RubySec

Providing security resources for the Ruby community

CVE-2016-10707 (jquery-rails): Denial of Service in jquery

Denial of Service in jquery

Published: January 18, 2018

SECURITY IDENTIFIERS

GEM

jquery-rails

FRAMEWORK

Ruby on Rails

SEVERITY

CVSS v3.x: 7.5 (High)

CVSS v2.0: 5.0 (Medium)

UNAFFECTED VERSIONS

< 3.0.0-rc.1

PATCHED VERSIONS

>= 3.0.0

DESCRIPTION

Affected versions of jquery use a lowercasing logic on attribute names. When given a boolean attribute with a name that contains uppercase characters, jquery enters into an infinite recursion loop, exceeding the call stack limit, and resulting in a denial of service condition.

Recommendation

Update to version 3.0.0 or later.

RELATED