The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service (worker resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Moped::BSON::ObjecId.legal? method in rubygem-moped before commit
    dd5a7c14b5d2e466f7875d079af71ad19774609b allows remote attackers to cause a denial of service (worker
    resource consumption) or perform a cross-site scripting (XSS) attack via a crafted string. (CVE-2015-4410)

Security fix for CVE-2015-4411

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
414409	SCA: security update for moped (GHSA-f93j-hmcr-jcwh)	Tenable Cloud Security	SCA Checks	high
414409	SCA: security update for moped (GHSA-f93j-hmcr-jcwh)	Tenable Self-Hosted Container Security	SCA Checks	high
84752	Fedora 21 : rubygem-moped-1.5.3-1.fc21 (2015-11138)	Nessus	Fedora Local Security Checks	low
84751	Fedora 22 : rubygem-moped-1.5.3-1.fc22 (2015-11070)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2015-4410

high

Tenable Plugins

high

high

low

low