Ruby/actionpack/6.0.2.rc2
Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.
https://rubygems.org/gems/actionpack
MIT
31 Security Vulnerabilities
Open Redirect in ActionPack
- https://nvd.nist.gov/vuln/detail/CVE-2021-22942
- https://github.com/advisories/GHSA-2rqw-v265-jf8c
- https://access.redhat.com/security/cve/cve-2021-22942
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22942.yml
- https://groups.google.com/g/rubyonrails-security/c/wB5tRn7h36c
- https://rubygems.org/gems/actionpack
- https://weblog.rubyonrails.org/2021/8/19/Rails-6-0-4-1-and-6-1-4-1-have-been-released/
- http://www.openwall.com/lists/oss-security/2021/12/14/5
- https://www.debian.org/security/2023/dsa-5372
- https://security.netapp.com/advisory/ntap-20240202-0005/
Overview
There is a possible open redirect vulnerability in the Host Authorization middleware in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2021-22942.
Versions Affected: >= 6.0.0. Not affected: < 6.0.0 Fixed Versions: 6.1.4.1, 6.0.4.1
Impact
Specially crafted “X-Forwarded-Host” headers in combination with certain “allowed host” formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
Impacted applications will have allowed hosts with a leading dot. For example, configuration files that look like this:
config.hosts << '.EXAMPLE.com'
When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
This vulnerability is similar to CVE-2021-22881, but CVE-2021-22881 did not take in to account domain name case sensitivity.
Releases
The fixed releases are available at the normal locations.
Workarounds
In the case a patch can’t be applied, the following monkey patch can be used in an initializer:
module ActionDispatch
class HostAuthorization
HOSTNAME = /[a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9.:]+\]/i
VALID_ORIGIN_HOST = /\A(#{HOSTNAME})(?::\d+)?\z/
VALID_FORWARDED_HOST = /(?:\A|,[ ]?)(#{HOSTNAME})(?::\d+)?\z/
private
def authorized?(request)
origin_host =
request.get_header("HTTP_HOST")&.slice(VALID_ORIGIN_HOST, 1) || ""
forwarded_host =
request.x_forwarded_host&.slice(VALID_FORWARDED_HOST, 1) || ""
@permissions.allows?(origin_host) &&
(forwarded_host.blank? || @permissions.allows?(forwarded_host))
end
end
end
Cross-site scripting in actionpack
- https://nvd.nist.gov/vuln/detail/CVE-2020-8264
- https://github.com/advisories/GHSA-35mm-cc6r-8fjp
- https://hackerone.com/reports/904059
- https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8264.yml
- https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk
In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware.
Workarounds
Until such time as the patch can be applied, application developers should disable the Actionable Exceptions middleware in their development environment via a line such as this one in their config/environment/development.rb: config.middleware.delete ActionDispatch::ActionableExceptions
Actionpack has possible cross-site scripting vulnerability via User Supplied Values to redirect_to
- https://github.com/rails/rails/commit/1c3f93d1e90a3475f9ae2377ead25ccf11f71441
- https://github.com/rails/rails/commit/c9ab9b32bcdcfd8bcd55907f6c7b20b4e004cc23
- https://discuss.rubyonrails.org/t/cve-2023-28362-possible-xss-via-user-supplied-values-to-redirect-to/83132
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-28362.yml
- https://github.com/advisories/GHSA-4g8v-vg43-wpgf
The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header. This vulnerability has been assigned the CVE identifier CVE-2023-28362.
Versions Affected: All. Not affected: None Fixed Versions: 7.0.5.1, 6.1.7.4
Impact
This introduces the potential for a Cross-site-scripting (XSS) payload to be delivered on the now static redirection page. Note that this both requires user interaction and for a Rails app to be configured to allow redirects to external hosts (defaults to false in Rails >= 7.0.x).
Releases
The FIXED releases are available at the normal locations.
Workarounds
Avoid providing user supplied URLs with arbitrary schemes to the redirect_to method.
Possible DoS Vulnerability in Action Controller Token Authentication
- https://github.com/rails/rails/releases/tag/v5.2.4.6
- https://nvd.nist.gov/vuln/detail/CVE-2021-22904
- https://github.com/advisories/GHSA-7wjx-3g7j-8584
- https://github.com/rails/rails/releases/tag/v5.2.6
- https://github.com/rails/rails/releases/tag/v6.0.3.7
- https://github.com/rails/rails/releases/tag/v6.1.3.2
- https://groups.google.com/g/rubyonrails-security/c/Pf1TjkOBdyQ
- https://hackerone.com/reports/1101125
- https://discuss.rubyonrails.org/t/cve-2021-22904-possible-dos-vulnerability-in-action-controller-token-authentication/77869
- https://security.netapp.com/advisory/ntap-20210805-0009/
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22904.yml
There is a possible DoS vulnerability in the Token Authentication logic in Action Controller.
Versions Affected: >= 4.0.0 Not affected: < 4.0.0 Fixed Versions: 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6
Impact
Impacted code uses authenticate_or_request_with_http_token or authenticate_with_http_token for request authentication. Impacted code will look something like this:
class PostsController < ApplicationController
before_action :authenticate
private
def authenticate
authenticate_or_request_with_http_token do |token, options|
# ...
end
end
end
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The fixed releases are available at the normal locations.
Workarounds
The following monkey patch placed in an initializer can be used to work around the issue:
module ActionController::HttpAuthentication::Token
AUTHN_PAIR_DELIMITERS = /(?:,|;|\t)/
end
Patches
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
- 5-2-http-authentication-dos.patch - Patch for 5.2 series
- 6-0-http-authentication-dos.patch - Patch for 6.0 series
- 6-1-http-authentication-dos.patch - Patch for 6.1 series
Please note that only the 6.1.Z, 6.0.Z, and 5.2.Z series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
Credits
Thank you to https://hackerone.com/wonda_tea_coffee for reporting this issue!
Possible Strong Parameters Bypass in ActionPack
- https://nvd.nist.gov/vuln/detail/CVE-2020-8164
- https://github.com/advisories/GHSA-8727-m6gj-mc37
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8164.yml
- https://groups.google.com/forum/#!topic/rubyonrails-security/f6ioe4sdpbY
- https://hackerone.com/reports/292797
- https://groups.google.com/g/rubyonrails-security/c/f6ioe4sdpbY
- https://lists.debian.org/debian-lts-announce/2020/06/msg00022.html
- https://lists.debian.org/debian-lts-announce/2020/07/msg00013.html
- https://www.debian.org/security/2020/dsa-4766
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00089.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00093.html
- http://lists.opensuse.org/opensuse-security-announce/2020-09/msg00107.html
There is a strong parameters bypass vector in ActionPack.
Versions Affected: rails <= 6.0.3 Not affected: rails < 5.0.0 Fixed Versions: rails >= 5.2.4.3, rails >= 6.0.3.1
Impact
In some cases user supplied information can be inadvertently leaked from
Strong Parameters. Specifically the return value of each, or each_value,
or each_pair will return the underlying untrusted
hash of data that was
read from the parameters. Applications that use this return value may be
inadvertently use untrusted user input.
Impacted code will look something like this:
def update
# Attacker has included the parameter: `{ is_admin: true }`
User.update(clean_up_params)
end
def clean_up_params
params.each { |k, v| SomeModel.check(v) if k == :name }
end
Note the mistaken use of each in the clean_up_params method in the above
example.
Workarounds
Do not use the return values of each, each_value, or each_pair in your
application.
Actionpack Open Redirect Vulnerability
- https://nvd.nist.gov/vuln/detail/CVE-2021-22881
- https://github.com/advisories/GHSA-8877-prq4-9xfw
- https://hackerone.com/reports/1047447
- https://benjamin-bouchet.com/cve-2021-22881-faille-de-securite-dans-le-middleware-hostauthorization/
- https://discuss.rubyonrails.org/t/cve-2021-22881-possible-open-redirect-in-host-authorization-middleware/77130
- https://rubygems.org/gems/actionpack
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XQ3NS4IBYE2I3MVMGAHFZBZBIZGHXHT3/
- http://www.openwall.com/lists/oss-security/2021/05/05/2
- http://www.openwall.com/lists/oss-security/2021/08/20/1
- http://www.openwall.com/lists/oss-security/2021/12/14/5
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22881.yml
- https://groups.google.com/g/rubyonrails-security/c/zN_3qA26l6E
- https://github.com/rails/rails/commit/b5de7b3a4787d8a55aaad39f477c16e3af65e444
- https://github.com/rails/rails/blob/v6.1.2.1/actionpack/CHANGELOG.md
The Host Authorization middleware in Action Pack before 6.1.2.1, 6.0.3.5 suffers from an open redirect vulnerability. Specially crafted Host headers in combination with certain allowed host
formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
ReDoS based DoS vulnerability in Action Dispatch
- https://github.com/rails/rails/releases/tag/v7.0.4.1
- https://github.com/advisories/GHSA-8xww-x3g3-6jcv
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-22795.yml
- https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released
- https://nvd.nist.gov/vuln/detail/CVE-2023-22795
- https://discuss.rubyonrails.org/t/cve-2023-22795-possible-redos-based-dos-vulnerability-in-action-dispatch/82118
There is a possible regular expression based DoS vulnerability in Action Dispatch related to the If-None-Match header. This vulnerability has been assigned the CVE identifier CVE-2023-22795.
Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 (Rails LTS), 6.1.7.1, 7.0.4.1
Impact
A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately. Releases
The FIXED releases are available at the normal locations. Workarounds
We recommend that all users upgrade to one of the FIXED versions. In the meantime, users can mitigate this vulnerability by using a load balancer or other device to filter out malicious If-None-Match headers before they reach the application.
Users on Ruby 3.2.0 or greater are not affected by this vulnerability. Patches
To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
6-1-Avoid-regex-backtracking-on-If-None-Match-header.patch - Patch for 6.1 series
7-0-Avoid-regex-backtracking-on-If-None-Match-header.patch - Patch for 7.0 series
Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
Cross-site Scripting in actionpack
- https://nvd.nist.gov/vuln/detail/CVE-2022-3704
- https://github.com/rails/rails/issues/46244
- https://github.com/rails/rails/commit/be177e4566747b73ff63fd5f529fab564e475ed4
- https://vuldb.com/?id.212319
- https://github.com/rails/rails/pull/46269
- https://github.com/advisories/GHSA-9chr-4fjh-5rgw
- https://github.com/rails/rails/issues/46244#issuecomment-1380875153
actionpack from the Ruby on Rails project is vulnerable to Cross-site Scripting in the Route Error Page. This issue has been patched with this commit.
This vulnerability is disputed by the Rails security team. It requires that the developer is tricked into copy pasting a malicious javascript-containing string into a development-only error page accessible only via localhost.
Untrusted users can run pending migrations in production in Rails
- https://nvd.nist.gov/vuln/detail/CVE-2020-8185
- https://github.com/advisories/GHSA-c6qr-h5vq-59jc
- https://github.com/rails/rails/commit/2121b9d20b60ed503aa041ef7b926d331ed79fc2
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8185.yml
- https://groups.google.com/g/rubyonrails-security/c/pAe9EV8gbM0
- https://hackerone.com/reports/899069
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB/
There is a vulnerability in versions of Rails prior to 6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production.
This vulnerability has been assigned the CVE identifier CVE-2020-8185.
Versions Affected: 6.0.0 < rails < 6.0.3.2
Not affected: Applications with config.action_dispatch.show_exceptions = false (this is not a default setting in production)
Fixed Versions: rails >= 6.0.3.2
Impact
Using this issue, an attacker would be able to execute any migrations that are pending for a Rails app running in production mode. It is important to note that an attacker is limited to running migrations the application developer has already defined in their application and ones that have not already run.
Workarounds
Until such time as the patch can be applied, application developers should disable the ActionDispatch middleware in their production environment via a line such as this one in their config/environment/production.rb:
config.middleware.delete ActionDispatch::ActionableExceptions
Denial of Service in Action Dispatch
- https://github.com/rails/rails/releases/tag/v6.0.3.7
- https://nvd.nist.gov/vuln/detail/CVE-2021-22902
- https://github.com/advisories/GHSA-g8ww-46x2-2p65
- https://github.com/rails/rails/releases/tag/v6.1.3.2
- https://groups.google.com/g/rubyonrails-security/c/_5ID_ld9u1c
- https://hackerone.com/reports/1138654
- https://discuss.rubyonrails.org/t/cve-2021-22902-possible-denial-of-service-vulnerability-in-action-dispatch/77866
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22902.yml
Impact
There is a possible Denial of Service vulnerability in Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine.
Releases
The fixed releases are available at the normal locations.
Workarounds
The following monkey patch placed in an initializer can be used to work around the issue.
module Mime
class Type
MIME_REGEXP = /\A(?:\*\/\*|#{MIME_NAME}\/(?:\*|#{MIME_NAME})(?>\s*#{MIME_PARAMETER}\s*)*)\z/
end
end
Patches
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
- 6-0-Prevent-catastrophic-backtracking-during-mime-parsin.patch - Patch for 6.0 series
- 6-1-Prevent-catastrophic-backtracking-during-mime-parsin.patch - Patch for 6.1 series
Please note that only the 6.1.Z, 6.0.Z, and 5.2.Z series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
Credits
Thanks to Security Curious security...@pm.me for reporting this!
Action Pack contains Information Disclosure / Unintended Method Execution vulnerability
- https://github.com/rails/rails/releases/tag/v5.2.4.6
- https://nvd.nist.gov/vuln/detail/CVE-2021-22885
- https://github.com/advisories/GHSA-hjg4-8q5f-x6fm
- https://github.com/rails/rails/releases/tag/v5.2.6
- https://github.com/rails/rails/releases/tag/v6.0.3.7
- https://github.com/rails/rails/releases/tag/v6.1.3.2
- https://groups.google.com/g/rubyonrails-security/c/NiQl-48cXYI
- https://hackerone.com/reports/1106652
- https://www.debian.org/security/2021/dsa-4929
- https://security.netapp.com/advisory/ntap-20210805-0009/
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-22885.yml
Impact
There is a possible information disclosure / unintended method execution vulnerability in Action Pack when using the redirect_to or polymorphic_url helper with untrusted user input.
Vulnerable code will look like this.
redirect_to(params[:some_param])
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The FIXED releases are available at the normal locations.
Workarounds
To work around this problem, it is recommended to use an allow list for valid parameters passed from the user. For example,
private def check(param)
case param
when "valid"
param
else
"/"
end
end
def index
redirect_to(check(params[:some_param]))
end
Or force the user input to be cast to a string like this,
def index
redirect_to(params[:some_param].to_s)
end
Patches
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
- 5-2-information-disclosure.patch - Patch for 5.2 series
- 6-0-information-disclosure.patch - Patch for 6.0 series
- 6-1-information-disclosure.patch - Patch for 6.1 series
Please note that only the 5.2, 6.0, and 6.1 series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
Credits
Thanks to Benoit Côté-Jodoin from Shopify for reporting this.
Ability to forge per-form CSRF tokens in Rails
It is possible to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token for any action for that session.
Impact
Given the ability to extract the global CSRF token, an attacker would be able to construct a per-form CSRF token for that session.
Workarounds
This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.
Cross-site Scripting Vulnerability in Action Pack
- https://nvd.nist.gov/vuln/detail/CVE-2022-22577
- https://github.com/rails/rails/pull/44635
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2022-22577.yml
- https://groups.google.com/g/ruby-security-ann/c/NuFRKaN5swI
- https://rubyonrails.org/2022/4/26/Rails-7-0-2-4-6-1-5-1-6-0-4-8-and-5-2-7-1-have-been-released
- https://github.com/advisories/GHSA-mm33-5vfq-3mm3
- https://discuss.rubyonrails.org/t/cve-2022-22577-possible-xss-vulnerability-in-action-pack/80533
- https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html
- https://security.netapp.com/advisory/ntap-20221118-0002/
- https://github.com/rails/rails/commit/2b820a2a69fa50cffa74b4aedc57bf92ed6910ec
- https://github.com/rails/rails/commit/5299b57d596ea274f77f5ffee2b79c6ee0255508
- https://github.com/rails/rails/commit/8198d7c4accad0b6ba956b9d59528534a289866b
- https://github.com/rails/rails/commit/d2253115ac2b30f5f7210670af906cebf79cf809
- https://www.debian.org/security/2023/dsa-5372
There is a possible XSS vulnerability in Rails / Action Pack. This vulnerability has been assigned the CVE identifier CVE-2022-22577.
Versions Affected: >= 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1
Impact
CSP headers were only sent along with responses that Rails considered as
HTML
responses. This left API requests without CSP headers, which could
possibly expose users to XSS attacks.
Releases
The FIXED releases are available at the normal locations.
Workarounds
Set a CSP for your API responses manually.
ReDoS based DoS vulnerability in Action Dispatch
- https://github.com/rails/rails/releases/tag/v7.0.4.1
- https://github.com/advisories/GHSA-p84v-45xj-wwqj
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2023-22792.yml
- https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released
- https://nvd.nist.gov/vuln/detail/CVE-2023-22792
- https://discuss.rubyonrails.org/t/cve-2023-22792-possible-redos-based-dos-vulnerability-in-action-dispatch/82115
- https://security.netapp.com/advisory/ntap-20240202-0007/
- https://www.debian.org/security/2023/dsa-5372
There is a possible regular expression based DoS vulnerability in Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2023-22792.
Versions Affected: >= 3.0.0 Not affected: < 3.0.0 Fixed Versions: 5.2.8.15 (Rails LTS), 6.1.7.1, 7.0.4.1 Impact
Specially crafted cookies, in combination with a specially crafted XFORWARDEDHOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately. Releases
The FIXED releases are available at the normal locations. Workarounds
We recommend that all users upgrade to one of the FIXED versions. In the meantime, users can mitigate this vulnerability by using a load balancer or other device to filter out malicious XFORWARDEDHOST headers before they reach the application. Patches
To aid users who aren’t able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
6-1-Use-string-split-instead-of-regex-for-domain-parts.patch - Patch for 6.1 series
7-0-Use-string-split-instead-of-regex-for-domain-parts.patch - Patch for 7.0 series
Please note that only the 7.0.Z and 6.1.Z series are supported at present, and 6.0.Z for severe vulnerabilities. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
https://rubyonrails.org/2023/1/17/Rails-Versions-6-0-6-1-6-1-7-1-7-0-4-1-have-been-released
actionpack Open Redirect in Host Authorization Middleware
- https://nvd.nist.gov/vuln/detail/CVE-2021-44528
- https://groups.google.com/g/ruby-security-ann/c/vG9gz3nk1pM/m/7-NU4MNrDAAJ?utm_medium=email&utm_source=footer
- https://github.com/rails/rails/commit/aecba3c301b80e9d5a63c30ea1b287bceaf2c107
- https://github.com/rails/rails/blob/v6.1.4.2/actionpack/CHANGELOG.md#rails-6142-december-14-2021
- https://github.com/advisories/GHSA-qphc-hf5q-v8fc
- https://github.com/rails/rails/commit/0fccfb9a3097a9c4260c791f1a40b128517e7815
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2021-44528.yml
- https://groups.google.com/g/ruby-security-ann/c/vG9gz3nk1pM/m/7-NU4MNrDAAJ
- https://www.debian.org/security/2023/dsa-5372
- https://security.netapp.com/advisory/ntap-20240208-0003/
Specially crafted X-Forwarded-Host
headers in combination with certain allowed host
formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
Impacted applications will have allowed hosts with a leading dot. For example, configuration files that look like this:
config.hosts << '.EXAMPLE.com'
When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
This vulnerability is similar to CVE-2021-22881 and CVE-2021-22942.
Releases
The fixed releases are available at the normal locations.
Patches
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
- 6-0-host-authorzation-open-redirect.patch - Patch for 6.0 series
- 6-1-host-authorzation-open-redirect.patch - Patch for 6.1 series
- 7-0-host-authorzation-open-redirect.patch - Patch for 7.0 series
Please note that only the 6.1.Z, 6.0.Z, and 5.2.Z series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
Exposure of information in Action Pack
- https://github.com/rails/rails/security/advisories/GHSA-wh98-p28r-vrc9
- https://github.com/rails/rails/commit/f9a2ad03943d5c2ba54e1d45f155442b519c75da
- https://discuss.rubyonrails.org/t/cve-2022-23633-possible-exposure-of-information-vulnerability-in-action-pack/80016
- https://rubyonrails.org/2022/2/11/Rails-7-0-2-2-6-1-4-6-6-0-4-6-and-5-2-6-2-have-been-released
- https://github.com/advisories/GHSA-wh98-p28r-vrc9
- https://nvd.nist.gov/vuln/detail/CVE-2022-23633
- http://www.openwall.com/lists/oss-security/2022/02/11/5
- https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html
- https://www.debian.org/security/2023/dsa-5372
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2022-23633.yml
- https://groups.google.com/g/ruby-security-ann/c/FkTM-_7zSNA/m/K2RiMJBlBAAJ
- https://security.netapp.com/advisory/ntap-20240119-0013/
Impact
Under certain circumstances response bodies will not be closed, for example a bug in a webserver or a bug in a Rack middleware. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests, especially when interacting with ActiveSupport::CurrentAttributes.
Upgrading to the FIXED versions of Rails will ensure mitigation of this issue even in the context of a buggy webserver or middleware implementation.
Patches
This has been fixed in Rails 7.0.2.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.
Workarounds
Upgrading is highly recommended, but to work around this problem the following middleware can be used:
class GuardedExecutor < ActionDispatch::Executor
def call(env)
ensure_completed!
super
end
private
def ensure_completed!
@executor.new.complete! if @executor.active?
end
end
# Ensure the guard is inserted before ActionDispatch::Executor
Rails.application.configure do
config.middleware.swap ActionDispatch::Executor, GuardedExecutor, executor
end
Possible Strong Parameters Bypass in ActionPack
There is a strong parameters bypass vector in ActionPack.
Versions Affected: rails <= 6.0.3 Not affected: rails < 4.0.0 Fixed Versions: rails >= 5.2.4.3, rails >= 6.0.3.1
Impact
In some cases user supplied information can be inadvertently leaked from
Strong Parameters. Specifically the return value of each, or each_value,
or each_pair will return the underlying untrusted
hash of data that was
read from the parameters. Applications that use this return value may be
inadvertently use untrusted user input.
Impacted code will look something like this:
def update
# Attacker has included the parameter: `{ is_admin: true }`
User.update(clean_up_params)
end
def clean_up_params
params.each { |k, v| SomeModel.check(v) if k == :name }
end
Note the mistaken use of each in the clean_up_params method in the above
example.
Workarounds
Do not use the return values of each, each_value, or each_pair in your
application.
Ability to forge per-form CSRF tokens given a global CSRF token
It is possible to possible to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token for any action for that session.
Versions Affected: rails < 5.2.5, rails < 6.0.4 Not affected: Applications without existing HTML injection vulnerabilities. Fixed Versions: rails >= 5.2.4.3, rails >= 6.0.3.1
Impact
Given the ability to extract the global CSRF token, an attacker would be able to construct a per-form CSRF token for that session.
Workarounds
This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.
Untrusted users able to run pending migrations in production
There is a vulnerability in versions of Rails prior to 6.0.3.2 that allowed an untrusted user to run any pending migrations on a Rails app running in production.
This vulnerability has been assigned the CVE identifier CVE-2020-8185.
Versions Affected: 6.0.0 < rails < 6.0.3.2
Not affected: Applications with config.action_dispatch.show_exceptions = false (this is not a default setting in production)
Fixed Versions: rails >= 6.0.3.2
Impact
Using this issue, an attacker would be able to execute any migrations that are pending for a Rails app running in production mode. It is important to note that an attacker is limited to running migrations the application developer has already defined in their application and ones that have not already ran.
Workarounds
Until such time as the patch can be applied, application developers should disable the ActionDispatch middleware in their production environment via a line such as this one in their config/environment/production.rb:
config.middleware.delete ActionDispatch::ActionableExceptions
Possible XSS Vulnerability in Action Pack in Development Mode
There is a possible XSS vulnerability in Action Pack while the application server is in development mode. This vulnerability is in the Actionable Exceptions middleware. This vulnerability has been assigned the CVE identifier CVE-2020-8264.
Versions Affected: >= 6.0.0 Not affected: < 6.0.0 Fixed Versions: 6.0.3.4
Impact
When an application is running in development mode, and attacker can send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application.
Workarounds
Until such time as the patch can be applied, application developers should disable the Actionable Exceptions middleware in their development environment via a line such as this one in their config/environment/development.rb:
config.middleware.delete ActionDispatch::ActionableExceptions
Possible Open Redirect in Host Authorization Middleware
There is a possible open redirect vulnerability in the Host Authorization middleware in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2021-22881.
Versions Affected: >= 6.0.0 Not affected: < 6.0.0 Fixed Versions: 6.1.2.1, 6.0.3.5
Impact
Specially crafted Host
headers in combination with certain allowed host
formats can cause the Host Authorization middleware in Action Pack to redirect
users to a malicious website.
Impacted applications will have allowed hosts with a leading dot. For example, configuration files that look like this:
config.hosts << '.tkte.ch'
When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
Workarounds
In the case a patch can't be applied, the following monkey patch can be used in an initializer:
module ActionDispatch
class HostAuthorization
private
def authorized?(request)
valid_host = /
\A
(?<host>[a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9\.:]+\])
(:\d+)?
\z
/x
origin_host = valid_host.match(
request.get_header("HTTP_HOST").to_s.downcase)
forwarded_host = valid_host.match(
request.x_forwarded_host.to_s.split(/,\s?/).last)
origin_host && @permissions.allows?(origin_host[:host]) && (
forwarded_host.nil? || @permissions.allows?(forwarded_host[:host]))
end
end
end
Possible Information Disclosure / Unintended Method Execution in Action Pack
There is a possible information disclosure / unintended method execution vulnerability in Action Pack which has been assigned the CVE identifier CVE-2021-22885.
Versions Affected: >= 2.0.0. Not affected: < 2.0.0. Fixed Versions: 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6
Impact
There is a possible information disclosure / unintended method execution
vulnerability in Action Pack when using the redirect_to or polymorphic_url
helper with untrusted user input.
Vulnerable code will look like this:
redirect_to(params[:some_param])
All users running an affected release should either upgrade or use one of the workarounds immediately.
Workarounds
To work around this problem, it is recommended to use an allow list for valid parameters passed from the user. For example:
private def check(param)
case param
when "valid"
param
else
"/"
end
end
def index
redirect_to(check(params[:some_param]))
end
Or force the user input to be cast to a string like this:
def index
redirect_to(params[:some_param].to_s)
end
Possible Denial of Service vulnerability in Action Dispatch
There is a possible Denial of Service vulnerability in the Mime type parser of Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2021-22902.
Versions Affected: >= 6.0.0 Not affected: < 6.0.0 Fixed Versions: 6.0.3.7, 6.1.3.2
Impact
There is a possible Denial of Service vulnerability in Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine.
Workarounds
The following monkey patch placed in an initializer can be used to work around the issue:
module Mime
class Type
MIME_REGEXP = /\A(?:\*\/\*|#{MIME_NAME}\/(?:\*|#{MIME_NAME})(?>\s*#{MIME_PARAMETER}\s*)*)\z/
end
end
Possible DoS Vulnerability in Action Controller Token Authentication
There is a possible DoS vulnerability in the Token Authentication logic in Action Controller. This vulnerability has been assigned the CVE identifier CVE-2021-22904.
Versions Affected: >= 4.0.0 Not affected: < 4.0.0 Fixed Versions: 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6
Impact
Impacted code uses authenticate_or_request_with_http_token or
authenticate_with_http_token for request authentication. Impacted code will
look something like this:
class PostsController < ApplicationController
before_action :authenticate
private
def authenticate
authenticate_or_request_with_http_token do |token, options|
# ...
end
end
end
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The fixed releases are available at the normal locations.
Workarounds
The following monkey patch placed in an initializer can be used to work around the issue:
module ActionController::HttpAuthentication::Token
AUTHN_PAIR_DELIMITERS = /(?:,|;|\t)/
end
Possible Open Redirect in Host Authorization Middleware
There is a possible open redirect vulnerability in the Host Authorization middleware in Action Pack. This vulnerability has been assigned the CVE identifier CVE-2021-22942.
Versions Affected: >= 6.0.0. Not affected: < 6.0.0 Fixed Versions: 6.1.4.1, 6.0.4.1
Impact
Specially crafted “X-Forwarded-Host” headers in combination with certain “allowed host” formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.
Impacted applications will have allowed hosts with a leading dot. For example, configuration files that look like this:
config.hosts << '.EXAMPLE.com'
When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
This vulnerability is similar to CVE-2021-22881, but CVE-2021-22881 did not take in to account domain name case sensitivity.
Releases
The fixed releases are available at the normal locations.
Workarounds
In the case a patch can’t be applied, the following monkey patch can be used in an initializer:
module ActionDispatch
class HostAuthorization
HOSTNAME = /[a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9.:]+\]/i
VALID_ORIGIN_HOST = /\A(#{HOSTNAME})(?::\d+)?\z/
VALID_FORWARDED_HOST = /(?:\A|,[ ]?)(#{HOSTNAME})(?::\d+)?\z/
private
def authorized?(request)
origin_host =
request.get_header("HTTP_HOST")&.slice(VALID_ORIGIN_HOST, 1) || ""
forwarded_host =
request.x_forwarded_host&.slice(VALID_FORWARDED_HOST, 1) || ""
@permissions.allows?(origin_host) &&
(forwarded_host.blank? || @permissions.allows?(forwarded_host))
end
end
end
Possible Open Redirect in Host Authorization Middleware
There is a possible open redirect vulnerability in the Host Authorization middleware in Action Pack.
Specially crafted X-Forwarded-Host
headers in combination with certain
allowed host
formats can cause the Host Authorization middleware in Action
Pack to redirect users to a malicious website.
Impacted applications will have allowed hosts with a leading dot. For example, configuration files that look like this:
config.hosts << '.EXAMPLE.com'
When an allowed host contains a leading dot, a specially crafted Host header can be used to redirect to a malicious website.
This vulnerability is similar to CVE-2021-22881 and CVE-2021-22942.
Releases
The fixed releases are available at the normal locations.
Patches
To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset.
- 6-0-host-authorzation-open-redirect.patch - Patch for 6.0 series
- 6-1-host-authorzation-open-redirect.patch - Patch for 6.1 series
- 7-0-host-authorzation-open-redirect.patch - Patch for 7.0 series
Please note that only the 6.1.Z, 6.0.Z, and 5.2.Z series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases.
Possible XSS Vulnerability in Action Pack
There is a possible XSS vulnerability in Rails / Action Pack. This vulnerability has been assigned the CVE identifier CVE-2022-22577.
Versions Affected: >= 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.0.2.4, 6.1.5.1, 6.0.4.8, 5.2.7.1
Impact
CSP headers were only sent along with responses that Rails considered as
HTML
responses. This left API requests without CSP headers, which could
possibly expose users to XSS attacks.
Releases
The FIXED releases are available at the normal locations.
Workarounds
Set a CSP for your API responses manually.
Possible exposure of information vulnerability in Action Pack
Impact
Under certain circumstances response bodies will not be closed, for example a
bug in a webserver (https://github.com/puma/puma/pull/2812) or a bug in a Rack
middleware. In the event a response is not notified of a close,
ActionDispatch::Executor will not know to reset thread local state for the
next request. This can lead to data being leaked to subsequent requests,
especially when interacting with ActiveSupport::CurrentAttributes.
Upgrading to the FIXED versions of Rails will ensure mitigation if this issue even in the context of a buggy webserver or middleware implementation.
Patches
This has been fixed in Rails 7.0.2.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2.
Workarounds
Upgrading is highly recommended, but to work around this problem the following middleware can be used:
class GuardedExecutor < ActionDispatch::Executor
def call(env)
ensure_completed!
super
end
private
def ensure_completed!
@executor.new.complete! if @executor.active?
end
end
# Ensure the guard is inserted before ActionDispatch::Executor
Rails.application.configure do
config.middleware.swap ActionDispatch::Executor, GuardedExecutor, executor
end
ReDoS based DoS vulnerability in Action Dispatch
There is a possible regular expression based DoS vulnerability in Action Dispatch. This vulnerability has been assigned the CVE identifier CVE-2023-22792.
Versions Affected: >= 3.0.0 Not affected: < 3.0.0 Fixed Versions: 5.2.8.15 (Rails LTS), 6.1.7.1, 7.0.4.1
Impact
Specially crafted cookies, in combination with a specially crafted XFORWARDEDHOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
Workarounds
We recommend that all users upgrade to one of the FIXED versions. In the meantime, users can mitigate this vulnerability by using a load balancer or other device to filter out malicious XFORWARDEDHOST headers before they reach the application.
ReDoS based DoS vulnerability in Action Dispatch
There is a possible regular expression based DoS vulnerability in Action Dispatch related to the If-None-Match header. This vulnerability has been assigned the CVE identifier CVE-2023-22795.
Versions Affected: All Not affected: None Fixed Versions: 5.2.8.15 (Rails LTS), 6.1.7.1, 7.0.4.1
Impact
A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.
Workarounds
We recommend that all users upgrade to one of the FIXED versions. In the meantime, users can mitigate this vulnerability by using a load balancer or other device to filter out malicious If-None-Match headers before they reach the application.
Users on Ruby 3.2.0 or greater are not affected by this vulnerability.
Possible XSS via User Supplied Values to redirect_to
The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header. This vulnerability has been assigned the CVE identifier CVE-2023-28362.
Versions Affected: All. Not affected: None Fixed Versions: 7.0.5.1, 6.1.7.4
Impact
This introduces the potential for a Cross-site-scripting (XSS) payload to be delivered on the now static redirection page. Note that this both requires user interaction and for a Rails app to be configured to allow redirects to external hosts (defaults to false in Rails >= 7.0.x).
Releases
The FIXED releases are available at the normal locations.
Workarounds
Avoid providing user supplied URLs with arbitrary schemes to the redirect_to method.
464 Other Versions
| Version | License | Security | Released | |
|---|---|---|---|---|
| 7.1.3.2 | MIT | 2024-02-21 - 21:46 | 2 months | |
| 7.1.3.1 | MIT | 2024-02-21 - 18:46 | 2 months | |
| 7.1.3 | MIT | 4 | 2024-01-16 - 22:54 | 3 months |
| 7.1.2 | MIT | 4 | 2023-11-10 - 21:50 | 6 months |
| 7.1.1 | MIT | 4 | 2023-10-11 - 22:17 | 7 months |
| 7.1.0 | MIT | 4 | 2023-10-05 - 08:07 | 7 months |
| 7.1.0.rc2 | MIT | 1 | 2023-10-01 - 22:00 | 7 months |
| 7.1.0.rc1 | MIT | 1 | 2023-09-27 - 04:01 | 7 months |
| 7.1.0.beta1 | MIT | 1 | 2023-09-13 - 00:40 | 8 months |
| 7.0.8.1 | MIT | 2024-02-21 - 18:42 | 2 months | |
| 7.0.8 | MIT | 2 | 2023-09-09 - 19:12 | 8 months |
| 7.0.7.2 | MIT | 2 | 2023-08-22 - 20:10 | 8 months |
| 7.0.7.1 | MIT | 2 | 2023-08-22 - 17:20 | 8 months |
| 7.0.7 | MIT | 2 | 2023-08-09 - 23:57 | 9 months |
| 7.0.6 | MIT | 2 | 2023-06-29 - 20:56 | 10 months |
| 7.0.5.1 | MIT | 2 | 2023-06-26 - 21:42 | 10 months |
| 7.0.5 | MIT | 4 | 2023-05-24 - 19:11 | 11 months |
| 7.0.4.3 | MIT | 4 | 2023-03-13 - 18:53 | about 1 year |
| 7.0.4.2 | MIT | 4 | 2023-01-25 - 03:14 | over 1 year |
| 7.0.4.1 | MIT | 4 | 2023-01-17 - 18:55 | over 1 year |
| 7.0.4 | MIT | 11 | 2022-09-09 - 18:42 | over 1 year |
| 7.0.3.1 | MIT | 11 | 2022-07-12 - 17:31 | almost 2 years |
| 7.0.3 | MIT | 11 | 2022-05-09 - 13:40 | almost 2 years |
| 7.0.2.4 | MIT | 11 | 2022-04-26 - 19:33 | about 2 years |
| 7.0.2.3 | MIT | 13 | 2022-03-08 - 17:50 | about 2 years |
| 7.0.2.2 | MIT | 13 | 2022-02-11 - 19:43 | about 2 years |
| 7.0.2.1 | MIT | 15 | 2022-02-11 - 18:18 | about 2 years |
| 7.0.2 | MIT | 15 | 2022-02-08 - 23:12 | about 2 years |
| 7.0.1 | MIT | 15 | 2022-01-06 - 21:54 | over 2 years |
| 7.0.0 | MIT | 15 | 2021-12-15 - 23:43 | over 2 years |
| 7.0.0.rc3 | MIT | 6 | 2021-12-14 - 23:04 | over 2 years |
| 7.0.0.rc2 | MIT | 6 | 2021-12-14 - 19:39 | over 2 years |
| 7.0.0.rc1 | MIT | 7 | 2021-12-06 - 21:31 | over 2 years |
| 7.0.0.alpha2 | MIT | 7 | 2021-09-15 - 23:15 | over 2 years |
| 7.0.0.alpha1 | MIT | 7 | 2021-09-15 - 21:56 | over 2 years |
| 6.1.7.7 | MIT | 1 | 2024-02-21 - 18:39 | 2 months |
| 6.1.7.6 | MIT | 1 | 2023-08-22 - 20:07 | 8 months |
| 6.1.7.5 | MIT | 1 | 2023-08-22 - 17:15 | 8 months |
| 6.1.7.4 | MIT | 1 | 2023-06-26 - 21:31 | 10 months |
| 6.1.7.3 | MIT | 2 | 2023-03-13 - 18:48 | about 1 year |
| 6.1.7.2 | MIT | 2 | 2023-01-25 - 03:23 | over 1 year |
| 6.1.7.1 | MIT | 2 | 2023-01-17 - 18:54 | over 1 year |
| 6.1.7 | MIT | 7 | 2022-09-09 - 18:38 | over 1 year |
| 6.1.6.1 | MIT | 7 | 2022-07-12 - 17:29 | almost 2 years |
| 6.1.6 | MIT | 7 | 2022-05-09 - 13:45 | almost 2 years |
| 6.1.5.1 | MIT | 7 | 2022-04-26 - 19:30 | about 2 years |
| 6.1.5 | MIT | 9 | 2022-03-10 - 21:16 | about 2 years |
| 6.1.4.7 | MIT | 9 | 2022-03-08 - 17:48 | about 2 years |
| 6.1.4.6 | MIT | 9 | 2022-02-11 - 19:41 | about 2 years |
| 6.1.4.5 | MIT | 11 | 2022-02-11 - 18:22 | about 2 years |
| 6.1.4.4 | MIT | 11 | 2021-12-15 - 22:53 | over 2 years |
| 6.1.4.3 | MIT | 11 | 2021-12-14 - 23:02 | over 2 years |
| 6.1.4.2 | MIT | 11 | 2021-12-14 - 19:49 | over 2 years |
| 6.1.4.1 | MIT | 13 | 2021-08-19 - 16:25 | over 2 years |
| 6.1.4 | MIT | 15 | 2021-06-24 - 20:40 | almost 3 years |
| 6.1.3.2 | MIT | 15 | 2021-05-05 - 15:34 | almost 3 years |
| 6.1.3.1 | MIT | 23 | 2021-03-26 - 18:06 | about 3 years |
| 6.1.3 | MIT | 23 | 2021-02-17 - 18:41 | about 3 years |
| 6.1.2.1 | MIT | 23 | 2021-02-10 - 20:44 | about 3 years |
| 6.1.2 | MIT | 25 | 2021-02-09 - 21:28 | about 3 years |
| 6.1.1 | MIT | 25 | 2021-01-07 - 22:59 | over 3 years |
| 6.1.0 | MIT | 25 | 2020-12-09 - 19:57 | over 3 years |
| 6.1.0.rc2 | MIT | 17 | 2020-12-01 - 22:01 | over 3 years |
| 6.1.0.rc1 | MIT | 15 | 2020-11-02 - 21:20 | over 3 years |
| 6.0.6.1 | MIT | 7 | 2023-01-17 - 18:53 | over 1 year |
| 6.0.6 | MIT | 7 | 2022-09-09 - 18:32 | over 1 year |
| 6.0.5.1 | MIT | 7 | 2022-07-12 - 17:28 | almost 2 years |
| 6.0.5 | MIT | 7 | 2022-05-09 - 13:50 | almost 2 years |
| 6.0.4.8 | MIT | 7 | 2022-04-26 - 19:27 | about 2 years |
| 6.0.4.7 | MIT | 9 | 2022-03-08 - 17:47 | about 2 years |
| 6.0.4.6 | MIT | 9 | 2022-02-11 - 19:39 | about 2 years |
| 6.0.4.5 | MIT | 11 | 2022-02-11 - 18:24 | about 2 years |
| 6.0.4.4 | MIT | 11 | 2021-12-15 - 22:46 | over 2 years |
| 6.0.4.3 | MIT | 11 | 2021-12-14 - 23:00 | over 2 years |
| 6.0.4.2 | MIT | 11 | 2021-12-14 - 20:10 | over 2 years |
| 6.0.4.1 | MIT | 13 | 2021-08-19 - 16:22 | over 2 years |
| 6.0.4 | MIT | 15 | 2021-06-15 - 20:17 | almost 3 years |
| 6.0.3.7 | MIT | 15 | 2021-05-05 - 16:01 | almost 3 years |
| 6.0.3.6 | MIT | 21 | 2021-03-26 - 17:32 | about 3 years |
| 6.0.3.5 | MIT | 21 | 2021-02-10 - 20:39 | about 3 years |
| 6.0.3.4 | MIT | 23 | 2020-10-07 - 16:50 | over 3 years |
| 6.0.3.3 | MIT | 25 | 2020-09-09 - 18:24 | over 3 years |
| 6.0.3.2 | MIT | 25 | 2020-06-17 - 14:54 | almost 4 years |
| 6.0.3.1 | MIT | 27 | 2020-05-18 - 15:47 | almost 4 years |
| 6.0.3 | MIT | 31 | 2020-05-06 - 18:04 | almost 4 years |
| 6.0.3.rc1 | MIT | 31 | 2020-05-01 - 17:18 | almost 4 years |
| 6.0.2.2 | MIT | 31 | 2020-03-19 - 16:43 | about 4 years |
| 6.0.2.1 | MIT | 31 | 2019-12-18 - 19:08 | over 4 years |
| 6.0.2 | MIT | 31 | 2019-12-13 - 18:20 | over 4 years |
| 6.0.2.rc2 | MIT | 31 | 2019-12-09 - 16:12 | over 4 years |
| 6.0.2.rc1 | MIT | 31 | 2019-11-27 - 15:11 | over 4 years |
| 6.0.1 | MIT | 31 | 2019-11-05 - 14:39 | over 4 years |
| 6.0.1.rc1 | MIT | 31 | 2019-10-31 - 20:05 | over 4 years |
| 6.0.0 | MIT | 31 | 2019-08-16 - 18:00 | over 4 years |
| 6.0.0.rc2 | MIT | 12 | 2019-07-22 - 21:10 | almost 5 years |
| 6.0.0.rc1 | MIT | 12 | 2019-04-24 - 18:51 | about 5 years |
| 6.0.0.beta3 | MIT | 12 | 2019-03-13 - 17:02 | about 5 years |
| 6.0.0.beta2 | MIT | 12 | 2019-02-25 - 22:45 | about 5 years |
| 6.0.0.beta1 | MIT | 12 | 2019-01-18 - 20:46 | over 5 years |
| 5.2.8.1 | MIT | 7 | 2022-07-12 - 17:26 | almost 2 years |