[SECURITY] [DSA 4586-1] ruby2.5 security update

------------------------------------------------------------------------- Debian Security Advisory DSA-4586-1 [email protected] https://www.debian.org/security/ Salvatore Bonaccorso December 17, 2019 https://www.debian.org/security/faq -...

UBUNTU-CVE-2019-18978

An issue was discovered in the rack-cors aka Rack CORS Middleware gem before 1.0.4 for Ruby. It allows ../ directory traversal to access private resources because resource matching does not ensure that pathnames are in a canonical format...

GHSA-XV7X-X6WR-XX7G Apache Ranger policy engine incorrectly matches paths in certain conditions

Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true...

CVE-2016-8746

CVE-2016-8746 affects Apache Ranger policy engine prior to version 0.6.3. The issue is a path-matching defect that occurs under recursive evaluation when policies do not contain wildcards, enablingmis-matches and potential security bypass. The vulnerability is scoped to the policy engine logic (n...

CVE-2016-8746

Apache Ranger before 0.6.3 policy engine incorrectly matches paths in certain conditions when policy does not contain wildcards and has recursion flag set to true...

Spring Security / MVC Path Matching Inconsistency

Both Spring Security and the Spring Framework rely on URL pattern mappings for authorization and for mapping requests to controllers respectively. Differences in the strictness of the pattern matching mechanisms, for example with regards to space trimming in path segments, can lead Spring Securit...

SA-CONTRIB-2013-088 - Secure Pages - Missing Encryption of Sensitive Data

The Secure Pages module manages redirects between HTTP and HTTPS pages. A flaw in the URL path matching could lead some pages and forms to be transmitted via plain HTTP, even if the administrator intended those pages to use HTTPS. This flaw may surface either due to a malicious user enticing a us...