kaminari versions prior to 0.16.2 are vulnerable to an Insecure File
Permissions vulnerability, where certain files within the kaminari gem have
insecure file permissions.

Versions Affected: < 0.16.2
Fixed Versions: >= 0.16.2

Impact

An attacker with local access could write arbitrary code to the affected files
resulting in arbitrary code execution.

Releases

The fixed releases are available at the normal locations.

Workarounds

Manually set the permissions of the affected files to 644.

All Affected Versions:

lib/kaminari/models/page_scope_methods.rb

Version 0.15.0 and 0.15.1:

spec/models/mongo_mapper/mongo_mapper_spec.rb

Version 0.16.0:

spec/models/mongo_mapper/mongo_mapper_spec.rb
spec/models/mongoid/mongoid_spec.rb

Version 0.16.1:

spec/models/active_record/scopes_spec.rb
spec/models/mongo_mapper/mongo_mapper_spec.rb
spec/models/mongoid/mongoid_spec.rb
gemfiles/data_mapper_12.gemfile
gemfiles/active_record_32.gemfile