The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE: This issue is due to an incomplete fix to CVE-2015-4410.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The Moped::BSON::ObjecId.legal? method in mongodb/bson-ruby before 3.0.4 as used in rubygem-moped allows
    remote attackers to cause a denial of service (worker resource consumption) via a crafted string. NOTE:
    This issue is due to an incomplete fix to CVE-2015-4410. (CVE-2015-4411)

Security fix for CVE-2015-4411

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
423377	SCA: security update for bson (GHSA-qh4w-7pw3-p4rp)	Tenable Cloud Security	SCA Checks	high
423377	SCA: security update for bson (GHSA-qh4w-7pw3-p4rp)	Tenable Self-Hosted Container Security	SCA Checks	high
84752	Fedora 21 : rubygem-moped-1.5.3-1.fc21 (2015-11138)	Nessus	Fedora Local Security Checks	low
84751	Fedora 22 : rubygem-moped-1.5.3-1.fc22 (2015-11070)	Nessus	Fedora Local Security Checks	low

Detections

Analytics

CVE-2015-4411

high

Tenable Plugins

high

high

low

low