{"document":{"aggregate_severity":{"namespace":"https://www.suse.com/support/security/rating/","text":"moderate"},"category":"csaf_vex","csaf_version":"2.0","distribution":{"text":"Copyright 2024 SUSE LLC. All rights reserved.","tlp":{"label":"WHITE","url":"https://www.first.org/tlp/"}},"lang":"en","notes":[{"category":"summary","text":"SUSE CVE-2024-41128","title":"Title"},{"category":"description","text":"Action Pack is a framework for handling and responding to web requests. Starting in version 3.1.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatch. Carefully crafted query parameters can cause query parameter filtering to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to version 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. One may use Ruby 3.2 as a workaround. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.","title":"Description of the CVE"},{"category":"legal_disclaimer","text":"CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).","title":"Terms of use"}],"publisher":{"category":"vendor","contact_details":"https://www.suse.com/support/security/contact/","name":"SUSE Product Security Team","namespace":"https://www.suse.com/"},"references":[{"category":"external","summary":"CVE-2024-41128","url":"https://www.suse.com/security/cve/CVE-2024-41128"},{"category":"external","summary":"SUSE Security Ratings","url":"https://www.suse.com/support/security/rating/"},{"category":"external","summary":"SUSE Bug 1231730 for CVE-2024-41128","url":"https://bugzilla.suse.com/1231730"},{"category":"external","summary":"Advisory link for openSUSE-SU-2024:14479-1","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2ZXD3WUVCXVEO5FFUTSYTZJ7QX6AZ2IV/"},{"category":"external","summary":"Advisory link for openSUSE-SU-2025:15124-1","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3C5WPU2RXUSPKAI3EANLIGCY34ZDBZ4Y/"}],"title":"SUSE CVE CVE-2024-41128","tracking":{"current_release_date":"2025-05-19T00:58:24Z","generator":{"date":"2024-10-17T02:53:41Z","engine":{"name":"cve-database.git:bin/generate-csaf-vex.pl","version":"1"}},"id":"CVE-2024-41128","initial_release_date":"2024-10-17T02:53:41Z","revision_history":[{"date":"2024-10-17T02:53:41Z","number":"2","summary":"Current version"},{"date":"2024-11-08T03:58:47Z","number":"3","summary":"Current version"},{"date":"2024-11-09T03:59:42Z","number":"4","summary":"Current version"},{"date":"2024-11-10T03:55:24Z","number":"5","summary":"Current version"},{"date":"2025-01-02T04:00:18Z","number":"6","summary":"Current version"},{"date":"2025-01-12T00:22:15Z","number":"7","summary":"Current version"},{"date":"2025-02-14T04:43:30Z","number":"8","summary":"Current version"},{"date":"2025-02-16T04:35:34Z","number":"9","summary":"Current version"},{"date":"2025-03-13T12:57:10Z","number":"10","summary":"Current version"},{"date":"2025-03-15T04:51:41Z","number":"11","summary":"Current version"},{"date":"2025-04-24T13:37:35Z","number":"12","summary":"Current version"},{"date":"2025-05-19T00:58:24Z","number":"13","summary":"Current version"}],"status":"interim","version":"13"}},"product_tree":{"branches":[{"branches":[{"branches":[{"category":"product_name","name":"SUSE Linux Enterprise High Availability Extension 15 SP2","product":{"name":"SUSE Linux Enterprise High Availability Extension 15 SP2","product_id":"SUSE Linux Enterprise High Availability Extension 15 SP2","product_identification_helper":{"cpe":"cpe:/o:suse:sle-ha:15:sp2"}}},{"category":"product_name","name":"SUSE Linux Enterprise High Availability Extension 15 SP3","product":{"name":"SUSE Linux Enterprise High Availability Extension 15 SP3","product_id":"SUSE Linux Enterprise High Availability Extension 15 SP3","product_identification_helper":{"cpe":"cpe:/o:suse:sle-ha:15:sp3"}}},{"category":"product_name","name":"SUSE Linux Enterprise High Availability Extension 15 SP4","product":{"name":"SUSE Linux Enterprise High Availability Extension 15 SP4","product_id":"SUSE Linux Enterprise High Availability Extension 15 SP4","product_identification_helper":{"cpe":"cpe:/o:suse:sle-ha:15:sp4"}}},{"category":"product_name","name":"SUSE Linux Enterprise High Availability Extension 15 SP5","product":{"name":"SUSE Linux Enterprise High Availability Extension 15 SP5","product_id":"SUSE Linux Enterprise High Availability Extension 15 SP5","product_identification_helper":{"cpe":"cpe:/o:suse:sle-ha:15:sp5"}}},{"category":"product_name","name":"SUSE Linux Enterprise High Availability Extension 15 SP6","product":{"name":"SUSE Linux Enterprise High Availability Extension 15 SP6","product_id":"SUSE Linux Enterprise High Availability Extension 15 SP6","product_identification_helper":{"cpe":"cpe:/o:suse:sle-ha:15:sp6"}}},{"category":"product_name","name":"SUSE Linux Enterprise High Availability Extension 15 SP7","product":{"name":"SUSE Linux Enterprise High Availability Extension 15 SP7","product_id":"SUSE Linux Enterprise High Availability Extension 15 SP7","product_identification_helper":{"cpe":"cpe:/o:suse:sle-ha:15:sp7"}}},{"category":"product_name","name":"openSUSE Leap 15.5","product":{"name":"openSUSE Leap 15.5","product_id":"openSUSE Leap 15.5","product_identification_helper":{"cpe":"cpe:/o:opensuse:leap:15.5"}}},{"category":"product_name","name":"openSUSE Leap 15.6","product":{"name":"openSUSE Leap 15.6","product_id":"openSUSE Leap 15.6","product_identification_helper":{"cpe":"cpe:/o:opensuse:leap:15.6"}}},{"category":"product_name","name":"openSUSE Tumbleweed","product":{"name":"openSUSE Tumbleweed","product_id":"openSUSE Tumbleweed","product_identification_helper":{"cpe":"cpe:/o:opensuse:tumbleweed"}}},{"category":"product_version","name":"ruby2.5-rubygem-actionpack-5_1","product":{"name":"ruby2.5-rubygem-actionpack-5_1","product_id":"ruby2.5-rubygem-actionpack-5_1","product_identification_helper":{"purl":"pkg:rpm/suse/ruby2.5-rubygem@actionpack-5_1"}}},{"category":"product_version","name":"ruby2.5-rubygem-actionpack-doc-5_1","product":{"name":"ruby2.5-rubygem-actionpack-doc-5_1","product_id":"ruby2.5-rubygem-actionpack-doc-5_1","product_identification_helper":{"purl":"pkg:rpm/suse/ruby2.5-rubygem-actionpack@doc-5_1"}}},{"category":"product_version","name":"ruby3.3-rubygem-actionpack-7.0-7.0.8.6-1.1","product":{"name":"ruby3.3-rubygem-actionpack-7.0-7.0.8.6-1.1","product_id":"ruby3.3-rubygem-actionpack-7.0-7.0.8.6-1.1","product_identification_helper":{"purl":"pkg:rpm/suse/ruby3.3-rubygem-actionpack-7.0@7.0.8.6-1.1"}}},{"category":"product_version","name":"ruby3.3-rubygem-rails-7.0-7.0.8.6-1.1","product":{"name":"ruby3.3-rubygem-rails-7.0-7.0.8.6-1.1","product_id":"ruby3.3-rubygem-rails-7.0-7.0.8.6-1.1","product_identification_helper":{"purl":"pkg:rpm/suse/ruby3.3-rubygem-rails-7.0@7.0.8.6-1.1"}}},{"category":"product_version","name":"ruby3.4-rubygem-actionpack-7.0-7.0.8.6-1.3","product":{"name":"ruby3.4-rubygem-actionpack-7.0-7.0.8.6-1.3","product_id":"ruby3.4-rubygem-actionpack-7.0-7.0.8.6-1.3","product_identification_helper":{"purl":"pkg:rpm/suse/ruby3.4-rubygem-actionpack-7.0@7.0.8.6-1.3"}}},{"category":"product_version","name":"ruby3.4-rubygem-rails-7.0-7.0.8.6-1.3","product":{"name":"ruby3.4-rubygem-rails-7.0-7.0.8.6-1.3","product_id":"ruby3.4-rubygem-rails-7.0-7.0.8.6-1.3","product_identification_helper":{"purl":"pkg:rpm/suse/ruby3.4-rubygem-rails-7.0@7.0.8.6-1.3"}}},{"category":"product_version","name":"rubygem-actionpack-5_1","product":{"name":"rubygem-actionpack-5_1","product_id":"rubygem-actionpack-5_1","product_identification_helper":{"purl":"pkg:rpm/suse/rubygem@actionpack-5_1"}}}],"category":"product_family","name":"SUSE Linux Enterprise"}],"category":"vendor","name":"SUSE"}],"relationships":[{"category":"default_component_of","full_product_name":{"name":"ruby3.3-rubygem-actionpack-7.0-7.0.8.6-1.1 as component of openSUSE Tumbleweed","product_id":"openSUSE Tumbleweed:ruby3.3-rubygem-actionpack-7.0-7.0.8.6-1.1"},"product_reference":"ruby3.3-rubygem-actionpack-7.0-7.0.8.6-1.1","relates_to_product_reference":"openSUSE Tumbleweed"},{"category":"default_component_of","full_product_name":{"name":"ruby3.3-rubygem-rails-7.0-7.0.8.6-1.1 as component of openSUSE Tumbleweed","product_id":"openSUSE Tumbleweed:ruby3.3-rubygem-rails-7.0-7.0.8.6-1.1"},"product_reference":"ruby3.3-rubygem-rails-7.0-7.0.8.6-1.1","relates_to_product_reference":"openSUSE Tumbleweed"},{"category":"default_component_of","full_product_name":{"name":"ruby3.4-rubygem-actionpack-7.0-7.0.8.6-1.3 as component of openSUSE Tumbleweed","product_id":"openSUSE Tumbleweed:ruby3.4-rubygem-actionpack-7.0-7.0.8.6-1.3"},"product_reference":"ruby3.4-rubygem-actionpack-7.0-7.0.8.6-1.3","relates_to_product_reference":"openSUSE Tumbleweed"},{"category":"default_component_of","full_product_name":{"name":"ruby3.4-rubygem-rails-7.0-7.0.8.6-1.3 as component of openSUSE Tumbleweed","product_id":"openSUSE Tumbleweed:ruby3.4-rubygem-rails-7.0-7.0.8.6-1.3"},"product_reference":"ruby3.4-rubygem-rails-7.0-7.0.8.6-1.3","relates_to_product_reference":"openSUSE Tumbleweed"},{"category":"default_component_of","full_product_name":{"name":"ruby2.5-rubygem-actionpack-5_1 as component of SUSE Linux Enterprise High Availability Extension 15 SP2","product_id":"SUSE Linux Enterprise High Availability Extension 15 SP2:ruby2.5-rubygem-actionpack-5_1"},"product_reference":"ruby2.5-rubygem-actionpack-5_1","relates_to_product_reference":"SUSE Linux Enterprise High Availability Extension 15 SP2"},{"category":"default_component_of","full_product_name":{"name":"rubygem-actionpack-5_1 as component of SUSE Linux Enterprise High Availability Extension 15 SP2","product_id":"SUSE Linux Enterprise High Availability Extension 15 SP2:rubygem-actionpack-5_1"},"product_reference":"rubygem-actionpack-5_1","relates_to_product_reference":"SUSE Linux Enterprise High Availability Extension 15 SP2"},{"category":"default_component_of","full_product_name":{"name":"ruby2.5-rubygem-actionpack-5_1 as component of SUSE Linux Enterprise High Availability Extension 15 SP3","product_id":"SUSE Linux Enterprise High Availability Extension 15 SP3:ruby2.5-rubygem-actionpack-5_1"},"product_reference":"ruby2.5-rubygem-actionpack-5_1","relates_to_product_reference":"SUSE Linux Enterprise High Availability Extension 15 SP3"},{"category":"default_component_of","full_product_name":{"name":"rubygem-actionpack-5_1 as component of SUSE Linux Enterprise High Availability Extension 15 SP3","product_id":"SUSE Linux Enterprise High Availability Extension 15 SP3:rubygem-actionpack-5_1"},"product_reference":"rubygem-actionpack-5_1","relates_to_product_reference":"SUSE Linux Enterprise High Availability Extension 15 SP3"},{"category":"default_component_of","full_product_name":{"name":"ruby2.5-rubygem-actionpack-5_1 as component of SUSE Linux Enterprise High Availability Extension 15 SP4","product_id":"SUSE Linux Enterprise High Availability Extension 15 SP4:ruby2.5-rubygem-actionpack-5_1"},"product_reference":"ruby2.5-rubygem-actionpack-5_1","relates_to_product_reference":"SUSE Linux Enterprise High Availability Extension 15 SP4"},{"category":"default_component_of","full_product_name":{"name":"rubygem-actionpack-5_1 as component of SUSE Linux Enterprise High Availability Extension 15 SP4","product_id":"SUSE Linux Enterprise High Availability Extension 15 SP4:rubygem-actionpack-5_1"},"product_reference":"rubygem-actionpack-5_1","relates_to_product_reference":"SUSE Linux Enterprise High Availability Extension 15 SP4"},{"category":"default_component_of","full_product_name":{"name":"ruby2.5-rubygem-actionpack-5_1 as component of SUSE Linux Enterprise High Availability Extension 15 SP5","product_id":"SUSE Linux Enterprise High Availability Extension 15 SP5:ruby2.5-rubygem-actionpack-5_1"},"product_reference":"ruby2.5-rubygem-actionpack-5_1","relates_to_product_reference":"SUSE Linux Enterprise High Availability Extension 15 SP5"},{"category":"default_component_of","full_product_name":{"name":"rubygem-actionpack-5_1 as component of SUSE Linux Enterprise High Availability Extension 15 SP5","product_id":"SUSE Linux Enterprise High Availability Extension 15 SP5:rubygem-actionpack-5_1"},"product_reference":"rubygem-actionpack-5_1","relates_to_product_reference":"SUSE Linux Enterprise High Availability Extension 15 SP5"},{"category":"default_component_of","full_product_name":{"name":"ruby2.5-rubygem-actionpack-5_1 as component of SUSE Linux Enterprise High Availability Extension 15 SP6","product_id":"SUSE Linux Enterprise High Availability Extension 15 SP6:ruby2.5-rubygem-actionpack-5_1"},"product_reference":"ruby2.5-rubygem-actionpack-5_1","relates_to_product_reference":"SUSE Linux Enterprise High Availability Extension 15 SP6"},{"category":"default_component_of","full_product_name":{"name":"rubygem-actionpack-5_1 as component of SUSE Linux Enterprise High Availability Extension 15 SP6","product_id":"SUSE Linux Enterprise High Availability Extension 15 SP6:rubygem-actionpack-5_1"},"product_reference":"rubygem-actionpack-5_1","relates_to_product_reference":"SUSE Linux Enterprise High Availability Extension 15 SP6"},{"category":"default_component_of","full_product_name":{"name":"ruby2.5-rubygem-actionpack-5_1 as component of SUSE Linux Enterprise High Availability Extension 15 SP7","product_id":"SUSE Linux Enterprise High Availability Extension 15 SP7:ruby2.5-rubygem-actionpack-5_1"},"product_reference":"ruby2.5-rubygem-actionpack-5_1","relates_to_product_reference":"SUSE Linux Enterprise High Availability Extension 15 SP7"},{"category":"default_component_of","full_product_name":{"name":"rubygem-actionpack-5_1 as component of SUSE Linux Enterprise High Availability Extension 15 SP7","product_id":"SUSE Linux Enterprise High Availability Extension 15 SP7:rubygem-actionpack-5_1"},"product_reference":"rubygem-actionpack-5_1","relates_to_product_reference":"SUSE Linux Enterprise High Availability Extension 15 SP7"},{"category":"default_component_of","full_product_name":{"name":"ruby2.5-rubygem-actionpack-5_1 as component of openSUSE Leap 15.5","product_id":"openSUSE Leap 15.5:ruby2.5-rubygem-actionpack-5_1"},"product_reference":"ruby2.5-rubygem-actionpack-5_1","relates_to_product_reference":"openSUSE Leap 15.5"},{"category":"default_component_of","full_product_name":{"name":"ruby2.5-rubygem-actionpack-doc-5_1 as component of openSUSE Leap 15.5","product_id":"openSUSE Leap 15.5:ruby2.5-rubygem-actionpack-doc-5_1"},"product_reference":"ruby2.5-rubygem-actionpack-doc-5_1","relates_to_product_reference":"openSUSE Leap 15.5"},{"category":"default_component_of","full_product_name":{"name":"rubygem-actionpack-5_1 as component of openSUSE Leap 15.5","product_id":"openSUSE Leap 15.5:rubygem-actionpack-5_1"},"product_reference":"rubygem-actionpack-5_1","relates_to_product_reference":"openSUSE Leap 15.5"},{"category":"default_component_of","full_product_name":{"name":"ruby2.5-rubygem-actionpack-5_1 as component of openSUSE Leap 15.6","product_id":"openSUSE Leap 15.6:ruby2.5-rubygem-actionpack-5_1"},"product_reference":"ruby2.5-rubygem-actionpack-5_1","relates_to_product_reference":"openSUSE Leap 15.6"},{"category":"default_component_of","full_product_name":{"name":"ruby2.5-rubygem-actionpack-doc-5_1 as component of openSUSE Leap 15.6","product_id":"openSUSE Leap 15.6:ruby2.5-rubygem-actionpack-doc-5_1"},"product_reference":"ruby2.5-rubygem-actionpack-doc-5_1","relates_to_product_reference":"openSUSE Leap 15.6"},{"category":"default_component_of","full_product_name":{"name":"rubygem-actionpack-5_1 as component of openSUSE Leap 15.6","product_id":"openSUSE Leap 15.6:rubygem-actionpack-5_1"},"product_reference":"rubygem-actionpack-5_1","relates_to_product_reference":"openSUSE Leap 15.6"}]},"vulnerabilities":[{"cve":"CVE-2024-41128","ids":[{"system_name":"SUSE CVE Page","text":"https://www.suse.com/security/cve/CVE-2024-41128"}],"notes":[{"category":"general","text":"Action Pack is a framework for handling and responding to web requests. Starting in version 3.1.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the query parameter filtering routines of Action Dispatch. Carefully crafted query parameters can cause query parameter filtering to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to version 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. One may use Ruby 3.2 as a workaround. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.","title":"CVE description"}],"product_status":{"known_affected":["SUSE Linux Enterprise High Availability Extension 15 SP2:ruby2.5-rubygem-actionpack-5_1","SUSE Linux Enterprise High Availability Extension 15 SP2:rubygem-actionpack-5_1","SUSE Linux Enterprise High Availability Extension 15 SP3:ruby2.5-rubygem-actionpack-5_1","SUSE Linux Enterprise High Availability Extension 15 SP3:rubygem-actionpack-5_1","SUSE Linux Enterprise High Availability Extension 15 SP4:ruby2.5-rubygem-actionpack-5_1","SUSE Linux Enterprise High Availability Extension 15 SP4:rubygem-actionpack-5_1","SUSE Linux Enterprise High Availability Extension 15 SP5:ruby2.5-rubygem-actionpack-5_1","SUSE Linux Enterprise High Availability Extension 15 SP5:rubygem-actionpack-5_1","SUSE Linux Enterprise High Availability Extension 15 SP6:ruby2.5-rubygem-actionpack-5_1","SUSE Linux Enterprise High Availability Extension 15 SP6:rubygem-actionpack-5_1","SUSE Linux Enterprise High Availability Extension 15 SP7:ruby2.5-rubygem-actionpack-5_1","SUSE Linux Enterprise High Availability Extension 15 SP7:rubygem-actionpack-5_1","openSUSE Leap 15.5:ruby2.5-rubygem-actionpack-5_1","openSUSE Leap 15.5:ruby2.5-rubygem-actionpack-doc-5_1","openSUSE Leap 15.5:rubygem-actionpack-5_1","openSUSE Leap 15.6:ruby2.5-rubygem-actionpack-5_1","openSUSE Leap 15.6:ruby2.5-rubygem-actionpack-doc-5_1","openSUSE Leap 15.6:rubygem-actionpack-5_1"],"recommended":["openSUSE Tumbleweed:ruby3.3-rubygem-actionpack-7.0-7.0.8.6-1.1","openSUSE Tumbleweed:ruby3.3-rubygem-rails-7.0-7.0.8.6-1.1","openSUSE Tumbleweed:ruby3.4-rubygem-actionpack-7.0-7.0.8.6-1.3","openSUSE Tumbleweed:ruby3.4-rubygem-rails-7.0-7.0.8.6-1.3"]},"references":[{"category":"external","summary":"CVE-2024-41128","url":"https://www.suse.com/security/cve/CVE-2024-41128"},{"category":"external","summary":"SUSE Security Ratings","url":"https://www.suse.com/support/security/rating/"},{"category":"external","summary":"SUSE Bug 1231730 for CVE-2024-41128","url":"https://bugzilla.suse.com/1231730"},{"category":"external","summary":"Advisory link for openSUSE-SU-2024:14479-1","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/2ZXD3WUVCXVEO5FFUTSYTZJ7QX6AZ2IV/"},{"category":"external","summary":"Advisory link for openSUSE-SU-2025:15124-1","url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3C5WPU2RXUSPKAI3EANLIGCY34ZDBZ4Y/"}],"remediations":[{"category":"vendor_fix","details":"To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n","product_ids":["openSUSE Tumbleweed:ruby3.3-rubygem-actionpack-7.0-7.0.8.6-1.1","openSUSE Tumbleweed:ruby3.3-rubygem-rails-7.0-7.0.8.6-1.1","openSUSE Tumbleweed:ruby3.4-rubygem-actionpack-7.0-7.0.8.6-1.3","openSUSE Tumbleweed:ruby3.4-rubygem-rails-7.0-7.0.8.6-1.3"]}],"scores":[{"cvss_v3":{"baseScore":5.9,"baseSeverity":"MEDIUM","vectorString":"CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H","version":"3.1"},"products":["openSUSE Tumbleweed:ruby3.3-rubygem-actionpack-7.0-7.0.8.6-1.1","openSUSE Tumbleweed:ruby3.3-rubygem-rails-7.0-7.0.8.6-1.1","openSUSE Tumbleweed:ruby3.4-rubygem-actionpack-7.0-7.0.8.6-1.3","openSUSE Tumbleweed:ruby3.4-rubygem-rails-7.0-7.0.8.6-1.3"]}],"threats":[{"category":"impact","date":"2024-10-16T04:00:52Z","details":"moderate"}],"title":"CVE-2024-41128"}]}