SB2016081711 - Fedora 25 update for rubygem-actioncable, rubygem-actionmailer, rubygem-actionpack, rubygem-actionview, rubygem-activejob, rubygem-activemodel, rubygem-activerecord, rubygem-activesupport, rubygem-rails, rubygem-railties

Description

This security bulletin contains information about 2 secuirty vulnerabilities.

1) Security restrictions bypass (CVE-ID: CVE-2016-6317)

The vulnerability allows a remote attacker to bypass certain security restrictions.

Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values.

2) Cross-site scripting (CVE-ID: CVE-2016-6316)

Vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability is caused by an input validation error in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1. A remote authenticated attacker can trick the victim to follow a specially specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Remediation

Install update from vendor's website.

References

• https://bodhi.fedoraproject.org/updates/FEDORA-2016-5760339e76