Description
Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rails | 1.2.5-1 | — |
| Debian 13 | rails | 1.2.5-1 | — |
| Debian 12 | rails | 1.2.5-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | rails | < 1.2.4 | 1.2.4 | GHSA-fjfg-q662-gm6j |
References
- ADV-2007-4238 vdb-entry
- ADV-2007-3508 vdb-entry
- TA07-352A third-party-advisory
- 28136 third-party-advisory
- 26096 vdb-entry
- GLSA-200711-17 vendor-advisory
- 40717 vdb-entry
- http://bugs.gentoo.org/show_bug.cgi?id=195315
- http://weblog.rubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release
- APPLE-SA-2007-12-17 vendor-advisory
- http://docs.info.apple.com/article.html?artnum=307179
- 27657 third-party-advisory
- http://dev.rubyonrails.org/ticket/8453