sinatra: Reflected File Download attack

A flaw was found in Sinatra, a domain-specific language for creating web applications in Ruby. An application is vulnerable to a reflected file download RFD attack that sets the Content-Disposition header of a response when the filename is derived from user-supplied input...

Ubuntu: Security Advisory (USN-5806-2)

The remote host is missing an update for the SPDX-FileCopyrightText: 2023 Greenbone AG Some text descriptions might be excerpted from a referenced sources, and are Copyright C by the respective right holders. SPDX-License-Identifier: GPL-2.0-only ifdescription...

RHEL 8 : pcs (RHSA-2023:0427)

The remote Redhat Enterprise Linux 8 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2023:0427 advisory. The pcs packages provide a command-line configuration system for the Pacemaker and Corosync utilities. Security Fixes: sinatra: Reflected File Downlo...

USN-5806-2 ruby2.5, ruby3.0 vulnerability

USN-5806-1 fixed vulnerabilities in Ruby. This update fixes the problem for Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.10. Original advisory details: Hiroshi Tokumaru discovered that Ruby did not properly handle certain user input for applications which generate HTTP responses using cgi ge...

Ruby Sinatra Name Path Limitation Confidential Data

The vulnerability of the Ruby Sinatra web application development framework is related to shortcomings in pathname restrictions for directories. Exploiting this vulnerability allows an attacker operating remotely to gain access to confidential data...

Ubuntu 18.04 LTS / 22.04 LTS : Ruby vulnerability (USN-5806-2)

The remote Ubuntu 18.04 LTS / 22.04 LTS host has packages installed that are affected by a vulnerability as referenced in the USN-5806-2 advisory. USN-5806-1 fixed vulnerabilities in Ruby. This update fixes the problem for Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.10. Tenable has extracte...

Oracle Linux 8 : ruby:2.5 (ELSA-2023-12064)

The remote Oracle Linux 8 host has packages installed that are affected by a vulnerability as referenced in the ELSA-2023-12064 advisory. ruby 2.5.9-110.0.1 - Fix for CVE-2022-28739 Orabug: 34824177 Tenable has extracted the preceding description block directly from the Oracle Linux security...

ruby:2.5 security update

ruby 2.5.9-110.0.1 - Fix for CVE-2022-28739 Orabug: 34824177...

rubygem-activerecord security vulnerability

rubygem-activerecord is an application of rubygems open source. A security vulnerability exists in rubygem-activerecord that stems from the presence of a denial of service...

rubygem-rack security vulnerability

rubygem-rack is an application in the rubygems open source. Rubygem-rack has a security vulnerability that stems from a denial of service in Content-Disposition parsing...

PT-2023-9883 · Ruby · Jruby-Openssl

Name of the Vulnerable Software and Affected Versions: jruby-openssl gem versions prior to 0.6 Description: A security issue was found in the handling of SSL certificate validation, where failed verification did not properly alert the application, making it vulnerable to attacks. This could allow...

ReDoS based DoS vulnerability in Active Support's underscore

There is a possible regular expression based DoS vulnerability in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-22796. Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 Rails LTS, which is a paid service and not part of the rubygem, 6.1.7.1,...

GHSA-J6GC-792M-QGM2 ReDoS based DoS vulnerability in Active Support's underscore

There is a possible regular expression based DoS vulnerability in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-22796. Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 Rails LTS, which is a paid service and not part of the rubygem, 6.1.7.1,...

GHSA-8XWW-X3G3-6JCV ReDoS based DoS vulnerability in Action Dispatch

There is a possible regular expression based DoS vulnerability in Action Dispatch related to the If-None-Match header. This vulnerability has been assigned the CVE identifier CVE-2023-22795. Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 Rails LTS, 6.1.7.1, 7.0.4.1 Impact A...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in the ifnonematch header in http/cache.rb. An attacker can cause resource exhaustion with a malicious If-None-Match header if a version of Ruby below 3.2.0 is in use. NOTE: Patches have been...

ReDoS based DoS vulnerability in Action Dispatch

There is a possible regular expression based DoS vulnerability in Action Dispatch related to the If-None-Match header. This vulnerability has been assigned the CVE identifier CVE-2023-22795. Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 Rails LTS, 6.1.7.1, 7.0.4.1 Impact A...

Regular Expression Denial of Service (ReDoS)

Overview rack is a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between the so-called middleware into a singl...

Regular Expression Denial of Service (ReDoS)

Overview Affected versions of this package are vulnerable to Regular Expression Denial of Service ReDoS in uri/gid.rb, when parsing modelname values. NOTE: A patch has been released to address this issue: 1-0-model-name-redos.patch Details Denial of Service DoS describes a family of attacks, all...

ReDoS based DoS vulnerability in Action Dispatch

There is a possible regular expression based DoS vulnerability in Action Dispatch related to the If-None-Match header. This vulnerability has been assigned the CVE identifier CVE-2023-22795. Versions Affected: All Not affected: None Fixed Versions: 6.1.7.1, 7.0.4.1 Impact A specially crafted HTTP...

ReDoS based DoS vulnerability in Active Support’s underscore

There is a possible regular expression based DoS vulnerability in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-22796. Versions Affected: All Not affected: None Fixed Versions: 6.1.7.1, 7.0.4.1 Impact A specially crafted string passed to the underscore method ca...