BSON rubygem contains potential denial of service

높음 7.5CVE-2015-4411 · GHSA-qh4w-7pw3-p4rp · Published 20/02/2020 · updated 17/06/2026

요약

CVE-2015-4411은(는) bson, bson (mongodb)에 영향을 주는 높음 (CVSS 7.5) 취약점입니다.
향후 30일 내 악용 확률(EPSS): 6.4%, 전체 취약점의 93.7%보다 높음.
조치: 3.0.4 이상으로 업데이트하세요.

Package	Affected versions	Patched versions
bson RubyGems	`< 3.0.4`	`3.0.4`
bson mongodb	`< 3.0.4`	`3.0.4`

Description

The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410.

NVD description

The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410.

References

nvd.nist.gov/vuln/detail/CVE-2015-4411 · ADVISORY
mongodb/bson-ruby commit 976da32 · WEB
mongodb/bson-ruby commit fef6f75 · WEB
mongoid/moped commit dd5a7c1 · WEB
bugzilla.redhat.com/show_bug.cgi · WEB
GitHub Advisory GHSA-qh4w-7pw3-p4rp · ADVISORY
mongodb/bson-ruby · PACKAGE
mongodb/bson-ruby · WEB
rubysec/ruby-advisory-db · WEB
homakov.blogspot.ru/2012/05/saferweb-injects-in-various-ruby.html · WEB

bson의 다른 취약점

모두 보기 →

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free

Package

Affected versions

Patched versions

bson

RubyGems

< 3.0.4

3.0.4

bson

mongodb

< 3.0.4

3.0.4

Description

NVD description