CVE-2024-47888: Actiontext Denial of Service Vulnerability
MODERATECVE-2024-47888 is a MODERATE denial of service vulnerability (CWE-1333: Inefficient Regular Expression Complexity) affecting Actiontext libraries in the RubyGems ecosystem. The issue involves possible redos vulnerability in plain_text_for_blockquote_node in action text. Remediation is available by upgrading affected packages to version 6.1.7.9, 7.0.8.5, 7.1.4.1, 7.2.1.1.
CVE-2024-47888 at a Glance
How to Fix CVE-2024-47888
To remediate this vulnerability, upgrade all affected Actiontext dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade actiontext to 6.1.7.9Upgrade actiontext to 7.0.8.5Upgrade actiontext to 7.1.4.1Upgrade actiontext to 7.2.1.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for actiontextHow to Check if You Are Affected
To determine whether your application is affected by CVE-2024-47888, inspect your project dependencies for Actiontext:
inspect dependencies for actiontextAnalyze the terminal output to locate any version of Actiontext in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 6.1.7.9), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-1333: Inefficient Regular Expression Complexity, where the product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential. In Actiontext, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2024-47888 Affected Actiontext Versions
4 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
actiontext
|
RubyGems |
≥ 6.0.0
< 6.1.7.9
|
6.1.7.9
|
|
actiontext
|
RubyGems |
≥ 7.0.0
< 7.0.8.5
|
7.0.8.5
|
|
actiontext
|
RubyGems |
≥ 7.1.0
< 7.1.4.1
|
7.1.4.1
|
|
actiontext
|
RubyGems |
≥ 7.2.0
< 7.2.1.1
|
7.2.1.1
|
References
Frequently Asked Questions
What is CVE-2024-47888?
Which Actiontext versions are affected?
What version fixes CVE-2024-47888?
Is actiontext affected?
What CWE is associated with CVE-2024-47888?
How can I check RubyGems dependencies for CVE-2024-47888?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-wwhv-wxv9-rpgw",
"modified" : "2024-12-02T19:53:42Z",
"published" : "2024-10-15T23:35:36Z",
"aliases" : [ "CVE-2024-47888" ],
"summary" : "Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action Text",
"details" : "There is a possible ReDoS vulnerability in the plain_text_for_blockquote_node helper in Action Text. This vulnerability has been assigned the CVE identifier CVE-2024-47888.\n\nImpact\n------\n\nCarefully crafted text can cause the plain_text_for_blockquote_node helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or apply the relevant patch immediately.\n\nRuby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.\n\n\nReleases\n--------\nThe fixed releases are available at the normal locations.\n\nWorkarounds\n-----------\nUsers can avoid calling `plain_text_for_blockquote_node` or upgrade to Ruby 3.2\n\nCredits\n-------\n\nThanks to [ooooooo_q](https://hackerone.com/ooooooo_q) for the report!",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "RubyGems",
"name" : "actiontext"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "6.0.0"
}, {
"fixed" : "6.1.7.9"
} ]
} ]
}, {
"package" : {
"ecosystem" : "RubyGems",
"name" : "actiontext"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "7.0.0"
}, {
"fixed" : "7.0.8.5"
} ]
} ]
}, {
"package" : {
"ecosystem" : "RubyGems",
"name" : "actiontext"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "7.1.0"
}, {
"fixed" : "7.1.4.1"
} ]
} ]
}, {
"package" : {
"ecosystem" : "RubyGems",
"name" : "actiontext"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "7.2.0"
}, {
"fixed" : "7.2.1.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/rails/rails/security/advisories/GHSA-wwhv-wxv9-rpgw"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/rails/rails"
}, {
"type" : "WEB",
"url" : "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actiontext/CVE-2024-47888.yml"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-1333" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2024-10-15T23:35:36Z",
"nvd_published_at" : "2024-10-16T21:15:13Z"
}
}