CVE-2024-47889: Actionmailer Denial of Service Vulnerability
MODERATECVE-2024-47889 is a MODERATE denial of service vulnerability (CWE-1333: Inefficient Regular Expression Complexity) affecting Actionmailer libraries in the RubyGems ecosystem. The issue involves possible redos vulnerability in block_format in action mailer. Remediation is available by upgrading affected packages to version 6.1.7.9, 7.0.8.5, 7.1.4.1, 7.2.1.1.
CVE-2024-47889 at a Glance
How to Fix CVE-2024-47889
To remediate this vulnerability, upgrade all affected Actionmailer dependencies to a patched release. Both direct and transitive dependencies should be checked, as frameworks or security libraries may pull in vulnerable versions transitively.
Upgrade actionmailer to 6.1.7.9Upgrade actionmailer to 7.0.8.5Upgrade actionmailer to 7.1.4.1Upgrade actionmailer to 7.2.1.1Run the following command in your project directory to verify that all resolved dependencies use the patched release:
inspect dependencies for actionmailerHow to Check if You Are Affected
To determine whether your application is affected by CVE-2024-47889, inspect your project dependencies for Actionmailer:
inspect dependencies for actionmailerAnalyze the terminal output to locate any version of Actionmailer in your dependency tree. If any resolved version matches the vulnerable ranges listed in the table below (for example, versions earlier than 6.1.7.9), your application is affected.
Note: Verify declared build manifests and deployed runtime container environments.
Technical Details
Vulnerability Mechanism & Technical Analysis
This vulnerability is classified under CWE-1333: Inefficient Regular Expression Complexity, where the product uses a regular expression with a worst-case computational complexity that is inefficient and possibly exponential. In Actionmailer, software state validation or input boundaries are circumvented during processing. Review the official source advisory statement below for specific affected components, classes, and reproduction details.
Source Advisory Statement
CVE-2024-47889 Affected Actionmailer Versions
4 component(s)| Product / Package | Ecosystem | Affected Versions | Fixed Version |
|---|---|---|---|
|
actionmailer
|
RubyGems |
≥ 3.0.0
< 6.1.7.9
|
6.1.7.9
|
|
actionmailer
|
RubyGems |
≥ 7.0.0
< 7.0.8.5
|
7.0.8.5
|
|
actionmailer
|
RubyGems |
≥ 7.1.0
< 7.1.4.1
|
7.1.4.1
|
|
actionmailer
|
RubyGems |
≥ 7.2.0
< 7.2.1.1
|
7.2.1.1
|
References
Frequently Asked Questions
What is CVE-2024-47889?
Which Actionmailer versions are affected?
What version fixes CVE-2024-47889?
Is actionmailer affected?
What CWE is associated with CVE-2024-47889?
How can I check RubyGems dependencies for CVE-2024-47889?
Machine-readable OSV JSON
OSV v1.5 Schema
{
"schema_version" : "1.4.0",
"id" : "GHSA-h47h-mwp9-c6q6",
"modified" : "2025-01-07T21:47:36Z",
"published" : "2024-10-15T23:35:38Z",
"aliases" : [ "CVE-2024-47889" ],
"summary" : "Possible ReDoS vulnerability in block_format in Action Mailer",
"details" : "There is a possible ReDoS vulnerability in the block_format helper in Action Mailer. This vulnerability has been assigned the CVE identifier CVE-2024-47889.\n\nImpact\n------\n\nCarefully crafted text can cause the block_format helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade or apply the relevant patch immediately.\n\nRuby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 requires Ruby 3.2 or greater so is unaffected.\n\n\nReleases\n--------\nThe fixed releases are available at the normal locations.\n\nWorkarounds\n-----------\nUsers can avoid calling the `block_format` helper or upgrade to Ruby 3.2\n\nCredits\n-------\n\nThanks to yuki_osaki for the report!",
"severity" : [ {
"type" : "CVSS_V4",
"score" : "CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:N/VI:N/VA:H/SC:N/SI:N/SA:N/E:U"
} ],
"affected" : [ {
"package" : {
"ecosystem" : "RubyGems",
"name" : "actionmailer"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "3.0.0"
}, {
"fixed" : "6.1.7.9"
} ]
} ]
}, {
"package" : {
"ecosystem" : "RubyGems",
"name" : "actionmailer"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "7.0.0"
}, {
"fixed" : "7.0.8.5"
} ]
} ]
}, {
"package" : {
"ecosystem" : "RubyGems",
"name" : "actionmailer"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "7.1.0"
}, {
"fixed" : "7.1.4.1"
} ]
} ]
}, {
"package" : {
"ecosystem" : "RubyGems",
"name" : "actionmailer"
},
"ranges" : [ {
"type" : "ECOSYSTEM",
"events" : [ {
"introduced" : "7.2.0"
}, {
"fixed" : "7.2.1.1"
} ]
} ]
} ],
"references" : [ {
"type" : "WEB",
"url" : "https://github.com/rails/rails/security/advisories/GHSA-h47h-mwp9-c6q6"
}, {
"type" : "PACKAGE",
"url" : "https://github.com/rails/rails"
}, {
"type" : "WEB",
"url" : "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionmailer/CVE-2024-47889.yml"
} ],
"database_specific" : {
"cwe_ids" : [ "CWE-1333" ],
"severity" : "MODERATE",
"github_reviewed" : true,
"github_reviewed_at" : "2024-10-15T23:35:38Z",
"nvd_published_at" : "2024-10-16T21:15:13Z"
}
}