Active Support in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

For Debian 7 'Wheezy', these problems have been fixed in version 3.2_3.2.6-6+deb7u3.

We recommend that you upgrade your ruby-activesupport-3.2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Multiple security issues have been discovered in the Ruby on Rails web application development framework, which may result in denial of service, cross-site scripting, information disclosure or bypass of input validation.

Security fix for CVE-2015-7577 CVE-2016-0753

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This update for rubygem-actionpack-4_2, rubygem-actionview-4_2, rubygem-activemodel-4_2, rubygem-activerecord-4_2, rubygem-activesupport-4_2 fixes the following issues :

  - CVE-2015-7576: Timing attack vulnerability in basic     authentication in Action Controller (boo#963329)

  - CVE-2016-0752: directory traversal and information leak     in Action View (boo#963332)

  - CVE-2015-7581: unbounded memory growth DoS via wildcard     controller routes (boo#963335)

  - CVE-2016-0751: rubygem-actionpack: Object Leak DoS     (boo#963331)

  - CVE-2016-0753: Input Validation Circumvention     (boo#963334)

  - CVE-2015-7577: Nested attributes rejection proc bypass     (boo#963330)

Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

For Debian 7 'Wheezy', these problems have been fixed in version 3.2_3.2.6-3+deb7u1.

We recommend that you upgrade your ruby-activemodel-3.2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ruby on Rails blog :

Rails 5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, and 3.2.22.1 have been released! These contain important security fixes, and it is recommended that users upgrade as soon as possible.

Security fix for CVE-2016-0753

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Active Record in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters.

For Debian 7 'Wheezy', these problems have been fixed in version 3.2.6-5+deb7u3.

We recommend that you upgrade your ruby-activerecord-3.2 packages.

NOTE: Tenable Network Security has extracted the preceding description block directly from the DLA security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2015-7581 CVE-2015-7576 CVE-2016-0751 CVE-2016-0752 CVE-2016-0753

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2015-7576 CVE-2016-0753

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Security fix for CVE-2015-7577 Security fix for CVE-2016-0753

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Published	Updated	Severity
93832	Debian DLA-641-1 : ruby-activesupport-3.2 security update	Nessus	Debian Local Security Checks	10/4/2016	1/11/2021	medium
88499	Debian DSA-3464-1 : rails - security update	Nessus	Debian Local Security Checks	2/1/2016	3/28/2022	high
89567	Fedora 22 : rubygem-activerecord-4.2.0-2.fc22 (2016-73fe05d878)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	medium
88612	openSUSE Security Update : rubygem-actionpack-4_2 / rubygem-actionview-4_2 / rubygem-activemodel-4_2 / etc (openSUSE-2016-159)	Nessus	SuSE Local Security Checks	2/8/2016	3/28/2022	high
91396	Debian DLA-498-1 : ruby-activemodel-3.2 security update	Nessus	Debian Local Security Checks	6/1/2016	1/11/2021	medium
88532	FreeBSD : rails -- multiple vulnerabilities (bb0ef21d-0e1b-461b-bc3d-9cba39948888)	Nessus	FreeBSD Local Security Checks	2/3/2016	3/28/2022	high
89635	Fedora 23 : rubygem-activemodel-4.2.3-2.fc23 (2016-eb4d6e8aab)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	medium
93833	Debian DLA-642-1 : ruby-activerecord-3.2 security update	Nessus	Debian Local Security Checks	10/4/2016	1/11/2021	medium
89583	Fedora 22 : rubygem-actionpack-4.2.0-3.fc22 / rubygem-activemodel-4.2.0-2.fc22 (2016-94e71ee673)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	high
89614	Fedora 22 : rubygem-activesupport-4.2.0-4.fc22 (2016-cb30088b06)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	medium
89616	Fedora 23 : rubygem-activerecord-4.2.3-2.fc23 (2016-cc465a34df)	Nessus	Fedora Local Security Checks	3/4/2016	1/11/2021	medium

Detections

Analytics

Plugins Search

medium

high

medium

high

medium

high

medium

medium

high

medium

medium