Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!

Bug 926087 (CVE-2024-26142, CVE-2024-26143, CVE-2024-26144)

Summary: <dev-ruby/rails-{6.1.7.7,7.0.8.1,7.1.3.2}: multiple vulnerabilities
Product: Gentoo Security Reporter: Hans de Graaff <graaff>
Component: VulnerabilitiesAssignee: Gentoo Security <security>
Status: IN_PROGRESS ---    
Severity: normal CC: ruby
Priority: Normal    
Version: unspecified   
Hardware: All   
OS: Linux   
URL: https://rubyonrails.org/2024/2/21/Rails-Versions-6-1-7-7-7-0-8-1-and-7-1-3-2-have-been-released
Whiteboard: B3 [glsa?]
Package list:
Runtime testing required: ---
Bug Depends on: 932147    
Bug Blocks:    

Description Hans de Graaff gentoo-dev Security 2024-03-03 08:49:00 UTC
Here is a list of security issues that these releases address:

    CVE-2024-26143 Possible XSS Vulnerability in Action Controller, fixed in 7.1.3.1, 7.1.3.2, and 7.0.8.1
    CVE-2024-26142 Possible ReDoS vulnerability in Accept header parsing in Action Dispatch, fixed in 7.1.3.1 and 7.1.3.2
    CVE-2024-26144 Possible Sensitive Session Information Leak in Active Storage, fixed in 7.0.8.1 and 6.1.7.7 (does not impact Rails versions >= 7.1.0)
Comment 1 Hans de Graaff gentoo-dev Security 2024-03-03 08:50:25 UTC
Rails itself is not stable on any arch, but some of its components are, so treating this as a package with stable versions.