{
  "cveId": "CVE-2024-47889",
  "url": "https://patchblox.com/security/cve/CVE-2024-47889",
  "summary": "CVE-2024-47889 is fixed in 14 products on 1 platform, first by rails 2:4.2.10-0ubuntu4\u002Besm1, released October 16, 2024. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "rails: Action Mailer is a framework for designing email service layers",
  "description": "Action Mailer is a framework for designing email service layers. Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the block_format helper in Action Mailer. Carefully crafted text can cause the block_format helper to take an unexpected amount of time, possibly resulting in a DoS vulnerability. All users running an affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. As a workaround, users can avoid calling the \u0060block_format\u0060 helper or upgrade to Ruby 3.2. Ruby 3.2 has mitigations for this problem, so Rails applications using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 requires Ruby 3.2 or greater so is unaffected.",
  "published": "2024-10-16T14:15:00Z",
  "severity": "Medium",
  "epss": 0.00937,
  "epssPercentile": 0.61081,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "fixes": [
    {
      "platform": "linux",
      "product": "rails",
      "release": "Debian 12.15 (bookworm)",
      "fixedVersion": "2:6.1.7.10\u002Bdfsg-1~deb12u1",
      "fix": "DEBIAN-CVE-2024-47889",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-47889",
      "released": "2024-10-16T21:15:13Z"
    },
    {
      "platform": "linux",
      "product": "rails",
      "release": "Debian 13.5 (trixie)",
      "fixedVersion": "2:7.2.2.1\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2024-47889",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-47889",
      "released": "2024-10-16T21:15:13Z"
    },
    {
      "platform": "linux",
      "product": "rails",
      "release": "Debian 14",
      "fixedVersion": "2:7.2.2.1\u002Bdfsg-1",
      "fix": "DEBIAN-CVE-2024-47889",
      "url": "https://patchblox.com/security/fix/linux/debian-cve-2024-47889",
      "released": "2024-10-16T21:15:13Z"
    },
    {
      "platform": "linux",
      "product": "rails",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2:4.2.10-0ubuntu4\u002Besm1",
      "fix": "rails 2:4.2.10-0ubuntu4\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-rails-2-4.2.10-0ubuntu4-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "rails",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "fix": "rails 2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-rails-2-5.2.3-dfsg-3ubuntu0.1-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "rails",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "fix": "rails 2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-rails-2-6.1.4.1-dfsg-8ubuntu2-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-actioncable",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "fix": "ruby-actioncable 2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ruby-actioncable-2-5.2.3-dfsg-3ubuntu0.1-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-actioncable",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "fix": "ruby-actioncable 2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ruby-actioncable-2-6.1.4.1-dfsg-8ubuntu2-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-actionmailbox",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "fix": "ruby-actionmailbox 2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ruby-actionmailbox-2-6.1.4.1-dfsg-8ubuntu2-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-actionmailer",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2:4.2.10-0ubuntu4\u002Besm1",
      "fix": "ruby-actionmailer 2:4.2.10-0ubuntu4\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ruby-actionmailer-2-4.2.10-0ubuntu4-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-actionmailer",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "fix": "ruby-actionmailer 2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ruby-actionmailer-2-5.2.3-dfsg-3ubuntu0.1-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-actionmailer",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "fix": "ruby-actionmailer 2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ruby-actionmailer-2-6.1.4.1-dfsg-8ubuntu2-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-actionpack",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2:4.2.10-0ubuntu4\u002Besm1",
      "fix": "ruby-actionpack 2:4.2.10-0ubuntu4\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ruby-actionpack-2-4.2.10-0ubuntu4-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-actionpack",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "fix": "ruby-actionpack 2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ruby-actionpack-2-5.2.3-dfsg-3ubuntu0.1-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-actionpack",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "fix": "ruby-actionpack 2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ruby-actionpack-2-6.1.4.1-dfsg-8ubuntu2-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-actiontext",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "fix": "ruby-actiontext 2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ruby-actiontext-2-6.1.4.1-dfsg-8ubuntu2-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-actionview",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2:4.2.10-0ubuntu4\u002Besm1",
      "fix": "ruby-actionview 2:4.2.10-0ubuntu4\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ruby-actionview-2-4.2.10-0ubuntu4-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-actionview",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "fix": "ruby-actionview 2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ruby-actionview-2-5.2.3-dfsg-3ubuntu0.1-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-actionview",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "fix": "ruby-actionview 2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ruby-actionview-2-6.1.4.1-dfsg-8ubuntu2-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-activejob",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2:4.2.10-0ubuntu4\u002Besm1",
      "fix": "ruby-activejob 2:4.2.10-0ubuntu4\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ruby-activejob-2-4.2.10-0ubuntu4-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-activejob",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "fix": "ruby-activejob 2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ruby-activejob-2-5.2.3-dfsg-3ubuntu0.1-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-activejob",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "fix": "ruby-activejob 2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ruby-activejob-2-6.1.4.1-dfsg-8ubuntu2-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-activemodel",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2:4.2.10-0ubuntu4\u002Besm1",
      "fix": "ruby-activemodel 2:4.2.10-0ubuntu4\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ruby-activemodel-2-4.2.10-0ubuntu4-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-activemodel",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "fix": "ruby-activemodel 2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ruby-activemodel-2-5.2.3-dfsg-3ubuntu0.1-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-activemodel",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "fix": "ruby-activemodel 2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ruby-activemodel-2-6.1.4.1-dfsg-8ubuntu2-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-activerecord",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2:4.2.10-0ubuntu4\u002Besm1",
      "fix": "ruby-activerecord 2:4.2.10-0ubuntu4\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ruby-activerecord-2-4.2.10-0ubuntu4-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-activerecord",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "fix": "ruby-activerecord 2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ruby-activerecord-2-5.2.3-dfsg-3ubuntu0.1-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-activerecord",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "fix": "ruby-activerecord 2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ruby-activerecord-2-6.1.4.1-dfsg-8ubuntu2-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-activestorage",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "fix": "ruby-activestorage 2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ruby-activestorage-2-5.2.3-dfsg-3ubuntu0.1-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-activestorage",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "fix": "ruby-activestorage 2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ruby-activestorage-2-6.1.4.1-dfsg-8ubuntu2-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-activesupport",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2:4.2.10-0ubuntu4\u002Besm1",
      "fix": "ruby-activesupport 2:4.2.10-0ubuntu4\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ruby-activesupport-2-4.2.10-0ubuntu4-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-activesupport",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "fix": "ruby-activesupport 2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ruby-activesupport-2-5.2.3-dfsg-3ubuntu0.1-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-activesupport",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "fix": "ruby-activesupport 2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ruby-activesupport-2-6.1.4.1-dfsg-8ubuntu2-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-rails",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2:4.2.10-0ubuntu4\u002Besm1",
      "fix": "ruby-rails 2:4.2.10-0ubuntu4\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ruby-rails-2-4.2.10-0ubuntu4-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-rails",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "fix": "ruby-rails 2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ruby-rails-2-5.2.3-dfsg-3ubuntu0.1-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-rails",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "fix": "ruby-rails 2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ruby-rails-2-6.1.4.1-dfsg-8ubuntu2-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-railties",
      "release": "Ubuntu 18.04.6 LTS (bionic)",
      "fixedVersion": "2:4.2.10-0ubuntu4\u002Besm1",
      "fix": "ruby-railties 2:4.2.10-0ubuntu4\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-bionic-ruby-railties-2-4.2.10-0ubuntu4-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-railties",
      "release": "Ubuntu 20.04 LTS (focal)",
      "fixedVersion": "2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "fix": "ruby-railties 2:5.2.3\u002Bdfsg-3ubuntu0.1~esm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-focal-ruby-railties-2-5.2.3-dfsg-3ubuntu0.1-esm1",
      "released": "2024-10-16T14:15:00Z"
    },
    {
      "platform": "linux",
      "product": "ruby-railties",
      "release": "Ubuntu 22.04.1 LTS (jammy)",
      "fixedVersion": "2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "fix": "ruby-railties 2:6.1.4.1\u002Bdfsg-8ubuntu2\u002Besm1",
      "url": "https://patchblox.com/security/fix/linux/ubuntu-jammy-ruby-railties-2-6.1.4.1-dfsg-8ubuntu2-esm1",
      "released": "2024-10-16T14:15:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-08T06:59:42Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}