Explore top 10 tips to secure your open-source projects now. Read More
×
Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Loading...
Explore Latest Linux Security advisories
We found 5 articles for you...
89
security advisoryfedoraexploitFedora 39: FEDORA-2023-4f0bb4ff5e moderate: Activestorage File Permissions
Ruby on Rails security upgrade: - Versions-7-0-7-2-6-1-7-6-have-been-released - incorrect file permissions on encrypted files. Exploit not known.. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2023-4f0bb4ff5e 2023-09-15 18:36:13.240099 -------------------------------------------------------------------------------- Name : rubygem-activestorage Product : Fedora 39 Version : 7.0.7.2 Release : 1.fc39 URL : https://rubyonrails.org/ Summary : Local and cloud file storage framework Description : Attach cloud and local files in Rails applications. -------------------------------------------------------------------------------- Update Information: Ruby on Rails security upgrade: - Versions-7-0-7-2-6-1-7-6-have-been-released - incorrect file permissions on encrypted files. Exploit not known. -------------------------------------------------------------------------------- ChangeLog: * Mon Aug 28 2023 Pavel Valena - 7.0.7.2-1 - Update to activestorage 7.0.7.2. -------------------------------------------------------------------------------- This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-4f0bb4ff5e' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at -------------------------------------------------------------------------------- _______________________________________________ package-announce mailing list --
Sep 15, 2023
Fedora
89
security advisoryFedoraXSS issueFedora 37: FEDORA-2023-7002afbbb8 Critical: Rails ActionCable XSS
Update to Ruby on Rails 7.0.4.3. https://rubyonrails.org/2023/3/13/Rails-7-0-4-3-and-6-1-7-3-have-been-released. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2023-7002afbbb8 2023-04-05 01:34:43.146270 --------------------------------------------------------------------------------Name : rubygem-actioncable Product : Fedora 37 Version : 7.0.4.3 Release : 1.fc37 URL : https://rubyonrails.org/ Summary : WebSocket framework for Rails Description : Structure many real-time application concerns into channels over a single WebSocket connection. --------------------------------------------------------------------------------Update Information: Update to Ruby on Rails 7.0.4.3. https://rubyonrails.org/2023/3/13/Rails-7-0-4-3-and-6-1-7-3-have-been-released --------------------------------------------------------------------------------ChangeLog: * Tue Mar 14 2023 Pavel Valena - 7.0.4.3-1 - Update to actioncable 7.0.4.3. --------------------------------------------------------------------------------References: [ 1 ] Bug #2179637 - CVE-2023-28120 rubygem-activesupport: Possible XSS in SafeBuffer#bytesplice https://bugzilla.redhat.com/show_bug.cgi?id=2179637 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2023-7002afbbb8' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Apr 05, 2023
•Critical
Fedora
89
security advisoryfedoraupdate informationFedora 33 FEDORA-2020-4dd34860a3 Moderate XSS Risk in Image Processing
Upgrade to Ruby on Rails 6.0.3.3. Fixes CVEs: #1877568 #1831529 #1852381. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-4dd34860a3 2020-10-05 00:15:05.246453 --------------------------------------------------------------------------------Name : rubygem-image_processing Product : Fedora 33 Version : 1.11.0 Release : 1.fc33 URL : https://github.com/janko/image_processing Summary : High-level wrapper for processing images for the web with ImageMagick or libvips Description : High-level wrapper for processing images for the web with ImageMagick or libvips. --------------------------------------------------------------------------------Update Information: Upgrade to Ruby on Rails 6.0.3.3. Fixes CVEs: #1877568 #1831529 #1852381 --------------------------------------------------------------------------------ChangeLog: --------------------------------------------------------------------------------References: [ 1 ] Bug #1831529 - CVE-2020-5267 rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1831529 [ 2 ] Bug #1852381 - CVE-2020-8185 rubygem-rails: untrusted users able to run pending migrations in production [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1852381 [ 3 ] Bug #1877568 - CVE-2020-15169 rubygem-actionview: rubygem-activeview: Cross-site scripting in translation helpers [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1877568 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-4dd34860a3' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPGkey. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Oct 04, 2020
•Important
Fedora
89
security advisoryfedoraupdateFedora 33: FEDORA-2020-4dd34860a3 Moderate: Ruby on Rails XSS Fix
Upgrade to Ruby on Rails 6.0.3.3. Fixes CVEs: #1877568 #1831529 #1852381. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2020-4dd34860a3 2020-10-05 00:15:05.246453 --------------------------------------------------------------------------------Name : rubygem-actiontext Product : Fedora 33 Version : 6.0.3.3 Release : 1.fc33 URL : https://rubyonrails.org Summary : Rich text framework Description : Edit and display rich text in Rails applications. --------------------------------------------------------------------------------Update Information: Upgrade to Ruby on Rails 6.0.3.3. Fixes CVEs: #1877568 #1831529 #1852381 --------------------------------------------------------------------------------ChangeLog: * Tue Sep 22 2020 Pavel Valena - 6.0.3.3-1 - Update to actiontext 6.0.3.3. Resolves: rhbz#1877508 --------------------------------------------------------------------------------References: [ 1 ] Bug #1831529 - CVE-2020-5267 rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1831529 [ 2 ] Bug #1852381 - CVE-2020-8185 rubygem-rails: untrusted users able to run pending migrations in production [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1852381 [ 3 ] Bug #1877568 - CVE-2020-15169 rubygem-actionview: rubygem-activeview: Cross-site scripting in translation helpers [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1877568 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2020-4dd34860a3' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with the Fedora Project GPG key. Moredetails on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
Oct 04, 2020
•Important
Fedora
98
security advisorymoderatexss issueRed Hat Software Collections RHSA-2016:1856-01 Moderate XSS Issue
An update for rh-ror41-rubygem-actionview is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Moderate: rh-ror41-rubygem-actionview security update Advisory ID: RHSA-2016:1856-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2016:1856.html Issue date: 2016-09-13 CVE Names: CVE-2016-6316 ==================================================================== 1. Summary: An update for rh-ror41-rubygem-actionview is now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch 3. Description: Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component. Security Fix(es): * It wasdiscovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316) Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter. 4. Solution: For details on how to apply this update, which includes the changes described in this advisory, refer to: https://access.redhat.com/articles/11258 All running applications using rh-ror41-rubygem-actionviewmust be restarted for this update to take effect. 5. Bugs fixed (https://bugzilla.redhat.com/): 1365008 - CVE-2016-6316 rubygem-actionview: cross-site scripting flaw in Action View 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6): Source: rh-ror41-rubygem-actionview-4.1.5-6.el6.src.rpm noarch: rh-ror41-rubygem-actionview-4.1.5-6.el6.noarch.rpm rh-ror41-rubygem-actionview-doc-4.1.5-6.el6.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6): Source: rh-ror41-rubygem-actionview-4.1.5-6.el6.src.rpm noarch: rh-ror41-rubygem-actionview-4.1.5-6.el6.noarch.rpm rh-ror41-rubygem-actionview-doc-4.1.5-6.el6.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7): Source: rh-ror41-rubygem-actionview-4.1.5-6.el6.src.rpm noarch: rh-ror41-rubygem-actionview-4.1.5-6.el6.noarch.rpm rh-ror41-rubygem-actionview-doc-4.1.5-6.el6.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6): Source: rh-ror41-rubygem-actionview-4.1.5-6.el6.src.rpm noarch: rh-ror41-rubygem-actionview-4.1.5-6.el6.noarch.rpm rh-ror41-rubygem-actionview-doc-4.1.5-6.el6.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server (v.7): Source: rh-ror41-rubygem-actionview-4.1.5-6.el7.src.rpm noarch: rh-ror41-rubygem-actionview-4.1.5-6.el7.noarch.rpm rh-ror41-rubygem-actionview-doc-4.1.5-6.el7.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1): Source: rh-ror41-rubygem-actionview-4.1.5-6.el7.src.rpm noarch: rh-ror41-rubygem-actionview-4.1.5-6.el7.noarch.rpm rh-ror41-rubygem-actionview-doc-4.1.5-6.el7.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2): Source: rh-ror41-rubygem-actionview-4.1.5-6.el7.src.rpm noarch: rh-ror41-rubygem-actionview-4.1.5-6.el7.noarch.rpm rh-ror41-rubygem-actionview-doc-4.1.5-6.el7.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: rh-ror41-rubygem-actionview-4.1.5-6.el7.src.rpm noarch: rh-ror41-rubygem-actionview-4.1.5-6.el7.noarch.rpm rh-ror41-rubygem-actionview-doc-4.1.5-6.el7.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/ 7. References: https://access.redhat.com/security/cve/CVE-2016-6316 https://access.redhat.com/security/updates/classification/#moderate 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFX198pXlSAg2UNWIIRAtaRAJ40rTGE5OQvJcSTDcLGzfGfgD1J8wCfcDTw qa6PQ0emQrhPkLNKUjpFGpA=K/Ov -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Sep 13, 2016
Red Hat
98
security advisoryred hatrubyCentOS: CSA-2021:1123-01 Critical: php72 Service Disruption
Updated ruby193-rubygem-actionpack and ruby193-rubygem-activerecord packages that fix multiple security issues are now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having Important security. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Important: ruby193 security update Advisory ID: RHSA-2016:0455-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2016:0455.html Issue date: 2016-03-15 CVE Names: CVE-2015-7576 CVE-2015-7577 CVE-2016-0751 CVE-2016-0752 CVE-2016-2097 CVE-2016-2098 ==================================================================== 1. Summary: Updated ruby193-rubygem-actionpack and ruby193-rubygem-activerecord packages that fix multiple security issues are now available for Red Hat Software Collections. Red Hat Product Security has rated this update as having Important security impact. Common Vulnerability Scoring System (CVSS) base scores, which give detailed severity ratings, are available for each vulnerability from the CVE links in the References section. 2. Relevant releases/architectures: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) - noarch Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) - noarch 3. Description: The ruby193 collection providesRuby version 1.9.3 and Ruby on Rails version 3.2. Ruby on Rails is a model-view-controller (MVC) framework for web application development. The following issues were corrected in rubygem-actionpack: Multiple directory traversal flaws were found in the way the Action View component searched for templates for rendering. If an application passed untrusted input to the 'render' method, a remote, unauthenticated attacker could use these flaws to render unexpected files and, possibly, execute arbitrary code. (CVE-2016-0752, CVE-2016-2097) A code injection flaw was found in the way the Action View component searched for templates for rendering. If an application passed untrusted input to the 'render' method, a remote, unauthenticated attacker could use this flaw to execute arbitrary code. (CVE-2016-2098) A flaw was found in the way the Action Pack component performed MIME type lookups. Since queries were cached in a global cache of MIME types, an attacker could use this flaw to grow the cache indefinitely, potentially resulting in a denial of service. (CVE-2016-0751) A flaw was found in the way the Action Controller component compared user names and passwords when performing HTTP basic authentication. Time taken to compare strings could differ depending on input, possibly allowing a remote attacker to determine valid user names and passwords using a timing attack. (CVE-2015-7576) The following issue was corrected in rubygem-activerecord: A flaw was found in the Active Record component's handling of nested attributes in combination with the destroy flag. An attacker could possibly use this flaw to set attributes to invalid values or clear all attributes. (CVE-2015-7577) Red Hat would like to thank the Ruby on Rails project for reporting these issues. Upstream acknowledges John Poulin as the original reporter of CVE-2016-0752, Jyoti Singh and Tobias Kraze (makandra) as original reporters of CVE-2016-2097, Tobias Kraze (makandra) and joernchen (Phenoelit) as original reporters of CVE-2016-2098, Aaron Patterson(Red Hat) as the original reporter of CVE-2016-0751, Daniel Waterworth as the original reporter of CVE-2015-7576, and Justin Coyne as the original reporter of CVE-2015-7577. All ruby193 collection rubygem-actionpack and rubygem-activerecord packages users are advised to upgrade to these updated packages, which contain backported patches to correct these issues. All running applications using the ruby193 collection must be restarted for this update to take effect. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. For details on how to apply this update, refer to: https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1301933 - CVE-2015-7576 rubygem-actionpack: Timing attack vulnerability in basic authentication in Action Controller 1301946 - CVE-2016-0751 rubygem-actionpack: possible object leak and denial of service attack in Action Pack 1301957 - CVE-2015-7577 rubygem-activerecord: Nested attributes rejection proc bypass in Active Record 1301963 - CVE-2016-0752 rubygem-actionview, rubygem-actionpack: directory traversal flaw in Action View 1310043 - CVE-2016-2097 rubygem-actionview, rubygem-actionpack: directory traversal in Action View, incomplete CVE-2016-0752 fix 1310054 - CVE-2016-2098 rubygem-actionview, rubygem-actionpack: code injection vulnerability in Action View 6. Package List: Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6): Source: ruby193-rubygem-actionpack-3.2.8-16.el6.src.rpm ruby193-rubygem-activerecord-3.2.8-11.el6.src.rpm ruby193-rubygem-activesupport-3.2.8-6.el6.src.rpm noarch: ruby193-rubygem-actionpack-3.2.8-16.el6.noarch.rpm ruby193-rubygem-actionpack-doc-3.2.8-16.el6.noarch.rpm ruby193-rubygem-activerecord-3.2.8-11.el6.noarch.rpm ruby193-rubygem-activerecord-doc-3.2.8-11.el6.noarch.rpm ruby193-rubygem-activesupport-3.2.8-6.el6.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v.6.6): Source: ruby193-rubygem-actionpack-3.2.8-16.el6.src.rpm ruby193-rubygem-activerecord-3.2.8-11.el6.src.rpm ruby193-rubygem-activesupport-3.2.8-6.el6.src.rpm noarch: ruby193-rubygem-actionpack-3.2.8-16.el6.noarch.rpm ruby193-rubygem-actionpack-doc-3.2.8-16.el6.noarch.rpm ruby193-rubygem-activerecord-3.2.8-11.el6.noarch.rpm ruby193-rubygem-activerecord-doc-3.2.8-11.el6.noarch.rpm ruby193-rubygem-activesupport-3.2.8-6.el6.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7): Source: ruby193-rubygem-actionpack-3.2.8-16.el6.src.rpm ruby193-rubygem-activerecord-3.2.8-11.el6.src.rpm ruby193-rubygem-activesupport-3.2.8-6.el6.src.rpm noarch: ruby193-rubygem-actionpack-3.2.8-16.el6.noarch.rpm ruby193-rubygem-actionpack-doc-3.2.8-16.el6.noarch.rpm ruby193-rubygem-activerecord-3.2.8-11.el6.noarch.rpm ruby193-rubygem-activerecord-doc-3.2.8-11.el6.noarch.rpm ruby193-rubygem-activesupport-3.2.8-6.el6.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6): Source: ruby193-rubygem-actionpack-3.2.8-16.el6.src.rpm ruby193-rubygem-activerecord-3.2.8-11.el6.src.rpm ruby193-rubygem-activesupport-3.2.8-6.el6.src.rpm noarch: ruby193-rubygem-actionpack-3.2.8-16.el6.noarch.rpm ruby193-rubygem-actionpack-doc-3.2.8-16.el6.noarch.rpm ruby193-rubygem-activerecord-3.2.8-11.el6.noarch.rpm ruby193-rubygem-activerecord-doc-3.2.8-11.el6.noarch.rpm ruby193-rubygem-activesupport-3.2.8-6.el6.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7): Source: ruby193-rubygem-actionpack-3.2.8-16.el7.src.rpm ruby193-rubygem-activerecord-3.2.8-11.el7.src.rpm ruby193-rubygem-activesupport-3.2.8-6.el7.src.rpm noarch: ruby193-rubygem-actionpack-3.2.8-16.el7.noarch.rpm ruby193-rubygem-actionpack-doc-3.2.8-16.el7.noarch.rpm ruby193-rubygem-activerecord-3.2.8-11.el7.noarch.rpm ruby193-rubygem-activerecord-doc-3.2.8-11.el7.noarch.rpm ruby193-rubygem-activesupport-3.2.8-6.el7.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux ServerEUS (v. 7.1): Source: ruby193-rubygem-actionpack-3.2.8-16.el7.src.rpm ruby193-rubygem-activerecord-3.2.8-11.el7.src.rpm ruby193-rubygem-activesupport-3.2.8-6.el7.src.rpm noarch: ruby193-rubygem-actionpack-3.2.8-16.el7.noarch.rpm ruby193-rubygem-actionpack-doc-3.2.8-16.el7.noarch.rpm ruby193-rubygem-activerecord-3.2.8-11.el7.noarch.rpm ruby193-rubygem-activerecord-doc-3.2.8-11.el7.noarch.rpm ruby193-rubygem-activesupport-3.2.8-6.el7.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2): Source: ruby193-rubygem-actionpack-3.2.8-16.el7.src.rpm ruby193-rubygem-activerecord-3.2.8-11.el7.src.rpm ruby193-rubygem-activesupport-3.2.8-6.el7.src.rpm noarch: ruby193-rubygem-actionpack-3.2.8-16.el7.noarch.rpm ruby193-rubygem-actionpack-doc-3.2.8-16.el7.noarch.rpm ruby193-rubygem-activerecord-3.2.8-11.el7.noarch.rpm ruby193-rubygem-activerecord-doc-3.2.8-11.el7.noarch.rpm ruby193-rubygem-activesupport-3.2.8-6.el7.noarch.rpm Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7): Source: ruby193-rubygem-actionpack-3.2.8-16.el7.src.rpm ruby193-rubygem-activerecord-3.2.8-11.el7.src.rpm ruby193-rubygem-activesupport-3.2.8-6.el7.src.rpm noarch: ruby193-rubygem-actionpack-3.2.8-16.el7.noarch.rpm ruby193-rubygem-actionpack-doc-3.2.8-16.el7.noarch.rpm ruby193-rubygem-activerecord-3.2.8-11.el7.noarch.rpm ruby193-rubygem-activerecord-doc-3.2.8-11.el7.noarch.rpm ruby193-rubygem-activesupport-3.2.8-6.el7.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key 7.References: https://access.redhat.com/security/cve/CVE-2015-7576 https://access.redhat.com/security/cve/CVE-2015-7577 https://access.redhat.com/security/cve/CVE-2016-0751 https://access.redhat.com/security/cve/CVE-2016-0752 https://access.redhat.com/security/cve/CVE-2016-2097 https://access.redhat.com/security/cve/CVE-2016-2098 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2016 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFW6HmzXlSAg2UNWIIRAlodAJ4xsvfnvT+4dXQg6k8tXlybsUKMewCdHQ5U VaJQwkO55rBB9+BqLsW72aU=l7E9 -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Mar 15, 2016
•Important
Red Hat
91
security advisoryhigh severitygentooGentoo: GLSA-201412-28 High: Ruby on Rails Code Execution Risk
Multiple vulnerabilities were found in Ruby on Rails, the worst of which allowing for execution of arbitrary code.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201412-28 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: High Title: Ruby on Rails: Multiple vulnerabilities Date: December 14, 2014 Bugs: #354249, #379511, #386377, #450974, #453844, #456840, #462452 ID: 201412-28 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= Multiple vulnerabilities were found in Ruby on Rails, the worst of which allowing for execution of arbitrary code. Background ========= Ruby on Rails is a web-application and persistence framework. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-ruby/rails < 2.3.18 > = 2.3.18 * ------------------------------------------------------------------- NOTE: Packages marked with asterisks require manual intervention! Description ========== Multiple vulnerabilities have been discovered in Ruby on Rails. Please review the CVE identifiers referenced below for details. Impact ===== A remote attacker could execute arbitrary code or cause a Denial of Service condition. Furthermore, a remote attacker may be able to execute arbitrary SQL commands, change parameter names for form inputs and make changes to arbitrary records in the system, bypass intended access restrictions, render arbitrary views, inject arbitrary web script or HTML, or conduct cross-site request forgery (CSRF) attacks. Workaround ========= There is no knownworkaround at this time. Resolution ========= All Ruby on Rails 2.x users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot --verbose "> =dev-ruby/rails-2.3.18" NOTE: All applications using Ruby on Rails should also be configured to use the latest version available by running "rake rails:update" inside the application directory. NOTE: This is a legacy GLSA and stable updates for Ruby on Rails, including the unaffected version listed above, are no longer available from Gentoo. It may be possible to upgrade to the 3.2, 4.0, or 4.1 branches, however these packages are not currently stable. References ========= [ 1 ] CVE-2010-3933 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2010-3933 [ 2 ] CVE-2011-0446 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0446 [ 3 ] CVE-2011-0447 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0447 [ 4 ] CVE-2011-0448 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0448 [ 5 ] CVE-2011-0449 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-0449 [ 6 ] CVE-2011-2929 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2929 [ 7 ] CVE-2011-2930 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2930 [ 8 ] CVE-2011-2931 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2931 [ 9 ] CVE-2011-2932 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-2932 [ 10 ] CVE-2011-3186 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2011-3186 [ 11 ] CVE-2013-0155 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0155 [ 12 ] CVE-2013-0156 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0156 [ 13 ] CVE-2013-0276 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0276 [ 14 ] CVE-2013-0277 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0277 [ 15 ] CVE-2013-0333 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0333 [ 16 ] CVE-2013-1854 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1854 [ 17 ] CVE-2013-1855 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1855 [ 18 ] CVE-2013-1856 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1856 [ 19 ] CVE-2013-1857 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-1857 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201412-28 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Dec 14, 2014
Gentoo
98
security advisoryremote exploitred hatRed Hat Software Collections: RHSA-2014:1102-01 Important ActiveRecord Fix
Updated ror40-rubygem-activerecord packages that fix one security issue are now available for Red Hat Software Collections 1. Red Hat Product Security has rated this update as having Important security [More...]. ==================================================================== Red Hat Security Advisory Synopsis: Important: ror40-rubygem-activerecord security update Advisory ID: RHSA-2014:1102-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2014:1102.html Issue date: 2014-08-27 CVE Names: CVE-2014-3514 ==================================================================== 1. Summary: Updated ror40-rubygem-activerecord packages that fix one security issue are now available for Red Hat Software Collections 1. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) - noarch Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7) - noarch Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4) - noarch Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6) - noarch Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 7) - noarch 3. Description: Ruby on Rails is a model-view-controller (MVC) framework for web application development. Active Record implements object-relational mapping for accessing database entries using objects. It was discovered that Active Record's create_with method failed to properly check attributes passed to it. A remote attacker could possibly use this flaw to bypass the strong parameter protection and modify arbitrary model attributes via mass assignment if an application using Active Record calledcreate_with with untrusted values. (CVE-2014-3514) All ror40-rubygem-activerecord users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1131240 - CVE-2014-3514 rubygem-activerecord: Strong Parameter bypass with create_with 6. Package List: Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6): Source: ror40-rubygem-activerecord-4.0.2-2.3.el6.src.rpm noarch: ror40-rubygem-activerecord-4.0.2-2.3.el6.noarch.rpm ror40-rubygem-activerecord-doc-4.0.2-2.3.el6.noarch.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4): Source: ror40-rubygem-activerecord-4.0.2-2.3.el6.src.rpm noarch: ror40-rubygem-activerecord-4.0.2-2.3.el6.noarch.rpm ror40-rubygem-activerecord-doc-4.0.2-2.3.el6.noarch.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6): Source: ror40-rubygem-activerecord-4.0.2-2.3.el6.src.rpm noarch: ror40-rubygem-activerecord-4.0.2-2.3.el6.noarch.rpm ror40-rubygem-activerecord-doc-4.0.2-2.3.el6.noarch.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7): Source: ror40-rubygem-activerecord-4.0.2-2.3.el7.src.rpm noarch: ror40-rubygem-activerecord-4.0.2-2.3.el7.noarch.rpm ror40-rubygem-activerecord-doc-4.0.2-2.3.el7.noarch.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 7): Source: ror40-rubygem-activerecord-4.0.2-2.3.el7.src.rpm noarch: ror40-rubygem-activerecord-4.0.2-2.3.el7.noarch.rpm ror40-rubygem-activerecord-doc-4.0.2-2.3.el7.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are availablefrom https://access.redhat.com/security/team/key#package 7. References: https://access.redhat.com/security/cve/CVE-2014-3514 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2014 Red Hat, Inc. . Red Hat releases a vital security alert concerning the ror40-rubygem-activemodel update to enhance critical safeguarding.. Rubygem ActiveRecord, Red Hat Advisory, Software Update. . Severity: Important. LinuxSecurity.com Team
Aug 27, 2014
•Important
Red Hat
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
Should Linux servers automatically install security updates?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!