This update of rubygems fixes two vulnerabilities :

  - CVE-2008-7248: CVSS v2 Base Score: 4.3 Rails CSRF     protection can be bypassed by using special     content-types for a HTTP request.

  - CVE-2009-4214: CVSS v2 Base Score: 4.3 The method     strip_tags does not completely protect against XSS     attacks.

The remote host is affected by the vulnerability described in GLSA-200912-02 (Ruby on Rails: Multiple vulnerabilities)

    The following vulnerabilities were discovered:
    sameer     reported that lib/action_controller/cgi_process.rb removes the     :cookie_only attribute from the default session options     (CVE-2007-6077), due to an incomplete fix for CVE-2007-5380 (GLSA     200711-17).
    Tobias Schlottke reported that the :limit and     :offset parameters of ActiveRecord::Base.find() are not properly     sanitized before being processed (CVE-2008-4094).
    Steve from     Coderrr reported that the CRSF protection in protect_from_forgery()     does not parse the text/plain MIME format (CVE-2008-7248).
    Nate reported a documentation error that leads to the assumption     that a block returning nil passed to     authenticate_or_request_with_http_digest() would deny access to the     requested resource (CVE-2009-2422).
    Brian Mastenbrook reported     an input sanitation flaw, related to multibyte characters     (CVE-2009-3009).
    Gabe da Silveira reported an input sanitation     flaw in the strip_tags() function (CVE-2009-4214).
    Coda Hale     reported an information disclosure vulnerability related to HMAC     digests (CVE-2009-3086).
  Impact :

    A remote attacker could send specially crafted requests to a vulnerable     application, possibly leading to the execution of arbitrary SQL     statements or a circumvention of access control. A remote attacker     could also conduct session fixation attacks to hijack a user's session     or bypass the CSRF protection mechanism, or furthermore conduct     Cross-Site Scripting attacks or forge a digest via multiple attempts.
  Workaround :

    There is no known workaround at this time.

この rubygems の更新は 2 つの脆弱性を修正します。

- CVE-2008-7248：CVSS v2 ベーススコア：4.3 Rails CSRF 保護は、HTTP リクエストに対して特別な content-type を使用することで、バイパスされる可能性があります。

- CVE-2009-4214：CVSS v2 ベーススコア：4.3 メソッド strip_tags は、XSS 攻撃から完全には保護されていません。

ID	名前	製品	ファミリー	公開日	更新日	深刻度
44980	openSUSE Security Update : rubygem-actionpack (rubygem-actionpack-1946)	Nessus	SuSE Local Security Checks	2010/3/4	2021/1/14	medium
43378	GLSA-200912-02 : Ruby on Rails: Multiple vulnerabilities	Nessus	Gentoo Local Security Checks	2009/12/22	2021/1/6	high
44983	openSUSE Security Update : rubygem-actionpack (rubygem-actionpack-1946)	Nessus	SuSE Local Security Checks	2010/3/4	2021/1/14	medium
45035	openSUSE Security Update : rubygem-actionpack-2_3 (rubygem-actionpack-2_3-1934)	Nessus	SuSE Local Security Checks	2010/3/11	2021/1/14	medium
44977	openSUSE セキュリティ更新：rubygem-actionpack（rubygem-actionpack-1946）	Nessus	SuSE Local Security Checks	2010/3/4	2021/1/14	medium
44983	openSUSE セキュリティ更新：rubygem-actionpack（rubygem-actionpack-1946）	Nessus	SuSE Local Security Checks	2010/3/4	2021/1/14	medium
44977	openSUSE Security Update : rubygem-actionpack (rubygem-actionpack-1946)	Nessus	SuSE Local Security Checks	2010/3/4	2021/1/14	medium
44980	openSUSE セキュリティ更新：rubygem-actionpack（rubygem-actionpack-1946）	Nessus	SuSE Local Security Checks	2010/3/4	2021/1/14	medium
45035	openSUSE セキュリティ更新：rubygem-actionpack-2_3（rubygem-actionpack-2_3-1934）	Nessus	SuSE Local Security Checks	2010/3/11	2021/1/14	medium

検出

プラグインの検索

medium

high

medium

medium

medium

medium

medium

medium

medium