Security update for rubygem-actionpack-4_2, rubygem-actionview-4_2, rubygem-activemodel-4_2, rubygem-activerecord-4_2, rubygem-activesupport-4_2 SUSE Patch security@suse.de SUSE Security Team openSUSE-SU-2016:0372-1 Final 1 1 2016-02-07T15:27:46Z current 2016-02-07T15:27:46Z 2016-02-07T15:27:46Z cve-database/bin/generate-cvrf.pl 2017-02-24T01:00:00Z Security update for rubygem-actionpack-4_2, rubygem-actionview-4_2, rubygem-activemodel-4_2, rubygem-activerecord-4_2, rubygem-activesupport-4_2 This update for rubygem-actionpack-4_2, rubygem-actionview-4_2, rubygem-activemodel-4_2, rubygem-activerecord-4_2, rubygem-activesupport-4_2 fixes the following issues: - CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller (boo#963329) - CVE-2016-0752: directory traversal and information leak in Action View (boo#963332) - CVE-2015-7581: unbounded memory growth DoS via wildcard controller routes (boo#963335) - CVE-2016-0751: rubygem-actionpack: Object Leak DoS (boo#963331) - CVE-2016-0753: Input Validation Circumvention (boo#963334) - CVE-2015-7577: Nested attributes rejection proc bypass (boo#963330) The CVRF data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0). Copyright SUSE LLC under the Creative Commons License 4.0 with Attribution (CC-BY-4.0) https://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html E-Mail link for openSUSE-SU-2016:0372-1 https://www.suse.com/support/security/rating/ SUSE Security Ratings openSUSE Leap 42.1 ruby2.1-rubygem-actionpack-4_2-4.2.4-6.1 ruby2.1-rubygem-actionpack-doc-4_2-4.2.4-6.1 ruby2.1-rubygem-actionview-4_2-4.2.4-6.1 ruby2.1-rubygem-actionview-doc-4_2-4.2.4-6.1 ruby2.1-rubygem-activemodel-4_2-4.2.4-6.1 ruby2.1-rubygem-activemodel-doc-4_2-4.2.4-6.1 ruby2.1-rubygem-activerecord-4_2-4.2.4-6.1 ruby2.1-rubygem-activerecord-doc-4_2-4.2.4-6.1 ruby2.1-rubygem-activesupport-4_2-4.2.4-6.1 ruby2.1-rubygem-activesupport-doc-4_2-4.2.4-6.1 rubygem-actionpack-4_2-4.2.4-6.1 rubygem-actionview-4_2-4.2.4-6.1 rubygem-activemodel-4_2-4.2.4-6.1 rubygem-activerecord-4_2-4.2.4-6.1 rubygem-activesupport-4_2-4.2.4-6.1 ruby2.1-rubygem-actionpack-4_2-4.2.4-6.1 as a component of openSUSE Leap 42.1 ruby2.1-rubygem-actionpack-doc-4_2-4.2.4-6.1 as a component of openSUSE Leap 42.1 ruby2.1-rubygem-actionview-4_2-4.2.4-6.1 as a component of openSUSE Leap 42.1 ruby2.1-rubygem-actionview-doc-4_2-4.2.4-6.1 as a component of openSUSE Leap 42.1 ruby2.1-rubygem-activemodel-4_2-4.2.4-6.1 as a component of openSUSE Leap 42.1 ruby2.1-rubygem-activemodel-doc-4_2-4.2.4-6.1 as a component of openSUSE Leap 42.1 ruby2.1-rubygem-activerecord-4_2-4.2.4-6.1 as a component of openSUSE Leap 42.1 ruby2.1-rubygem-activerecord-doc-4_2-4.2.4-6.1 as a component of openSUSE Leap 42.1 ruby2.1-rubygem-activesupport-4_2-4.2.4-6.1 as a component of openSUSE Leap 42.1 ruby2.1-rubygem-activesupport-doc-4_2-4.2.4-6.1 as a component of openSUSE Leap 42.1 rubygem-actionpack-4_2-4.2.4-6.1 as a component of openSUSE Leap 42.1 rubygem-actionview-4_2-4.2.4-6.1 as a component of openSUSE Leap 42.1 rubygem-activemodel-4_2-4.2.4-6.1 as a component of openSUSE Leap 42.1 rubygem-activerecord-4_2-4.2.4-6.1 as a component of openSUSE Leap 42.1 rubygem-activesupport-4_2-4.2.4-6.1 as a component of openSUSE Leap 42.1 The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences. CVE-2015-7576 openSUSE Leap 42.1:ruby2.1-rubygem-actionpack-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-actionpack-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-actionview-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-actionview-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activemodel-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activemodel-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activerecord-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activerecord-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activesupport-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activesupport-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-actionpack-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-actionview-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-activemodel-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-activerecord-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-activesupport-4_2-4.2.4-6.1 moderate 4.3 AV:N/AC:M/Au:N/C:P/I:N/A:N Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html https://www.suse.com/security/cve/CVE-2015-7576.html CVE-2015-7576 https://bugzilla.suse.com/963329 SUSE Bug 963329 https://bugzilla.suse.com/970715 SUSE Bug 970715 activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, which allows remote attackers to bypass intended change restrictions by leveraging use of the nested attributes feature. CVE-2015-7577 openSUSE Leap 42.1:ruby2.1-rubygem-actionpack-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-actionpack-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-actionview-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-actionview-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activemodel-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activemodel-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activerecord-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activerecord-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activesupport-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activesupport-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-actionpack-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-actionview-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-activemodel-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-activerecord-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-activesupport-4_2-4.2.4-6.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html https://www.suse.com/security/cve/CVE-2015-7577.html CVE-2015-7577 https://bugzilla.suse.com/963330 SUSE Bug 963330 actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory consumption) by leveraging an application's use of a wildcard controller route. CVE-2015-7581 openSUSE Leap 42.1:ruby2.1-rubygem-actionpack-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-actionpack-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-actionview-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-actionview-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activemodel-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activemodel-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activerecord-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activerecord-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activesupport-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activesupport-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-actionpack-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-actionview-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-activemodel-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-activerecord-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-activesupport-4_2-4.2.4-6.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html https://www.suse.com/security/cve/CVE-2015-7581.html CVE-2015-7581 https://bugzilla.suse.com/963335 SUSE Bug 963335 actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the MIME type cache, which allows remote attackers to cause a denial of service (memory consumption) via a crafted HTTP Accept header. CVE-2016-0751 openSUSE Leap 42.1:ruby2.1-rubygem-actionpack-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-actionpack-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-actionview-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-actionview-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activemodel-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activemodel-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activerecord-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activerecord-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activesupport-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activesupport-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-actionpack-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-actionview-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-activemodel-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-activerecord-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-activesupport-4_2-4.2.4-6.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:N/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html https://www.suse.com/security/cve/CVE-2016-0751.html CVE-2016-0751 https://bugzilla.suse.com/963331 SUSE Bug 963331 Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pathname. CVE-2016-0752 openSUSE Leap 42.1:ruby2.1-rubygem-actionpack-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-actionpack-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-actionview-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-actionview-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activemodel-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activemodel-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activerecord-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activerecord-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activesupport-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activesupport-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-actionpack-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-actionview-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-activemodel-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-activerecord-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-activesupport-4_2-4.2.4-6.1 moderate 6.8 AV:N/AC:M/Au:N/C:P/I:P/A:P Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html https://www.suse.com/security/cve/CVE-2016-0752.html CVE-2016-0752 https://bugzilla.suse.com/963332 SUSE Bug 963332 https://bugzilla.suse.com/968850 SUSE Bug 968850 Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level writers for class accessors, which allows remote attackers to bypass intended validation steps via crafted parameters. CVE-2016-0753 openSUSE Leap 42.1:ruby2.1-rubygem-actionpack-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-actionpack-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-actionview-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-actionview-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activemodel-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activemodel-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activerecord-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activerecord-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activesupport-4_2-4.2.4-6.1 openSUSE Leap 42.1:ruby2.1-rubygem-activesupport-doc-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-actionpack-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-actionview-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-activemodel-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-activerecord-4_2-4.2.4-6.1 openSUSE Leap 42.1:rubygem-activesupport-4_2-4.2.4-6.1 moderate 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N Please Install the update. https://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html https://www.suse.com/security/cve/CVE-2016-0753.html CVE-2016-0753 https://bugzilla.suse.com/963334 SUSE Bug 963334