Skip to content

Commit 0e7e1ba

Browse files
jasnowjasnow
committed
GHSA SYNC: 4 brand new advisories
1 parent a93d52d commit 0e7e1ba

File tree

4 files changed

+190
-0
lines changed

4 files changed

+190
-0
lines changed

‎gems/actionmailer/CVE-2024-47889.yml

+47
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,47 @@
1+
---
2+
gem: actionmailer
3+
framework: rails
4+
cve: 2024-47889
5+
ghsa: h47h-mwp9-c6q6
6+
url: https://github.com/rails/rails/security/advisories/GHSA-h47h-mwp9-c6q6
7+
title: Possible ReDoS vulnerability in block_format in Action Mailer
8+
date: 2024-10-15
9+
description: |
10+
There is a possible ReDoS vulnerability in the block_format helper
11+
in Action Mailer. This vulnerability has been assigned the
12+
CVE identifier CVE-2024-47889.
13+
14+
## Impact
15+
16+
Carefully crafted text can cause the block_format helper to take an
17+
unexpected amount of time, possibly resulting in a DoS vulnerability.
18+
All users running an affected release should either upgrade or apply
19+
the relevant patch immediately.
20+
21+
Ruby 3.2 has mitigations for this problem, so Rails applications
22+
using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 requires
23+
Ruby 3.2 or greater so is unaffected.
24+
25+
## Releases
26+
27+
The fixed releases are available at the normal locations.
28+
29+
## Workarounds
30+
31+
Users can avoid calling the `block_format` helper or upgrade
32+
to Ruby 3.2.
33+
34+
##Credits
35+
36+
Thanks to [ooooooo_q](https://hackerone.com/ooooooo_q) for the report!
37+
unaffected_versions:
38+
- "< 3.0.0"
39+
patched_versions:
40+
- "~> 6.1.7.9"
41+
- "~> 7.0.8.5"
42+
- "~> 7.1.4.1"
43+
- ">= 7.2.1.1"
44+
related:
45+
url:
46+
- https://github.com/rails/rails/security/advisories/GHSA-h47h-mwp9-c6q6
47+
- https://github.com/advisories/GHSA-h47h-mwp9-c6q6

‎gems/actionpack/CVE-2024-41128.yml

+46
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,46 @@
1+
---
2+
gem: actionpack
3+
framework: rails
4+
cve: 2024-41128
5+
ghsa: x76w-6vjr-8xgj
6+
url: https://github.com/rails/rails/security/advisories/GHSA-x76w-6vjr-8xgj
7+
title: Possible ReDoS vulnerability in query parameter filtering in Action Dispatch
8+
date: 2024-10-15
9+
description: |
10+
There is a possible ReDoS vulnerability in the query parameter
11+
filtering routines of Action Dispatch. This vulnerability has
12+
been assigned the CVE identifier CVE-2024-41128.
13+
14+
## Impact
15+
16+
Carefully crafted query parameters can cause query parameter
17+
filtering to take an unexpected amount of time, possibly resulting
18+
in a DoS vulnerability. All users running an affected release
19+
should either upgrade or apply the relevant patch immediately.
20+
21+
Ruby 3.2 has mitigations for this problem, so Rails applications
22+
using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends
23+
on Ruby 3.2 or greater so is unaffected.
24+
25+
## Releases
26+
27+
The fixed releases are available at the normal locations.
28+
29+
## Workarounds
30+
31+
Users on Ruby 3.2 are unaffected by this issue.
32+
33+
## Credits
34+
35+
Thanks to [scyoon](https://hackerone.com/scyoon) for the report and patches!
36+
unaffected_versions:
37+
- "< 3.1.0"
38+
patched_versions:
39+
- "~> 6.1.7.9"
40+
- "~> 7.0.8.5"
41+
- "~> 7.1.4.1"
42+
- ">= 7.2.1.1"
43+
related:
44+
url:
45+
- https://github.com/rails/rails/security/advisories/GHSA-x76w-6vjr-8xgj
46+
- https://github.com/advisories/GHSA-x76w-6vjr-8xgj

‎gems/actionpack/CVE-2024-47887.yml

+49
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
---
2+
gem: actionpack
3+
framework: rails
4+
cve: 2024-47887
5+
ghsa: vfg9-r3fq-jvx4
6+
url: https://github.com/rails/rails/security/advisories/GHSA-vfg9-r3fq-jvx4
7+
title: Possible ReDoS vulnerability in HTTP Token authentication
8+
in Action Controller
9+
date: 2024-10-15
10+
description: |
11+
There is a possible ReDoS vulnerability in Action Controller's
12+
HTTP Token authentication. This vulnerability has been assigned
13+
the CVE identifier CVE-2024-47887.
14+
15+
## Impact
16+
17+
For applications using HTTP Token authentication via
18+
`authenticate_or_request_with_http_token` or similar, a carefully
19+
crafted header may cause header parsing to take an unexpected amount
20+
of time, possibly resulting in a DoS vulnerability. All users running
21+
an affected release should either upgrade or apply the relevant
22+
patch immediately.
23+
24+
Ruby 3.2 has mitigations for this problem, so Rails applications
25+
using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends
26+
on Ruby 3.2 or greater so is unaffected.
27+
28+
## Releases
29+
30+
The fixed releases are available at the normal locations.
31+
32+
## Workarounds
33+
34+
Users on Ruby 3.2 are unaffected by this issue.
35+
36+
## Credits
37+
38+
Thanks to [scyoon](https://hackerone.com/scyoon) for reporting
39+
unaffected_versions:
40+
- "< 4.0.0"
41+
patched_versions:
42+
- "~> 6.1.7.9"
43+
- "~> 7.0.8.5"
44+
- "~> 7.1.4.1"
45+
- ">= 7.2.1.1"
46+
related:
47+
url:
48+
- https://github.com/rails/rails/security/advisories/GHSA-vfg9-r3fq-jvx4
49+
- https://github.com/advisories/GHSA-vfg9-r3fq-jvx4

‎gems/actiontext/CVE-2024-47888.yml

+48
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
---
2+
gem: actiontext
3+
framework: rails
4+
cve: 2024-47888
5+
ghsa: wwhv-wxv9-rpgw
6+
url: https://github.com/rails/rails/security/advisories/GHSA-wwhv-wxv9-rpgw
7+
title: Possible ReDoS vulnerability in plain_text_for_blockquote_node
8+
in Action Text
9+
date: 2024-10-15
10+
description: |
11+
There is a possible ReDoS vulnerability in the
12+
plain_text_for_blockquote_node helper in Action Text. This
13+
vulnerability has been assigned the CVE identifier CVE-2024-47888.
14+
15+
## Impact
16+
17+
Carefully crafted text can cause the plain_text_for_blockquote_node
18+
helper to take an unexpected amount of time, possibly resulting
19+
in a DoS vulnerability. All users running an affected release should
20+
either upgrade or apply the relevant patch immediately.
21+
22+
Ruby 3.2 has mitigations for this problem, so Rails applications
23+
using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends
24+
on Ruby 3.2 or greater so is unaffected.
25+
26+
## Releases
27+
28+
The fixed releases are available at the normal locations.
29+
30+
## Workarounds
31+
32+
Users can avoid calling `plain_text_for_blockquote_node` or
33+
upgrade to Ruby 3.2.
34+
35+
## Credits
36+
37+
Thanks to [ooooooo_q](https://hackerone.com/ooooooo_q) for the report!
38+
unaffected_versions:
39+
- "< 6.0.0"
40+
patched_versions:
41+
- "~> 6.1.7.9"
42+
- "~> 7.0.8.5"
43+
- "~> 7.1.4.1"
44+
- ">= 7.2.1.1"
45+
related:
46+
url:
47+
- https://github.com/rails/rails/security/advisories/GHSA-wwhv-wxv9-rpgw
48+
- https://github.com/advisories/GHSA-wwhv-wxv9-rpgw

0 commit comments

Comments
 (0)