Bug 731432 (CVE-2011-2929)

Summary:	CVE-2011-2929 rubygem-actionpack: filter skipping vulnerability (Ruby on Rails)
Product:	[Other] Security Response	Reporter:	Vincent Danen <vdanen>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	bkearney, clalance, lutter, mastahnke, mhicks, mmorsi, mtasaka, sseago, vanmeeuwen+fedora, vondruch
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:	rubygem-actionpack 3.0.10, rubygem-actionpack 3.1.0	Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2013-01-16 09:46:29 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:
Bug Depends On:	731440, 731448
Bug Blocks:	732542

Description Vincent Danen 2011-08-17 16:29:39 UTC

A flaw in the template selection code in Ruby on Rails >=3.0 could allow an attacker to render a view they should not have access to [1].  This is corrected in 3.0.10 and 3.1.0rc6, patches are available in the advisory [1] and in git [2].

[1] http://groups.google.com/group/rubyonrails-security/browse_thread/thread/3420ac71aed312d6
[2] https://github.com/rails/rails/commit/5f94b93279f6d0682fafb237c301302c107a9552

Comment 2 Vincent Danen 2011-08-17 17:16:37 UTC

This flaw is in rubygem-actionpack, not rubygem-rails.

Comment 3 Vincent Danen 2011-08-17 17:25:46 UTC

Created rubygem-actionpack tracking bugs for this issue

Affects: fedora-15 [bug 731448]

Comment 5 Chris Lalancette 2011-08-18 14:08:21 UTC

I'm not really familiar with the Fedora security response procedures, but don't we also need a F-16 and rawhide bug as well?  Since the flaw was just fixed yesterday, the problem will be in all 3.

Comment 6 Vincent Danen 2011-08-18 20:29:37 UTC

You should be able to use the same tracking bug for all three.

Comment 7 Chris Lalancette 2011-08-18 20:45:55 UTC

OK, thanks, that's what I wanted to know.

Comment 8 Vincent Danen 2011-08-30 04:21:01 UTC

This issue has been assigned the name CVE-2011-2929:

http://www.openwall.com/lists/oss-security/2011/08/19/11

Comment 10 Huzaifa S. Sidhpurwala 2011-09-07 05:57:21 UTC

This issue does not affect the version of rubygem-actionpack shipped with Fedora 14.

This issue has been addressed in Fedora-15 and upcoming Fedora-16 via the following advisories:

fedora-15:
https://admin.fedoraproject.org/updates/rubygem-actionpack-3.0.5-4.fc15

fedora-16:
https://admin.fedoraproject.org/updates/rubygem-activesupport-3.0.10-1.fc16,rubygem-activemodel-3.0.10-1.fc16,rubygem-activerecord-3.0.10-1.fc16,rubygem-activeresource-3.0.10-1.fc16,rubygem-actionpack-3.0.10-1.fc16,rubygem-actionmailer-3.0.10-1.fc16,rubygem-railties-3.0.10-1.fc16,rubygem-rails-3.0.10-1.fc16