Skip to content
Patch Next
Sign inAdd to your agent

← Public intelligence

RubyGems package

actionmailer

Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.

Open advisories

2 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.

  1. Medium, CVSS 6.6RubyGemsPublished

    Possible ReDoS vulnerability in block_format in Action Mailer

    CVE-2024-47889 · GHSA-h47h-mwp9-c6q6

    Affected
    • RubyGems actionmailer >= 3.0.0, < 6.1.7.9; >= 7.0.0, < 7.0.8.5; >= 7.1.0, < 7.1.4.1; >= 7.2.0, < 7.2.1.1
    Fixed in
    7.0.8.57.1.4.17.2.1.16.1.7.9· Vendor fix available
    Issue
    There is a possible ReDoS vulnerability in the blockformat helper in Action Mailer. This vulnerability has been assigned the CVE identifier CVE-2024-47889. Impact ------ Carefully crafted text can cause the blockformat helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or apply the relevant patch immediately. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 requires Ruby 3.2 or greater so is unaffected. Releases -------- The fixed releases are available at the normal locations. Workarounds ----------- Users can avoid calling the blockformat helper or upgrade to Ruby 3.2 Credits ------- Thanks to yukiosaki for the report!

    Recommended action: Upgrade to 7.2.1.1, 7.1.4.1, 7.0.8.5 or 6.1.7.9 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →
  2. UnratedRubyGemsPublished

    actionmailer email address processing causes Denial of service

    CVE-2013-4389 · GHSA-rg5m-3fqp-6px8

    Affected
    • RubyGems actionmailer >= 3.0.0, < 3.2.15
    Fixed in
    3.2.15· Vendor fix available
    Issue
    Multiple format string vulnerabilities in logsubscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.

    Recommended action: Upgrade to 3.2.15 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.

    Sources:github.comSource checked Evidence →