Alerts This Week
Warning Icon 1 1,394
Alerts This Week
Warning Icon 1 1,394

Ubuntu 22.04 LTS USN-7290-1 High: Rails DoS Issues and Fix Instructions

ubuntu
Calendar Grey February 25, 2025
Dist Ubuntu Esm H88
Critical Rails vulnerabilities in Ubuntu 16.04-22.04 pose a DoS threat. Update your system and upgrade Rails to protect against potential attacks
Several security issues were fixed in Rails.

Summary

Several security issues were fixed in Rails.

Software Description:

- rails: MVC ruby based framework geared for web application development (

Details:

It was discovered that Rails did not correctly handle parsing block

formats in email service layers. An attacker could possibly use this

issue to cause a denial of service. (CVE-2024-47889)

It was discovered that Rails did not correctly handle parsing block

quotes in rich text content. An attacker could possibly use this issue

to cause a denial of service. This issue only affected Ubuntu 22.04 LTS.

(CVE-2024-47888)

It was discovered that Rails did not correctly handle parsing HTTP

token authentication headers. An attacker could possibly use this

issue to cause a denial of service. (CVE-2024-47887)

It was discovered that Rails did not correctly handle parsing query

parameters in web requests. An attacker could possibly use this issue

to cause a denial of service. (CVE-2024-41128)

Topics%20covered

Topics Covered

security advisory denial of service security issue software update Ubuntu ubuntu attack vector Rails rails

Update Instructions

The problem can be corrected by updating your system to the following
package versions:

Ubuntu 22.04 LTS
   rails                           2:6.1.4.1+dfsg-8ubuntu2+esm1
                                   Available with Ubuntu Pro
   ruby-actionmailer               2:6.1.4.1+dfsg-8ubuntu2+esm1
                                   Available with Ubuntu Pro
   ruby-actionpack                 2:6.1.4.1+dfsg-8ubuntu2+esm1
                                   Available with Ubuntu Pro
   ruby-actiontext                 2:6.1.4.1+dfsg-8ubuntu2+esm1
                                   Available with Ubuntu Pro

Ubuntu 20.04 LTS
   rails                           2:5.2.3+dfsg-3ubuntu0.1~esm1
                                   Available with Ubuntu Pro
   ruby-actionmailer               2:5.2.3+dfsg-3ubuntu0.1~esm1
                                   Available with Ubuntu Pro
   ruby-actionpack                 2:5.2.3+dfsg-3ubuntu0.1~esm1
                                   Available with Ubuntu Pro

Ubuntu 18.04 LTS
   rails                           2:4.2.10-0ubuntu4+esm1
                                   Available with Ubuntu Pro
   ruby-actionmailer               2:4.2.10-0ubuntu4+esm1
                                   Available with Ubuntu Pro
   ruby-actionpack                 2:4.2.10-0ubuntu4+esm1
                                   Available with Ubuntu Pro

Ubuntu 16.04 LTS
   rails                           2:4.2.6-1ubuntu0.1~esm1
                                   Available with Ubuntu Pro
   ruby-actionpack                 2:4.2.6-1ubuntu0.1~esm1
                                   Available with Ubuntu Pro

In general, a standard system update will make all the necessary changes.

References

https://ubuntu.com/security/notices/USN-7290-1

  CVE-2024-41128, CVE-2024-47887, CVE-2024-47888, CVE-2024-47889

Topics%20covered

Topics Covered

security advisory denial of service security issue software update Ubuntu ubuntu attack vector Rails rails

Package Information

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.

Your message here