Signal is active with 1 mentions in latest observed window
Recommended action window: Monitor and triage in normal cycle
NVD description
rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue has been patched in version 1.4.4.
Priority
LOW
Exploitation
NONE
PoC
NONE
Patch
AVAILABLE
Momentum
NONE
If you run products in this scope, you should treat this CVE as relevant to your environment.
1 version affected across 2 products
@make_now_just 確認したところ CVE-2022-23514 https://github.com/flavorjones/loofah/security/advisories/GHSA-486f-hjj9-9vhh もありました。 https://hackerone.com/reports/1684163 で CVE-2022-23517 と同じ原因だったため一緒に採番されていたものです。 他は記載されているとおりです
2 of 2 entries
| Part | Vendor | Product | Version | Target SW | Target HW |
|---|---|---|---|---|---|
| OS | debian | debian_linux | 10.0 | - | - |
| App | rubyonrails | rails_html_sanitizers | - | rails | - |