[SECURITY] [DLA 498-1] ruby-activemodel-3.2 security update

2016-05-3117:22:59

lists.debian.org

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

NONE

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N

5 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:L/Au:N/C:N/I:P/A:N

0.004 Low

EPSS

Percentile

74.2%

JSON

Package : ruby-activemodel-3.2
Version : 3.2_3.2.6-3+deb7u1
CVE ID : CVE-2016-0753

Active Model in Ruby on Rails 4.1.x before 4.1.14.1, 4.2.x before
4.2.5.1, and 5.x before 5.0.0.beta1.1 supports the use of instance-level
writers for class accessors, which allows remote attackers to bypass
intended validation steps via crafted parameters.

For Debian 7 "Wheezy", these problems have been fixed in version
3.2_3.2.6-3+deb7u1.

We recommend that you upgrade your ruby-activemodel-3.2 packages.

Further information about Debian LTS security advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://wiki.debian.org/LTS

OSVersionArchitecturePackageVersionFilename
Debian8allruby-activerecord< 2:4.1.8-1+deb8u1ruby-activerecord_2:4.1.8-1+deb8u1_all.deb
Debian7allruby-activerecord-3.2< 3.2.6-5+deb7u3ruby-activerecord-3.2_3.2.6-5+deb7u3_all.deb
Debian8allruby-activesupport-2.3< 2:4.1.8-1+deb8u1ruby-activesupport-2.3_2:4.1.8-1+deb8u1_all.deb
Debian8allrails< 2:4.1.8-1+deb8u1rails_2:4.1.8-1+deb8u1_all.deb
Debian8allruby-rails< 2:4.1.8-1+deb8u1ruby-rails_2:4.1.8-1+deb8u1_all.deb
Debian8allruby-actionmailer< 2:4.1.8-1+deb8u1ruby-actionmailer_2:4.1.8-1+deb8u1_all.deb
Debian7allruby-activesupport-3.2< 3.2.6-6+deb7u3ruby-activesupport-3.2_3.2.6-6+deb7u3_all.deb
Debian8allruby-actionview< 2:4.1.8-1+deb8u1ruby-actionview_2:4.1.8-1+deb8u1_all.deb
Debian8allruby-activemodel< 2:4.1.8-1+deb8u1ruby-activemodel_2:4.1.8-1+deb8u1_all.deb
Debian8allruby-actionpack< 2:4.1.8-1+deb8u1ruby-actionpack_2:4.1.8-1+deb8u1_all.deb

OS	Version	Architecture	Package	Version	Filename
Debian	8	all	ruby-activerecord	< 2:4.1.8-1+deb8u1	ruby-activerecord_2:4.1.8-1+deb8u1_all.deb
Debian	7	all	ruby-activerecord-3.2	< 3.2.6-5+deb7u3	ruby-activerecord-3.2_3.2.6-5+deb7u3_all.deb
Debian	8	all	ruby-activesupport-2.3	< 2:4.1.8-1+deb8u1	ruby-activesupport-2.3_2:4.1.8-1+deb8u1_all.deb
Debian	8	all	rails	< 2:4.1.8-1+deb8u1	rails_2:4.1.8-1+deb8u1_all.deb
Debian	8	all	ruby-rails	< 2:4.1.8-1+deb8u1	ruby-rails_2:4.1.8-1+deb8u1_all.deb
Debian	8	all	ruby-actionmailer	< 2:4.1.8-1+deb8u1	ruby-actionmailer_2:4.1.8-1+deb8u1_all.deb
Debian	7	all	ruby-activesupport-3.2	< 3.2.6-6+deb7u3	ruby-activesupport-3.2_3.2.6-6+deb7u3_all.deb
Debian	8	all	ruby-actionview	< 2:4.1.8-1+deb8u1	ruby-actionview_2:4.1.8-1+deb8u1_all.deb
Debian	8	all	ruby-activemodel	< 2:4.1.8-1+deb8u1	ruby-activemodel_2:4.1.8-1+deb8u1_all.deb
Debian	8	all	ruby-actionpack	< 2:4.1.8-1+deb8u1	ruby-actionpack_2:4.1.8-1+deb8u1_all.deb