept header to allow only known types.