PT-2022-7455
CVE-2022-23517
·
تاريخ النشر
2022-12-13
·
تاريخ التحديث
2026-03-13
الوصف من
CVSS 2.0
7.8
عاليةالمقاييسAV:N/AC:L/Au:N/C:N/I:N/A:C
Name of the Vulnerable Software and Affected Versions
rails-html-sanitizer versions < 1.4.4
Description
The issue is related to certain configurations of rails-html-sanitizer that use an inefficient regular expression. This inefficiency can lead to excessive backtracking when attempting to sanitize certain SVG attributes, resulting in a denial of service through CPU resource consumption. The vulnerability can be exploited by a remote attacker to cause a denial of service.
Recommendations
Upgrade to rails-html-sanitizer version 1.4.4 or later.
قابلية الاستغلال
استغلال
إصلاح
التأثيرات
المورّدون
المنتجات المتأثرة
وجدت خطأً في الوصف؟ لديك ما تضيفه؟ لا تتردد في مراسلتنا 👾