Информационная безопасность
[RU] switch to English


Многочисленные уязвимости безопасности в Ruby Actionpack / Actionmailer
Опубликовано:4 мая 2014 г.
Источник:
SecurityVulns ID:13717
Тип:библиотека
Уровень опасности:
5/10
Описание:DoS, межсайтовый скриптинг.
Затронутые продукты:RUBY : Ruby on Rails 4.0
CVE:CVE-2013-6417 (actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request that leverages (1) third-party Rack middleware or (2) custom Rack middleware. NOTE: this vulnerability exists because of an incomplete fix for CVE-2013-0155.)
 CVE-2013-6415 (Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit parameter.)
 CVE-2013-6414 (actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.)
 CVE-2013-4491 (Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via a crafted string that triggers generation of a fallback string by the i18n gem.)
 CVE-2013-4389 (Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.)
Оригинальный текстdocumentDEBIAN, [SECURITY] [DSA 2888-1] ruby-actionpack-3.2 security update (04.05.2014)
 documentDEBIAN, [SECURITY] [DSA 2887-1] ruby-actionmailer-3.2 security update (04.05.2014)

О сайте | Условия использования
© SecurityVulns, 3APA3A, Владимир Дубровин
Нижний Новгород