Lookup for vulnerabilities affecting packages.
| Vulnerability_id | VCID-b7z5-h1bw-tya9 |
|---|
| Summary | Missing security headers in Action Pack on non-HTML responses
# Permissions-Policy is Only Served on HTML Content-Type
The application configurable Permissions-Policy is only served on responses
with an HTML related Content-Type.
This has been assigned the CVE identifier CVE-2024-28103.
Versions Affected: >= 6.1.0
Not affected: < 6.1.0
Fixed Versions: 6.1.7.8, 7.0.8.4, and 7.1.3.4
Impact
------
Responses with a non-HTML Content-Type are not serving the configured Permissions-Policy. There are certain non-HTML Content-Types that would benefit from having the Permissions-Policy enforced.
Releases
--------
The fixed releases are available at the normal locations.
Workarounds
-----------
N/A
Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches for
the supported release series in accordance with our
[maintenance policy](https://guides.rubyonrails.org/maintenance_policy.html#security-issues)
regarding security issues. They are in git-am format and consist of a
single changeset.
* 6-1-include-permissions-policy-header-on-non-html.patch - Patch for 6.1 series
* 7-0-include-permissions-policy-header-on-non-html.patch - Patch for 7.0 series
* 7-1-include-permissions-policy-header-on-non-html.patch - Patch for 7.1 series
Credits
-------
Thank you [shinkbr](https://hackerone.com/shinkbr) for reporting this! |
|---|
| Aliases |
| 0 |
|
| 1 |
| alias |
GHSA-fwhr-88qx-h9g7 |
|
|
|---|
| Fixed_packages |
|
|---|
| Affected_packages |
| 0 |
| url |
pkg:gem/actionpack@6.1.0 |
| purl |
pkg:gem/actionpack@6.1.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-98gu-r7wd-cuah |
|
| 1 |
| vulnerability |
VCID-b7z5-h1bw-tya9 |
|
| 2 |
| vulnerability |
VCID-dd87-gevs-juhe |
|
| 3 |
| vulnerability |
VCID-eeru-6pyc-8bcd |
|
| 4 |
| vulnerability |
VCID-fdqs-v9b2-53gu |
|
| 5 |
| vulnerability |
VCID-fgtd-zx7r-rygb |
|
| 6 |
| vulnerability |
VCID-k6aw-heeb-wke2 |
|
| 7 |
| vulnerability |
VCID-nmz3-ux68-dkfd |
|
| 8 |
| vulnerability |
VCID-qth9-abgp-wyaq |
|
| 9 |
| vulnerability |
VCID-re7g-rxbm-dbd9 |
|
| 10 |
| vulnerability |
VCID-v2hk-dfbe-5khc |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@6.1.0 |
|
| 1 |
| url |
pkg:gem/actionpack@7.0.0 |
| purl |
pkg:gem/actionpack@7.0.0 |
| is_vulnerable |
true |
| affected_by_vulnerabilities |
| 0 |
| vulnerability |
VCID-98gu-r7wd-cuah |
|
| 1 |
| vulnerability |
VCID-b7z5-h1bw-tya9 |
|
| 2 |
| vulnerability |
VCID-dd87-gevs-juhe |
|
| 3 |
| vulnerability |
VCID-eeru-6pyc-8bcd |
|
| 4 |
| vulnerability |
VCID-k6aw-heeb-wke2 |
|
| 5 |
| vulnerability |
VCID-m9ud-s6w6-x7ac |
|
| 6 |
| vulnerability |
VCID-ndth-atqq-53gq |
|
| 7 |
| vulnerability |
VCID-nmz3-ux68-dkfd |
|
| 8 |
| vulnerability |
VCID-qth9-abgp-wyaq |
|
| 9 |
| vulnerability |
VCID-re7g-rxbm-dbd9 |
|
| 10 |
| vulnerability |
VCID-v2hk-dfbe-5khc |
|
| 11 |
| vulnerability |
VCID-z277-4dtj-zfbz |
|
|
| resource_url |
http://public2.vulnerablecode.io/packages/pkg:gem/actionpack@7.0.0 |
|
| 2 |
|
| 3 |
|
|
|---|
| References |
| 0 |
|
| 1 |
|
| 2 |
|
| 3 |
|
| 4 |
|
| 5 |
|
| 6 |
|
| 7 |
|
| 8 |
|
| 9 |
|
| 10 |
|
| 11 |
|
|
|---|
| Weaknesses |
| 0 |
| cwe_id |
20 |
| name |
Improper Input Validation |
| description |
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly. |
|
|
|---|
| Exploits |
|
|---|
| Severity_range_score | 4.0 - 6.9 |
|---|
| Exploitability | null |
|---|
| Weighted_severity | null |
|---|
| Risk_score | null |
|---|
| Resource_url | http://public2.vulnerablecode.io/vulnerabilities/VCID-b7z5-h1bw-tya9 |
|---|