Re: CVE request: Ruby on Rails ActiveModel::Name to_json Call Infinite Loop Remote DoS

[cve-assign () mitre org]

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

As far as we can tell, the status of this is that:

  https://github.com/rubysec/ruby-advisory-db/issues/130#issuecomment-77688439

(in, more or less, the role of the upstream vendor) suggests an
alternative interpretation in which this is a bug but not a
vulnerability. The bug has been fixed:

  https://github.com/rails/rails/commit/a0580e974b4a058a983de6c593e4573bd94b76f0

As mentioned at:

  https://github.com/rails/rails/pull/19055#issuecomment-75798877

the bug made it possible to write code that had an unintentional
infinite loop. Apparently nobody has yet mentioned an actual or
realistic scenario in which the infinite looping can begin only after
a manipulation of input by a client.

- -- 
CVE assignment team, MITRE CVE Numbering Authority
M/S M300
202 Burlington Road, Bedford, MA 01730 USA
[ PGP key available through http://cve.mitre.org/cve/request_id.html ]
-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.4.14 (SunOS)

iQEcBAEBAgAGBQJU/xJiAAoJEKllVAevmvmsQe4H/iIDCXa5vM4lPC3Et3UTKooO
BKV0T3cxNTLwpWNz7tYEPaRTohompQTtE0E43Wm9RWB9ODI7taWGA3rOpUbhG+LO
wWQjIKkYc+ax0JD5q0tboqENnV9um0u7RqHid21diSXXACIq/37CDoGZgddScJso
yw1t2ZNZeJwe4IBsrxIrkSRG6RoeOfpRt+DuET/vEuTQRJdif/zri7MJp6FMCN/n
fK0jEFKb1D9WV1EPb/+e12h5SiyZHFCat6Gd5gckNXLHvhs3FfYtf5bIgV0vQR48
eOt1mAH7sh9eStvqndR+hkJHRsGRWs+o5NyWEYd+EBY3ZxOo4qJGSnnj6nZ4v6k=
=QZrH
-----END PGP SIGNATURE-----