This service will be undergoing maintenance at 00:00 UTC, 2017-10-23 It is expected to last about 30 minutes
Bug 1297846 - rubygem-rails: XSS vulnerability in the select helper
rubygem-rails: XSS vulnerability in the select helper
Status: CLOSED WONTFIX
Product: Security Response
Classification: Other
Component: vulnerability (Show other bugs)
unspecified
All Linux
medium Severity medium
: ---
: ---
Assigned To: Red Hat Product Security
impact=moderate,public=20120301,repor...
: Security
Depends On:
Blocks: 1297848
  Show dependency treegraph
 
Reported: 2016-01-12 10:38 EST by Adam Mariš
Modified: 2016-01-13 15:09 EST (History)
37 users (show)

See Also:
Fixed In Version: rubygem-rails 3.2.2, rubygem-rails 3.1.4, rubygem-rails 3.0.12
Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of:
Environment:
Last Closed: 2016-01-13 15:09:18 EST
Type: ---
Regression: ---
Mount Type: ---
Documentation: ---
CRM:
Verified Versions:
Category: ---
oVirt Team: ---
RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: ---


Attachments (Terms of Use)

  None (edit)
Description Adam Mariš 2016-01-12 10:38:11 EST
It was reported that when developers generate html options tags manually, user input concatenated with manually built tags may not be escaped and an attacker can inject arbitrary HTML in to the document. Only manually generated select tag options are impacted.

Vulnerable code:

<%= select('post', 'author_id', "<option value='#{user.id}'>#{user.name}</option>") %>

Patches can be found here:

https://groups.google.com/forum/#!msg/rubyonrails-security/CdoMUVpsRmQ/iFRwR1xPym8J
Comment 1 Kurt Seifried 2016-01-13 15:09:18 EST
Statement:

This issue affects the versions of rubygem-rails as shipped with Red Hat Subscription Asset Manager 1.2. Red Hat Product Security has rated this issue as having Moderate security impact. A future update may address this issue. For additional information, refer to the Issue Severity Classification: https://access.redhat.com/security/updates/classification/.

Note You need to log in before you can comment on or make changes to this bug.