Most recent entries from all

bdu:2025-00338

certfr-2024-avi-0463 — De multiples vulnérabilités ont été découvertes dans Ruby on Rails. Elles permettent à un attaquant de provoquer une in…

certfr-2024-avi-0463

EUVD-2026-206282

fkie_cve-2024-28103

Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.

GHSA-fwhr-88qx-h9g7 — Missing security headers in Action Pack on non-HTML responses

Affected: RubyGems: actionpack

# Permissions-Policy is Only Served on HTML Content-Type

The application configurable Permissions-Policy is only served on responses with an HTML related Content-Type.

This has been assigned the CVE identifier CVE-2024-28103.

Versions Affected: >= 6.1.0 Not affected: < 6.1.0 Fixed Versions: 6.1.7.8, 7.0.8.4, and 7.1.3.4

Impact ------ Responses with a non-HTML Content-Type are not serving the configured Permissions-Policy. There are certain non-HTML Content-Types that would benefit from having the Permissions-Policy enforced.

Releases -------- The fixed releases are available at the normal locations.

Workarounds ----------- N/A

Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the supported release series in accordance with our [maintenance policy](https://guides.rubyonrails.org/maintenance_policy.html#security-issues) regarding security issues. They are in git-am format and consist of a single changeset.

* 6-1-include-permissions-policy-header-on-non-html.patch - Patch for 6.1 series * 7-0-include-permissions-policy-header-on-non-html.patch - Patch for 7.0 series * 7-1-include-permissions-policy-header-on-non-html.patch - Patch for 7.1 series

Credits -------

Thank you [shinkbr](https://hackerone.com/shinkbr) for reporting this!

gsd-2024-28103

OESA-2024-1708 — rubygem-actionpack security update

Affected: openEuler:22.03-LTS-SP1: rubygem-actionpack

Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn't require a browser. Security Fix(es): Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.(CVE-2024-28103)

openSUSE-SU-2024:14067-1 — ruby3.3-rubygem-actionpack-7.0-7.0.8.4-1.1 on GA media

ruby3.3-rubygem-actionpack-7.0-7.0.8.4-1.1 on GA media

SUSE-SU-2024:1973-1 — Security update for rmt-server

Security update for rmt-server

UBUNTU-CVE-2024-28103

Affected: Ubuntu:Pro:16.04:LTS: rails, Ubuntu:Pro:18.04:LTS: rails, Ubuntu:Pro:20.04:LTS: rails, Ubuntu:Pro:22.04:LTS: rails, Ubuntu:24.04:LTS: rails, Ubuntu:25.10: rails, Ubuntu:26.04:LTS: rails

WID-SEC-W-2024-1292 — Ruby on Rails: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um einen Cross-Site Scripting Angriff durchzuführen.