Open actionable advisories and recorded vendor fixes. This public package view has no inventory attached and cannot establish whether your deployment is affected. A vendor fix never resolves your finding; verify your installed version and the source guidance.
Open advisories
61 actionable advisories, newest first. Withdrawn advisories and news are excluded. Coverage is partial.
Cross-site scripting (XSS) vulnerability in the i18n translations helper method in Ruby on Rails 3.0.x before 3.0.11 and 3.1.x before 3.1.2, and the railsxss plugin in Ruby on Rails 2.3.x, allows remote attackers to inject arbitrary web script or HTML via vectors related to a translations string whose name ends with an "html" substring.
Recommended action: Upgrade to 3.1.2 or 3.0.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
actionpack/lib/actionview/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.4, when a case-insensitive filesystem is used, does not properly implement filters associated with the list of available templates, which allows remote attackers to bypass intended access restrictions via an action name that uses an unintended case for alphabetic characters.
Recommended action: Upgrade to 3.0.4 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Multiple cross-site scripting (XSS) vulnerabilities in the mailto helper in Ruby on Rails before 2.3.11, and 3.x before 3.0.4, when javascript encoding is used, allow remote attackers to inject arbitrary web script or HTML via a crafted (1) name or (2) email value.
Recommended action: Upgrade to 3.0.4 or 2.3.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 2.3.16, 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain [nil] values, a related issue to CVE-2012-2694.
Recommended action: Upgrade to 3.2.4, 3.1.5, 3.0.13 or 2.3.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The decodecredentials method in actionpack/lib/actioncontroller/metal/httpauthentication.rb in Ruby on Rails before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a withhttpdigest helper method, as demonstrated by the authenticateorrequestwithhttpdigest method.
Recommended action: Upgrade to 3.2.7, 3.1.7, 3.0.16 or 2.3.5 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts.
Recommended action: Upgrade to 2.3.4 or 2.2.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Ruby on Rails 2.1 before 2.1.3 and 2.2.x before 2.2.2 does not verify tokens for requests with certain content types, which allows remote attackers to bypass cross-site request forgery (CSRF) protection for requests to applications that rely on this protection, as demonstrated using text/plain.
Recommended action: Upgrade to 2.2.2 or 2.1.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Ruby on Rails 2.1.x, 2.2.x, and 2.3.x before 2.3.11, and 3.x before 3.0.4, does not properly validate HTTP requests that contain an X-Requested-With header, which makes it easier for remote attackers to conduct cross-site request forgery (CSRF) attacks via forged (1) AJAX or (2) API requests that leverage "combinations of browser plugins and HTTP redirects," a related issue to CVE-2011-0696.
Recommended action: Upgrade to 3.0.4 or 2.3.11 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.x before 2.2.3, and 2.3.x before 2.3.4, allows remote attackers to inject arbitrary web script or HTML by placing malformed Unicode strings into a form helper.
Recommended action: Upgrade to 2.3.4 or 2.2.3 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in the striptags helper in actionpack/lib/actioncontroller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary web script or HTML via a tag with an invalid name.
Recommended action: Upgrade to 3.0.10 or 2.3.13 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
CRLF injection vulnerability in actionpack/lib/actioncontroller/response.rb in Ruby on Rails 2.3.x before 2.3.13 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via the Content-Type header.
Recommended action: Upgrade to 2.3.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in actionpack/lib/actionview/helpers/formoptionshelper.rb in the select helper in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving certain generation of OPTION elements within SELECT elements.
Recommended action: Upgrade to 3.2.2, 3.1.4 or 3.0.12 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
actionpack/lib/actiondispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain ['xyz', nil] values, a related issue to CVE-2012-2660.
Recommended action: Upgrade to 3.2.6, 3.1.6 or 3.0.14 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The template selection functionality in actionpack/lib/actionview/template/resolver.rb in Ruby on Rails 3.0.x before 3.0.10 and 3.1.x before 3.1.0.rc6 does not properly handle glob characters, which allows remote attackers to render arbitrary views via a crafted URL, related to a "filter skipping vulnerability."
Recommended action: Upgrade to 3.0.10 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The tos method in actionpack/lib/actiondispatch/middleware/remoteip.rb in Ruby on Rails 3.0.5 does not validate the X-Forwarded-For header in requests from IP addresses on a Class C network, which might allow remote attackers to inject arbitrary text into log files or bypass intended address parsing via a crafted header.
Recommended action: Upgrade to 2.3.13 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in actionpack/lib/actionview/helpers/sanitizehelper.rb in the striptags helper in Ruby on Rails before 2.3.16, 3.0.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.
Recommended action: Upgrade to 3.2.8, 3.1.8, 3.0.17 or 2.3.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
actionpack/lib/actionview/lookupcontext.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.
Recommended action: Upgrade to 4.0.2 or 3.2.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in actionpack/lib/actionview/helpers/formtaghelper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the selecttag helper.
Recommended action: Upgrade to 3.2.8, 3.1.8 or 3.0.17 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
activesupport/coreext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
Recommended action: Upgrade to 3.2.11, 3.1.10, 3.0.19 or 2.3.15 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The sanitize helper in lib/actioncontroller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URLs, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via a crafted scheme name, as demonstrated by including a : sequence.
Recommended action: Upgrade to 3.2.13, 3.1.12 or 2.3.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Cross-site scripting (XSS) vulnerability in actionpack/lib/actionview/helpers/translationhelper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted string that triggers generation of a fallback string by the i18n gem.
Recommended action: Upgrade to 4.0.2 or 3.2.16 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The sanitizecss method in lib/actioncontroller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which makes it easier for remote attackers to conduct cross-site scripting (XSS) attacks via crafted Cascading Style Sheets (CSS) token sequences.
Recommended action: Upgrade to 3.2.13, 3.1.12 or 2.3.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
actionpack/lib/actionview/template/text.rb in Action View in Ruby on Rails 3.x before 3.2.17 converts MIME type strings to symbols during use of the :text option to the render method, which allows remote attackers to cause a denial of service (memory consumption) by including these strings in headers.
Recommended action: Upgrade to 3.2.17 or later, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
The httpbasicauthenticatewith method in actionpack/lib/actioncontroller/metal/httpauthentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.
Recommended action: Upgrade to 4.1.14.1 or 3.2.22.1 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.
Directory traversal vulnerability in actionpack/lib/abstractcontroller/base.rb in the implicit-render implementation in Ruby on Rails before 3.2.18, 4.0.x before 4.0.5, and 4.1.x before 4.1.1, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request.
Recommended action: Upgrade to 4.1.1, 4.0.5 or 3.2.18 by release line, then redeploy and verify.A vendor fix does not resolve your finding until you verify it in your own systems.