Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

Active Record in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

For Debian 7 'Wheezy', these problems have been fixed in version 3.2.6-5+deb7u3.

We recommend that you upgrade your ruby-activerecord-3.2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Active Support in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

For Debian 7 'Wheezy', these problems have been fixed in version 3.2_3.2.6-6+deb7u3.

We recommend that you upgrade your ruby-activesupport-3.2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

For Debian 7 'Wheezy', these problems have been fixed in version 3.2_3.2.6-3+deb7u1.

We recommend that you upgrade your ruby-activemodel-3.2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2016-0753

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2015-7577 Security fix for CVE-2016-0753

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2015-7576 CVE-2016-0753

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2015-7581 CVE-2015-7576 CVE-2016-0751 CVE-2016-0752 CVE-2016-0753

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2015-7577 CVE-2016-0753

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for rubygem-actionpack-4_2, rubygem-actionview-4_2, rubygem-activemodel-4_2, rubygem-activerecord-4_2, rubygem-activesupport-4_2 fixes the following issues :

  - CVE-2015-7576: Timing attack vulnerability in basic     authentication in Action Controller (boo#963329)

  - CVE-2016-0752: directory traversal and information leak     in Action View (boo#963332)

  - CVE-2015-7581: unbounded memory growth DoS via wildcard     controller routes (boo#963335)

  - CVE-2016-0751: rubygem-actionpack: Object Leak DoS     (boo#963331)

  - CVE-2016-0753: Input Validation Circumvention     (boo#963334)

  - CVE-2015-7577: Nested attributes rejection proc bypass     (boo#963330)

Ruby on Rails blog :

Rails 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, and 3.2.22.1 have been released! These contain important security fixes, and it is recommended that users upgrade as soon as possible.

Multiple security issues have been discovered in the Ruby on Rails web application development framework, which may result in denial of service, cross-site scripting, information disclosure or bypass of input validation.

ID	Name	Product	Family	Severity
93833	Debian DLA-642-1 : ruby-activerecord-3.2 security update	Nessus	Debian Local Security Checks	medium
93832	Debian DLA-641-1 : ruby-activesupport-3.2 security update	Nessus	Debian Local Security Checks	medium
91396	Debian DLA-498-1 : ruby-activemodel-3.2 security update	Nessus	Debian Local Security Checks	medium
89635	Fedora 23 : rubygem-activemodel-4.2.3-2.fc23 (2016-eb4d6e8aab)	Nessus	Fedora Local Security Checks	medium
89616	Fedora 23 : rubygem-activerecord-4.2.3-2.fc23 (2016-cc465a34df)	Nessus	Fedora Local Security Checks	medium
89614	Fedora 22 : rubygem-activesupport-4.2.0-4.fc22 (2016-cb30088b06)	Nessus	Fedora Local Security Checks	medium
89583	Fedora 22 : rubygem-actionpack-4.2.0-3.fc22 / rubygem-activemodel-4.2.0-2.fc22 (2016-94e71ee673)	Nessus	Fedora Local Security Checks	high
89567	Fedora 22 : rubygem-activerecord-4.2.0-2.fc22 (2016-73fe05d878)	Nessus	Fedora Local Security Checks	medium
88612	openSUSE Security Update : rubygem-actionpack-4_2 / rubygem-actionview-4_2 / rubygem-activemodel-4_2 / etc (openSUSE-2016-159)	Nessus	SuSE Local Security Checks	high
88532	FreeBSD : rails -- multiple vulnerabilities (bb0ef21d-0e1b-461b-bc3d-9cba39948888)	Nessus	FreeBSD Local Security Checks	high
88499	Debian DSA-3464-1 : rails - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2016-0753

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

high

medium

high

high

high