A vulnerability has been discovered in Ruby on Rails, which can lead to remote code execution via serialization of data.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-ruby/rails | * | < 7.0.3.1:7.0, < 6.1.6.1:6.1 | >= 7.0.3.1:7.0, >= 6.1.6.1:6.1 |
Ruby on Rails is a free web framework used to develop database-driven web applications.
Multiple vulnerabilities have been discovered in Ruby on Rails. Please review the CVE identifiers referenced below for details.
When serialized columns that use YAML (the default) are deserialized, Rails uses YAML.unsafe_load to convert the YAML data in to Ruby objects. If an attacker can manipulate data in the database (via means like SQL injection), then it may be possible for the attacker to escalate to an RCE. Impacted Active Record models will look something like this: class User < ApplicationRecord serialize :options # Vulnerable: Uses YAML for serialization serialize :values, Array # Vulnerable: Uses YAML for serialization serialize :values, JSON # Not vulnerable end The released versions change the default YAML deserializer to use YAML.safe_load, which prevents deserialization of possibly dangerous objects. This may introduce backwards compatibility issues with existing data.
There is no known workaround at this time.
All Ruby on Rails users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-ruby/rails-6.1.6.1:6.1" # emerge --ask --oneshot --verbose ">=dev-ruby/rails-7.0.3.1:7.0"
Multiple vulnerabilities were found in Ruby on Rails, the worst of which allowing for execution of arbitrary code.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-ruby/rails | * | < 2.3.18 | >= 2.3.18 |
Ruby on Rails is a web-application and persistence framework.
Multiple vulnerabilities have been discovered in Ruby on Rails. Please review the CVE identifiers referenced below for details.
A remote attacker could execute arbitrary code or cause a Denial of Service condition. Furthermore, a remote attacker may be able to execute arbitrary SQL commands, change parameter names for form inputs and make changes to arbitrary records in the system, bypass intended access restrictions, render arbitrary views, inject arbitrary web script or HTML, or conduct cross-site request forgery (CSRF) attacks.
There is no known workaround at this time.
All Ruby on Rails 2.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-ruby/rails-2.3.18"
NOTE: All applications using Ruby on Rails should also be configured to use the latest version available by running “rake rails:update” inside the application directory.
NOTE: This is a legacy GLSA and stable updates for Ruby on Rails, including the unaffected version listed above, are no longer available from Gentoo. It may be possible to upgrade to the 3.2, 4.0, or 4.1 branches, however these packages are not currently stable.
Multiple vulnerabilities have been discovered in Rails, the worst of which leading to the execution of arbitrary SQL statements.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-ruby/rails | * | < 2.2.2 | >= 2.3.5, >= 2.2.3-r1 (revision) |
Ruby on Rails is a web-application and persistence framework.
The following vulnerabilities were discovered:
A remote attacker could send specially crafted requests to a vulnerable application, possibly leading to the execution of arbitrary SQL statements or a circumvention of access control. A remote attacker could also conduct session fixation attacks to hijack a user's session or bypass the CSRF protection mechanism, or furthermore conduct Cross-Site Scripting attacks or forge a digest via multiple attempts.
There is no known workaround at this time.
All Ruby on Rails 2.3.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-ruby/rails-2.3.5"
All Ruby on Rails 2.2.x users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose "=dev-ruby/rails-2.2.3-r1"
NOTE: All applications using Ruby on Rails should also be configured to use the latest version available by running "rake rails:update" inside the application directory.
Several vulnerabilities were found in Ruby on Rails allowing for file disclosure and theft of user credentials.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-ruby/rails | * | < 1.2.5 | >= 1.2.5 |
Ruby on Rails is a free web framework used to develop database-driven web applications.
candlerb found that ActiveResource, when processing responses using the Hash.from_xml() function, does not properly sanitize filenames (CVE-2007-5380). The session management functionality allowed the "session_id" to be set in the URL (CVE-2007-5380). BCC discovered that the to_json() function does not properly sanitize input before returning it to the user (CVE-2007-3227).
Unauthenticated remote attackers could exploit these vulnerabilities to determine the existence of files or to read the contents of arbitrary XML files; conduct session fixation attacks and gain unauthorized access; and to execute arbitrary HTML and script code in a user's browser session in context of an affected site by enticing a user to browse a specially crafted URL.
There is no known workaround at this time.
All Ruby on Rails users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-ruby/rails-1.2.5"
Ruby on Rails has some weaknesses potentially allowing a Denial of Service and maybe the remote execution of arbitrary Ruby scripts.
| Package | Arch | Vulnerable | Unaffected |
|---|---|---|---|
| dev-ruby/rails | * | < 1.1.6 | >= 1.1.6 |
Ruby on Rails is an open-source web framework.
The Ruby on Rails developers have corrected some weaknesses in action_controller/, relative to the handling of the user input and the LOAD_PATH variable. A remote attacker could inject arbitrary entries into the LOAD_PATH variable and alter the main Ruby on Rails process. The security hole has only been partly solved in version 1.1.5. Version 1.1.6 now fully corrects it.
A remote attacker that would exploit these weaknesses might cause a Denial of Service of the web framework and maybe inject arbitrary Ruby scripts.
There is no known workaround at this time.
All Ruby on Rails users should upgrade to the latest version:
# emerge --sync # emerge --ask --oneshot --verbose ">=dev-ruby/rails-1.1.6"