Vulnerability in ruby-actionpack-3.2 - Security Update
Summary
DLA-604-1: ruby-actionpack-3.2 - security update. Affects ruby-actionpack-3.2 versions < 3.2.6-6+deb7u3. Fixed in 3.2.6-6+deb7u3. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Background
ruby-actionpack-3.2 is a web-flow and rendering framework that is part of Rails. It provides functionality for handling HTTP requests, rendering views, and managing sessions. This vulnerability affects version 3.2.6-6+deb7u3 of the package in Debian 7 Wheezy.
Vulnerability Detail
Multiple vulnerabilities have been discovered in ruby-actionpack-3.2:
-
CVE-2015-7576: This vulnerability allows a remote attacker to determine valid user names and passwords using a timing attack during HTTP basic authentication.
-
CVE-2016-0751: An attacker can exploit this vulnerability to grow the global cache of MIME types indefinitely, potentially resulting in a denial of service.
-
CVE-2016-0752: This vulnerability allows a remote, unauthenticated attacker to render unexpected files and potentially execute arbitrary code by passing untrusted input to the render method.
-
CVE-2016-2097: Crafted requests to Action View might result in rendering files from arbitrary locations, including files beyond the application's view directory. This vulnerability is the result of an incomplete fix of CVE-2016-0752.
-
CVE-2016-2098: If a web application does not properly sanitize user inputs, an attacker might control the arguments of the render method, resulting in the possibility of executing arbitrary Ruby code.
-
CVE-2016-6316: This vulnerability allows for cross-site scripting (XSS) attacks in Action View, where text declared as HTML safe will not have quotes escaped when used as attribute values in tag helpers.
How To Fix
Minimum fixed version
3.2.6-6+deb7u3
This is the first release that contains the fix.
sudo apt-get install --only-upgrade ruby-actionpack-3.2Tip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
There are no known workarounds for these vulnerabilities.
Conclusion
Upgrading your ruby-actionpack-3.2 package to version 3.2.6-6+deb7u3 or later is crucial to protect your application from these vulnerabilities. For further support on vulnerability remediation, you can contact DevNack.com.
See every vulnerability recorded for ruby-actionpack-3.2 →
FAQ
ruby-actionpack-3.2 is a web-flow and rendering framework that is part of Rails. It provides functionality for handling HTTP requests, rendering views, and managing sessions.
These vulnerabilities can be exploited by remote attackers to determine valid user names and passwords, execute arbitrary code, perform denial of service attacks, and conduct cross-site scripting attacks.
Yes, upgrading to version 3.2.6-6+deb7u3 or later of the ruby-actionpack-3.2 package fixes these vulnerabilities.
No, there are no known workarounds for these vulnerabilities.
You can find more information about these vulnerabilities in the Debian LTS security advisories and the associated CVE identifiers.
Related vulnerabilities
Recent vulnerabilities recorded for ruby-actionpack-3.2.
