Skip to content
OpenAdvisories
Medium WID-SEC-2022-0341 4 CVEs

Ruby on Rails: Mehrere Schwachstellen

Published May 5, 2021 · Updated Dec 8, 2022 · Revision 8 · de-DE

Vendor: Debian Vendor: Red Hat Vendor: SUSE Product: Enterprise Linux Product: Linux Product: Linux

Summary

Ein Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um Informationen offenzulegen, einen Denial of Service Zustand auszulösen und Sicherheitsmaßnahmen zu umgehen.

Product

Ruby on Rails ist ein in der Programmiersprache Ruby geschriebenes und quelloffenes Web Application Framework.

Vulnerabilities 4

  • High 7.5
    CVE-2021-22885

    Action Pack contains Information Disclosure / Unintended Method Execution vulnerability

    A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input.

    rails rails actionpack Debian Ubuntu RubyGems
  • High 7.5
    CVE-2021-22902

    Denial of Service in Action Dispatch

    The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause t…

    rails rails actionpack Debian Ubuntu RubyGems
  • High 7.5
    CVE-2021-22904

    Possible DoS Vulnerability in Action Controller Token Authentication

    The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_requ…

    rails rails actionpack Debian Ubuntu RubyGems
  • Medium 6.1
    CVE-2021-22903

    Possible Open Redirect Vulnerability in Action Pack

    The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a mal…

    rails actionpack Ubuntu RubyGems

Revision history

  1. #8

    Neue Updates von SUSE aufgenommen

  2. #7

    Neue Updates von SUSE aufgenommen

  3. #6

    Neue Updates von Red Hat aufgenommen

  4. #5

    Neue Updates von Debian aufgenommen

  5. #4

    Neue Updates von SUSE aufgenommen

  6. #3

    Neue Updates von SUSE aufgenommen

  7. #2

    Neue Updates von Debian aufgenommen

  8. #1

    Initiale Fassung

References