CVE-2013-4389: Possible DoS Vulnerability

October 16, 2013 (updated August 8, 2019)

A carefully crafted email address in conjunction with the Action Mailer logger format string could take advantage of a bug in Ruby’s sprintf implementation and possibly lead to a denial of service attack. Impacted Ruby code will look something like this: "some string #{user_input}" % some_number

References

seclists.org/oss-sec/2013/q4/118

Code Behaviors & Features

Detect and mitigate CVE-2013-4389 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →