Most recent entries from all

bdu:2021-05203

certfr-2021-avi-352 — De multiples vulnérabilités ont été découvertes dans Ruby-on-rails. Elles permettent à un attaquant de provoquer un dén…

certfr-2021-avi-352

EUVD-2026-23198

fkie_cve-2021-22904

The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication.

GHSA-7wjx-3g7j-8584 — Possible DoS Vulnerability in Action Controller Token Authentication

Affected: RubyGems: actionpack

There is a possible DoS vulnerability in the Token Authentication logic in Action Controller.

Versions Affected: >= 4.0.0 Not affected: < 4.0.0 Fixed Versions: 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6

Impact ------ Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication. Impacted code will look something like this:

``` class PostsController < ApplicationController before_action :authenticate

private

def authenticate authenticate_or_request_with_http_token do |token, options| # ... end end end ```

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases -------- The fixed releases are available at the normal locations.

Workarounds ----------- The following monkey patch placed in an initializer can be used to work around the issue:

```ruby module ActionController::HttpAuthentication::Token AUTHN_PAIR_DELIMITERS = /(?:,|;|\t)/ end ```

Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.

* 5-2-http-authentication-dos.patch - Patch for 5.2 series * 6-0-http-authentication-dos.patch - Patch for 6.0 series * 6-1-http-authentication-dos.patch - Patch for 6.1 series

Please note that only the 6.1.Z, 6.0.Z, and 5.2.Z series are supported at present. Users of earlier unsupported releases are…

gsd-2021-22904

OESA-2021-1248 — rubygem-actionpack security update

Affected: openEuler:20.03-LTS-SP1: rubygem-actionpack

Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn't require a browser. Security Fix(es): The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` or `authenticate_with_http_token` for request authentication.(CVE-2021-22904)

openSUSE-SU-2024:11317-1 — ruby2.7-rubygem-actionpack-5.2-5.2.6-1.2 on GA media

ruby2.7-rubygem-actionpack-5.2-5.2.6-1.2 on GA media

RHSA-2021:4702 — Red Hat Security Advisory: Satellite 6.10 Release

python-ecdsa: Unexpected and undocumented exceptions during signature decoding python-ecdsa: DER encoding is not being verified in signatures rubygem-activerecord-session_store: hijack sessions by using timing attacks targeting the session id rake: OS Command Injection via egrep in Rake::FileList guava: local information disclosure via temporary directory created with unsafe permissions PyYAML: incomplete fix for CVE-2020-1747 rubygem-nokogiri: XML external entity injection via Nokogiri::XML::Schema Satellite: Azure compute resource secret_key leak to authenticated users foreman: possible man-in-the-middle in smart_proxy realm_freeipa Satellite: BMC controller credential leak via API python-aiohttp: Open redirect in aiohttp.web_middlewares.normalize_path_middleware rubygem-actionpack: Possible Information Disclosure / Unintended Method Execution in Action Pack rails: Possible Denial of Service vulnerability in Action Dispatch rails: Possible DoS Vulnerability in Action Controller Token Authentication django: potential directory-traversal via uploaded files rubygem-puma: incomplete fix for CVE-2019-16770 allows Denial of Service (DoS) django: Potential directory-traversal via uploaded files rubygem-addressable: ReDoS in templates django: Potential directory traversal via ``admindocs`` python-urllib3: ReDoS in the parsing of authority part of URL django: Possible indeterminate SSRF, RFI, and LFI attacks since validators accepted leading zeros in IPv4 addresses

SUSE-SU-2022:2108-1 — Security update for rubygem-actionpack-5_1, rubygem-activesupport-5_1

Security update for rubygem-actionpack-5_1, rubygem-activesupport-5_1

UBUNTU-CVE-2021-22904

Affected: Ubuntu:Pro:16.04:LTS: rails, Ubuntu:Pro:18.04:LTS: rails, Ubuntu:Pro:20.04:LTS: rails, Ubuntu:Pro:22.04:LTS: rails, Ubuntu:24.04:LTS: rails, Ubuntu:25.10: rails, Ubuntu:26.04:LTS: rails

WID-SEC-W-2022-0341 — Ruby on Rails: Mehrere Schwachstellen

Ein Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um Informationen offenzulegen, einen Denial of Service Zustand auszulösen und Sicherheitsmaßnahmen zu umgehen.