Ruby/activesupport/7.0.0.rc2
A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.
https://rubygems.org/gems/activesupport
MIT
3 Security Vulnerabilities
ReDoS based DoS vulnerability in Active Support’s underscore
There is a possible regular expression based DoS vulnerability in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-22796.
Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 (Rails LTS), 6.1.7.1, 7.0.4.1
Impact
A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.
This affects String#underscore, ActiveSupport::Inflector.underscore, String#titleize, and any other methods using these.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Workarounds
There are no feasible workarounds for this issue.
Users on Ruby 3.2.0 or greater may be able to reduce the impact by configuring Regexp.timeout.
Possible XSS Security Vulnerability in SafeBuffer#bytesplice
There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input. This vulnerability has been assigned the CVE identifier CVE-2023-28120.
Versions Affected: All. Not affected: None Fixed Versions: 7.0.4.3, 6.1.7.3
Impact
ActiveSupport uses the SafeBuffer string subclass to tag strings as htmlsafe after they have been sanitized. When these strings are mutated, the tag is should be removed to mark them as no longer being htmlsafe.
Ruby 3.2 introduced a new bytesplice method which ActiveSupport did not yet understand to be a mutation. Users on older versions of Ruby are likely unaffected.
All users running an affected release and using bytesplice should either upgrade or use one of the workarounds immediately.
Workarounds
Avoid calling bytesplice on a SafeBuffer (html_safe) string with untrusted user input.
Possible File Disclosure of Locally Encrypted Files
There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037.
Versions Affected: >= 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5
Impact
ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file’s permissions are defaulted to the user’s current umask settings, meaning that it’s possible for other users on the same system to read the contents of the temporary file.
Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The fixed releases are available at the normal locations.
Workarounds
To work around this issue, you can set your umask to be more restrictive like this:
$ umask 0077
477 Other Versions
Version | License | Security | Released | |
---|---|---|---|---|
8.0.0 | MIT | 2024-11-07 - 22:30 | 6 days | |
8.0.0.rc2 | MIT | 2024-10-30 - 00:31 | 15 days | |
8.0.0.rc1 | MIT | 2024-10-19 - 01:43 | 26 days | |
8.0.0.beta1 | MIT | 2024-09-26 - 15:05 | about 2 months | |
7.2.2 | MIT | 2024-10-31 - 01:47 | 14 days | |
7.2.1.2 | MIT | 2024-10-23 - 22:34 | 21 days | |
7.2.1.1 | MIT | 2024-10-15 - 20:46 | 29 days | |
7.2.1 | MIT | 2024-08-22 - 19:45 | 3 months | |
7.2.0 | MIT | 2024-08-09 - 23:26 | 3 months | |
7.2.0.rc1 | MIT | 2024-08-06 - 17:00 | 3 months | |
7.2.0.beta3 | MIT | 2024-07-11 - 15:19 | 4 months | |
7.2.0.beta2 | MIT | 2024-06-04 - 18:14 | 5 months | |
7.2.0.beta1 | MIT | 2024-05-29 - 23:37 | 6 months | |
7.1.5 | MIT | 2024-10-31 - 01:34 | 14 days | |
7.1.4.2 | MIT | 2024-10-23 - 22:28 | 21 days | |
7.1.4.1 | MIT | 2024-10-15 - 20:39 | 29 days | |
7.1.4 | MIT | 2024-08-22 - 21:26 | 3 months | |
7.1.3.4 | MIT | 2024-06-04 - 18:00 | 5 months | |
7.1.3.3 | MIT | 2024-05-16 - 19:21 | 6 months | |
7.1.3.2 | MIT | 2024-02-21 - 21:45 | 9 months | |
7.1.3.1 | MIT | 2024-02-21 - 18:46 | 9 months | |
7.1.3 | MIT | 2024-01-16 - 22:53 | 10 months | |
7.1.2 | MIT | 2023-11-10 - 21:49 | about 1 year | |
7.1.1 | MIT | 2023-10-11 - 22:16 | about 1 year | |
7.1.0 | MIT | 2023-10-05 - 08:06 | about 1 year | |
7.1.0.rc2 | MIT | 2023-10-01 - 21:59 | about 1 year | |
7.1.0.rc1 | MIT | 2023-09-27 - 04:00 | about 1 year | |
7.1.0.beta1 | MIT | 2023-09-13 - 00:36 | about 1 year | |
7.0.8.6 | MIT | 2024-10-23 - 22:23 | 21 days | |
7.0.8.5 | MIT | 2024-10-15 - 20:23 | 29 days | |
7.0.8.4 | MIT | 2024-06-04 - 17:56 | 5 months | |
7.0.8.3 | MIT | 2024-05-17 - 19:52 | 6 months | |
7.0.8.2 | MIT | 2024-05-16 - 18:57 | 6 months | |
7.0.8.1 | MIT | 2024-02-21 - 18:42 | 9 months | |
7.0.8 | MIT | 2023-09-09 - 19:10 | about 1 year | |
7.0.7.2 | MIT | 2023-08-22 - 20:10 | about 1 year | |
7.0.7.1 | MIT | 2023-08-22 - 17:20 | about 1 year | |
7.0.7 | MIT | 2 | 2023-08-09 - 23:56 | over 1 year |
7.0.6 | MIT | 2 | 2023-06-29 - 20:53 | over 1 year |
7.0.5.1 | MIT | 2 | 2023-06-26 - 21:35 | over 1 year |
7.0.5 | MIT | 2 | 2023-05-24 - 18:57 | over 1 year |
7.0.4.3 | MIT | 2 | 2023-03-13 - 18:53 | over 1 year |
7.0.4.2 | MIT | 4 | 2023-01-25 - 03:14 | almost 2 years |
7.0.4.1 | MIT | 4 | 2023-01-17 - 18:55 | almost 2 years |
7.0.4 | MIT | 6 | 2022-09-09 - 18:42 | about 2 years |
7.0.3.1 | MIT | 6 | 2022-07-12 - 17:31 | over 2 years |
7.0.3 | MIT | 6 | 2022-05-09 - 13:35 | over 2 years |
7.0.2.4 | MIT | 6 | 2022-04-26 - 19:33 | over 2 years |
7.0.2.3 | MIT | 6 | 2022-03-08 - 17:50 | over 2 years |
7.0.2.2 | MIT | 6 | 2022-02-11 - 19:43 | almost 3 years |
7.0.2.1 | MIT | 6 | 2022-02-11 - 18:18 | almost 3 years |
7.0.2 | MIT | 6 | 2022-02-08 - 23:11 | almost 3 years |
7.0.1 | MIT | 6 | 2022-01-06 - 21:53 | almost 3 years |
7.0.0 | MIT | 6 | 2021-12-15 - 23:42 | almost 3 years |
7.0.0.rc3 | MIT | 3 | 2021-12-14 - 23:04 | almost 3 years |
7.0.0.rc2 | MIT | 3 | 2021-12-14 - 19:39 | almost 3 years |
7.0.0.rc1 | MIT | 3 | 2021-12-06 - 21:28 | almost 3 years |
7.0.0.alpha2 | MIT | 3 | 2021-09-15 - 23:14 | about 3 years |
7.0.0.alpha1 | MIT | 3 | 2021-09-15 - 21:55 | about 3 years |
6.1.7.10 | MIT | 2024-10-23 - 21:58 | 21 days | |
6.1.7.9 | MIT | 2024-10-15 - 21:24 | 29 days | |
6.1.7.8 | MIT | 2024-06-04 - 17:55 | 5 months | |
6.1.7.7 | MIT | 2024-02-21 - 18:38 | 9 months | |
6.1.7.6 | MIT | 2023-08-22 - 20:07 | about 1 year | |
6.1.7.5 | MIT | 2023-08-22 - 17:15 | about 1 year | |
6.1.7.4 | MIT | 1 | 2023-06-26 - 21:31 | over 1 year |
6.1.7.3 | MIT | 1 | 2023-03-13 - 18:48 | over 1 year |
6.1.7.2 | MIT | 2 | 2023-01-25 - 03:23 | almost 2 years |
6.1.7.1 | MIT | 2 | 2023-01-17 - 18:54 | almost 2 years |
6.1.7 | MIT | 3 | 2022-09-09 - 18:38 | about 2 years |
6.1.6.1 | MIT | 3 | 2022-07-12 - 17:29 | over 2 years |
6.1.6 | MIT | 3 | 2022-05-09 - 13:44 | over 2 years |
6.1.5.1 | MIT | 3 | 2022-04-26 - 19:30 | over 2 years |
6.1.5 | MIT | 3 | 2022-03-10 - 21:12 | over 2 years |
6.1.4.7 | MIT | 3 | 2022-03-08 - 17:48 | over 2 years |
6.1.4.6 | MIT | 3 | 2022-02-11 - 19:41 | almost 3 years |
6.1.4.5 | MIT | 3 | 2022-02-11 - 18:22 | almost 3 years |
6.1.4.4 | MIT | 3 | 2021-12-15 - 22:52 | almost 3 years |
6.1.4.3 | MIT | 3 | 2021-12-14 - 23:02 | almost 3 years |
6.1.4.2 | MIT | 3 | 2021-12-14 - 19:45 | almost 3 years |
6.1.4.1 | MIT | 3 | 2021-08-19 - 16:25 | about 3 years |
6.1.4 | MIT | 3 | 2021-06-24 - 20:40 | over 3 years |
6.1.3.2 | MIT | 3 | 2021-05-05 - 15:34 | over 3 years |
6.1.3.1 | MIT | 3 | 2021-03-26 - 18:05 | over 3 years |
6.1.3 | MIT | 3 | 2021-02-17 - 18:41 | over 3 years |
6.1.2.1 | MIT | 3 | 2021-02-10 - 20:44 | almost 4 years |
6.1.2 | MIT | 3 | 2021-02-09 - 21:28 | almost 4 years |
6.1.1 | MIT | 3 | 2021-01-07 - 22:58 | almost 4 years |
6.1.0 | MIT | 3 | 2020-12-09 - 19:56 | almost 4 years |
6.1.0.rc2 | MIT | 3 | 2020-12-01 - 22:00 | almost 4 years |
6.1.0.rc1 | MIT | 3 | 2020-11-02 - 21:14 | about 4 years |
6.0.6.1 | MIT | 6 | 2023-01-17 - 18:52 | almost 2 years |
6.0.6 | MIT | 6 | 2022-09-09 - 18:31 | about 2 years |
6.0.5.1 | MIT | 6 | 2022-07-12 - 17:28 | over 2 years |
6.0.5 | MIT | 6 | 2022-05-09 - 13:50 | over 2 years |
6.0.4.8 | MIT | 6 | 2022-04-26 - 19:26 | over 2 years |
6.0.4.7 | MIT | 6 | 2022-03-08 - 17:47 | over 2 years |
6.0.4.6 | MIT | 6 | 2022-02-11 - 19:39 | almost 3 years |
6.0.4.5 | MIT | 6 | 2022-02-11 - 18:24 | almost 3 years |
6.0.4.4 | MIT | 6 | 2021-12-15 - 22:45 | almost 3 years |