Skip to content

Commit a850e34

Browse files
jasnowRubySec CI
jasnow
authored and
RubySec CI
committed
Updated advisory posts against rubysec/ruby-advisory-db@443cfb9 
1 parent a425ab2 commit a850e34

File tree

4 files changed

+225
-0
lines changed

4 files changed

+225
-0
lines changed

‎advisories/_posts/2024-10-15-CVE-2024-41128.md‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2024-41128 (actionpack): Possible ReDoS vulnerability in query parameter
4+
filtering in Action Dispatch'
5+
comments: false
6+
categories:
7+
- actionpack
8+
- rails
9+
advisory:
10+
gem: actionpack
11+
framework: rails
12+
cve: 2024-41128
13+
ghsa: x76w-6vjr-8xgj
14+
url: https://github.com/rails/rails/security/advisories/GHSA-x76w-6vjr-8xgj
15+
title: Possible ReDoS vulnerability in query parameter filtering in Action Dispatch
16+
date: 2024-10-15
17+
description: |
18+
There is a possible ReDoS vulnerability in the query parameter
19+
filtering routines of Action Dispatch. This vulnerability has
20+
been assigned the CVE identifier CVE-2024-41128.
21+
22+
## Impact
23+
24+
Carefully crafted query parameters can cause query parameter
25+
filtering to take an unexpected amount of time, possibly resulting
26+
in a DoS vulnerability. All users running an affected release
27+
should either upgrade or apply the relevant patch immediately.
28+
29+
Ruby 3.2 has mitigations for this problem, so Rails applications
30+
using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends
31+
on Ruby 3.2 or greater so is unaffected.
32+
33+
## Releases
34+
35+
The fixed releases are available at the normal locations.
36+
37+
## Workarounds
38+
39+
Users on Ruby 3.2 are unaffected by this issue.
40+
41+
## Credits
42+
43+
Thanks to [scyoon](https://hackerone.com/scyoon) for the report and patches!
44+
unaffected_versions:
45+
- "< 3.1.0"
46+
patched_versions:
47+
- "~> 6.1.7.9"
48+
- "~> 7.0.8.5"
49+
- "~> 7.1.4.1"
50+
- ">= 7.2.1.1"
51+
related:
52+
url:
53+
- https://github.com/rails/rails/security/advisories/GHSA-x76w-6vjr-8xgj
54+
- https://github.com/advisories/GHSA-x76w-6vjr-8xgj
55+
---

‎advisories/_posts/2024-10-15-CVE-2024-47887.md‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2024-47887 (actionpack): Possible ReDoS vulnerability in HTTP Token authentication
4+
in Action Controller'
5+
comments: false
6+
categories:
7+
- actionpack
8+
- rails
9+
advisory:
10+
gem: actionpack
11+
framework: rails
12+
cve: 2024-47887
13+
ghsa: vfg9-r3fq-jvx4
14+
url: https://github.com/rails/rails/security/advisories/GHSA-vfg9-r3fq-jvx4
15+
title: Possible ReDoS vulnerability in HTTP Token authentication in Action Controller
16+
date: 2024-10-15
17+
description: |
18+
There is a possible ReDoS vulnerability in Action Controller's
19+
HTTP Token authentication. This vulnerability has been assigned
20+
the CVE identifier CVE-2024-47887.
21+
22+
## Impact
23+
24+
For applications using HTTP Token authentication via
25+
`authenticate_or_request_with_http_token` or similar, a carefully
26+
crafted header may cause header parsing to take an unexpected amount
27+
of time, possibly resulting in a DoS vulnerability. All users running
28+
an affected release should either upgrade or apply the relevant
29+
patch immediately.
30+
31+
Ruby 3.2 has mitigations for this problem, so Rails applications
32+
using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends
33+
on Ruby 3.2 or greater so is unaffected.
34+
35+
## Releases
36+
37+
The fixed releases are available at the normal locations.
38+
39+
## Workarounds
40+
41+
Users on Ruby 3.2 are unaffected by this issue.
42+
43+
## Credits
44+
45+
Thanks to [scyoon](https://hackerone.com/scyoon) for reporting
46+
unaffected_versions:
47+
- "< 4.0.0"
48+
patched_versions:
49+
- "~> 6.1.7.9"
50+
- "~> 7.0.8.5"
51+
- "~> 7.1.4.1"
52+
- ">= 7.2.1.1"
53+
related:
54+
url:
55+
- https://github.com/rails/rails/security/advisories/GHSA-vfg9-r3fq-jvx4
56+
- https://github.com/advisories/GHSA-vfg9-r3fq-jvx4
57+
---

‎advisories/_posts/2024-10-15-CVE-2024-47888.md‎

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,57 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2024-47888 (actiontext): Possible ReDoS vulnerability in plain_text_for_blockquote_node
4+
in Action Text'
5+
comments: false
6+
categories:
7+
- actiontext
8+
- rails
9+
advisory:
10+
gem: actiontext
11+
framework: rails
12+
cve: 2024-47888
13+
ghsa: wwhv-wxv9-rpgw
14+
url: https://github.com/rails/rails/security/advisories/GHSA-wwhv-wxv9-rpgw
15+
title: Possible ReDoS vulnerability in plain_text_for_blockquote_node in Action
16+
Text
17+
date: 2024-10-15
18+
description: |
19+
There is a possible ReDoS vulnerability in the
20+
plain_text_for_blockquote_node helper in Action Text. This
21+
vulnerability has been assigned the CVE identifier CVE-2024-47888.
22+
23+
## Impact
24+
25+
Carefully crafted text can cause the plain_text_for_blockquote_node
26+
helper to take an unexpected amount of time, possibly resulting
27+
in a DoS vulnerability. All users running an affected release should
28+
either upgrade or apply the relevant patch immediately.
29+
30+
Ruby 3.2 has mitigations for this problem, so Rails applications
31+
using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends
32+
on Ruby 3.2 or greater so is unaffected.
33+
34+
## Releases
35+
36+
The fixed releases are available at the normal locations.
37+
38+
## Workarounds
39+
40+
Users can avoid calling `plain_text_for_blockquote_node` or
41+
upgrade to Ruby 3.2.
42+
43+
## Credits
44+
45+
Thanks to [ooooooo_q](https://hackerone.com/ooooooo_q) for the report!
46+
unaffected_versions:
47+
- "< 6.0.0"
48+
patched_versions:
49+
- "~> 6.1.7.9"
50+
- "~> 7.0.8.5"
51+
- "~> 7.1.4.1"
52+
- ">= 7.2.1.1"
53+
related:
54+
url:
55+
- https://github.com/rails/rails/security/advisories/GHSA-wwhv-wxv9-rpgw
56+
- https://github.com/advisories/GHSA-wwhv-wxv9-rpgw
57+
---

‎advisories/_posts/2024-10-15-CVE-2024-47889.md‎

Lines changed: 56 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,56 @@
1+
---
2+
layout: advisory
3+
title: 'CVE-2024-47889 (actionmailer): Possible ReDoS vulnerability in block_format
4+
in Action Mailer'
5+
comments: false
6+
categories:
7+
- actionmailer
8+
- rails
9+
advisory:
10+
gem: actionmailer
11+
framework: rails
12+
cve: 2024-47889
13+
ghsa: h47h-mwp9-c6q6
14+
url: https://github.com/rails/rails/security/advisories/GHSA-h47h-mwp9-c6q6
15+
title: Possible ReDoS vulnerability in block_format in Action Mailer
16+
date: 2024-10-15
17+
description: |
18+
There is a possible ReDoS vulnerability in the block_format helper
19+
in Action Mailer. This vulnerability has been assigned the
20+
CVE identifier CVE-2024-47889.
21+
22+
## Impact
23+
24+
Carefully crafted text can cause the block_format helper to take an
25+
unexpected amount of time, possibly resulting in a DoS vulnerability.
26+
All users running an affected release should either upgrade or apply
27+
the relevant patch immediately.
28+
29+
Ruby 3.2 has mitigations for this problem, so Rails applications
30+
using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 requires
31+
Ruby 3.2 or greater so is unaffected.
32+
33+
## Releases
34+
35+
The fixed releases are available at the normal locations.
36+
37+
## Workarounds
38+
39+
Users can avoid calling the `block_format` helper or upgrade
40+
to Ruby 3.2.
41+
42+
##Credits
43+
44+
Thanks to [ooooooo_q](https://hackerone.com/ooooooo_q) for the report!
45+
unaffected_versions:
46+
- "< 3.0.0"
47+
patched_versions:
48+
- "~> 6.1.7.9"
49+
- "~> 7.0.8.5"
50+
- "~> 7.1.4.1"
51+
- ">= 7.2.1.1"
52+
related:
53+
url:
54+
- https://github.com/rails/rails/security/advisories/GHSA-h47h-mwp9-c6q6
55+
- https://github.com/advisories/GHSA-h47h-mwp9-c6q6
56+
---

0 commit comments

Comments
 (0)