Source: rails X-Debbugs-CC: [email protected] Severity: important Tags: security
Hi, The following vulnerabilities were published for rails. CVE-2024-47889[0]: | Action Mailer is a framework for designing email service layers. | Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5, | 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the | block_format helper in Action Mailer. Carefully crafted text can | cause the block_format helper to take an unexpected amount of time, | possibly resulting in a DoS vulnerability. All users running an | affected release should either upgrade to versions 6.1.7.9, 7.0.8.5, | 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. As a | workaround, users can avoid calling the `block_format` helper or | upgrade to Ruby 3.2. Ruby 3.2 has mitigations for this problem, so | Rails applications using Ruby 3.2 or newer are unaffected. Rails | 8.0.0.beta1 requires Ruby 3.2 or greater so is unaffected. https://github.com/rails/rails/security/advisories/GHSA-h47h-mwp9-c6q6 https://github.com/rails/rails/commit/985f1923fa62806ff676e41de67c3b4552131ab9 CVE-2024-47888[1]: | Action Text brings rich text content and editing to Rails. Starting | in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, | and 7.2.1.1, there is a possible ReDoS vulnerability in the | `plain_text_for_blockquote_node helper` in Action Text. Carefully | crafted text can cause the `plain_text_for_blockquote_node` helper | to take an unexpected amount of time, possibly resulting in a DoS | vulnerability. All users running an affected release should either | upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply | the relevant patch immediately. As a workaround, users can avoid | calling `plain_text_for_blockquote_node` or upgrade to Ruby 3.2. | Ruby 3.2 has mitigations for this problem, so Rails applications | using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on | Ruby 3.2 or greater so is unaffected. https://github.com/rails/rails/security/advisories/GHSA-wwhv-wxv9-rpgw https://github.com/rails/rails/commit/4f4312b21a6448336de7c7ab0c4d94b378def468 CVE-2024-47887[2]: | Action Pack is a framework for handling and responding to web | requests. Starting in version 4.0.0 and prior to versions 6.1.7.9, | 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS | vulnerability in Action Controller's HTTP Token authentication. For | applications using HTTP Token authentication via | `authenticate_or_request_with_http_token` or similar, a carefully | crafted header may cause header parsing to take an unexpected amount | of time, possibly resulting in a DoS vulnerability. All users | running an affected release should either upgrade to versions | 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch | immediately. One may choose to use Ruby 3.2 as a workaround.Ruby 3.2 | has mitigations for this problem, so Rails applications using Ruby | 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2 | or greater so is unaffected. https://github.com/rails/rails/security/advisories/GHSA-vfg9-r3fq-jvx4 https://github.com/rails/rails/commit/8e057db25bff1dc7a98e9ae72e0083825b9ac545 CVE-2024-41128[3]: | Action Pack is a framework for handling and responding to web | requests. Starting in version 3.1.0 and prior to versions 6.1.7.9, | 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS | vulnerability in the query parameter filtering routines of Action | Dispatch. Carefully crafted query parameters can cause query | parameter filtering to take an unexpected amount of time, possibly | resulting in a DoS vulnerability. All users running an affected | release should either upgrade to version 6.1.7.9, 7.0.8.5, 7.1.4.1, | or 7.2.1.1 or apply the relevant patch immediately. One may use Ruby | 3.2 as a workaround. Ruby 3.2 has mitigations for this problem, so | Rails applications using Ruby 3.2 or newer are unaffected. Rails | 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected. https://github.com/rails/rails/security/advisories/GHSA-x76w-6vjr-8xgj https://github.com/rails/rails/commit/fb493bebae1a9b83e494fe7edbf01f6167d606fd If you fix the vulnerabilities please also make sure to include the CVE (Common Vulnerabilities & Exposures) ids in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2024-47889 https://www.cve.org/CVERecord?id=CVE-2024-47889 [1] https://security-tracker.debian.org/tracker/CVE-2024-47888 https://www.cve.org/CVERecord?id=CVE-2024-47888 [2] https://security-tracker.debian.org/tracker/CVE-2024-47887 https://www.cve.org/CVERecord?id=CVE-2024-47887 [3] https://security-tracker.debian.org/tracker/CVE-2024-41128 https://www.cve.org/CVERecord?id=CVE-2024-41128 Please adjust the affected versions in the BTS as needed.
