Ruby/activesupport/7.0.5.1

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.

Repo Link: https://rubygems.org/gems/activesupport
License: MIT

2 Security Vulnerabilities

Active Support Possibly Discloses Locally Encrypted Files

Published date: 2023-08-23T20:36:24Z

CVE: CVE-2023-38037

Links:

There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037.

Versions Affected: >= 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5

Impact

ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file’s permissions are defaulted to the user’s current umask settings, meaning that it’s possible for other users on the same system to read the contents of the temporary file.

Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The fixed releases are available at the normal locations.

Workarounds

To work around this issue, you can set your umask to be more restrictive like this:

$ umask 0077

Affected versions: ["7.0.0", "7.0.1", "7.0.2", "7.0.2.2", "7.0.2.1", "7.0.2.3", "7.0.2.4", "7.0.3", "7.0.3.1", "7.0.4", "7.0.4.1", "7.0.4.2", "7.0.4.3", "7.0.5", "7.0.5.1", "7.0.6", "7.0.7", "6.1.0.rc1", "6.0.3.4", "6.0.3.3", "6.0.3.2", "6.0.3.1", "6.0.3", "6.0.3.rc1", "6.0.2.2", "6.0.2.1", "6.0.2", "6.0.2.rc2", "6.0.2.rc1", "6.0.1", "6.0.1.rc1", "6.0.0", "6.0.0.rc2", "6.0.0.rc1", "6.0.0.beta3", "6.0.0.beta2", "6.0.0.beta1", "5.2.4.4", "5.2.4.3", "5.2.4.2", "5.2.4.1", "5.2.4", "5.2.4.rc1", "5.2.3", "5.2.3.rc1", "5.2.2.1", "5.2.2", "5.2.2.rc1", "5.2.1.1", "5.2.1", "5.2.1.rc1", "5.2.0", "6.1.0.rc2", "6.1.0", "6.1.1", "6.1.2", "6.1.2.1", "6.0.3.5", "5.2.4.5", "6.1.3", "6.1.3.1", "6.0.3.6", "5.2.5", "6.1.3.2", "6.0.3.7", "5.2.6", "5.2.4.6", "6.0.4", "6.1.4", "6.1.4.1", "6.0.4.1", "6.1.4.3", "6.1.4.2", "6.0.4.3", "6.0.4.2", "6.1.4.4", "6.0.4.4", "6.1.4.6", "6.1.4.5", "6.0.4.6", "6.0.4.5", "5.2.6.2", "5.2.6.1", "6.1.4.7", "6.0.4.7", "5.2.6.3", "6.1.5", "5.2.7", "6.1.5.1", "6.0.4.8", "5.2.7.1", "6.1.6", "6.0.5", "5.2.8", "6.1.6.1", "6.0.5.1", "5.2.8.1", "6.1.7", "6.0.6", "6.1.7.1", "6.0.6.1", "6.1.7.2", "6.1.7.3", "6.1.7.4"]

Secure versions: [7.0.7.2, 7.0.7.1, 6.1.7.6, 6.1.7.5, 7.0.8, 7.1.0.beta1, 7.1.0.rc1, 7.1.0.rc2, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.3.2, 7.1.3.1, 7.0.8.1, 6.1.7.7]

Recommendation: Update to version 7.1.3.2.

Possible File Disclosure of Locally Encrypted Files

Published date: 2023-08-23

Framework: rails

CVE: 2023-38037

Links:

https://github.com/rails/rails/releases/tag/v7.0.7.1

There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037.

Versions Affected: >= 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5

Impact

Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Releases

The fixed releases are available at the normal locations.

Workarounds

To work around this issue, you can set your umask to be more restrictive like this:

$ umask 0077

Affected versions: ["6.1.0.rc1", "6.0.3.4", "6.0.3.3", "6.0.3.2", "6.0.3.1", "6.0.3", "6.0.3.rc1", "6.0.2.2", "6.0.2.1", "6.0.2", "6.0.2.rc2", "6.0.2.rc1", "6.0.1", "6.0.1.rc1", "6.0.0", "6.0.0.rc2", "6.0.0.rc1", "6.0.0.beta3", "6.0.0.beta2", "6.0.0.beta1", "5.2.4.4", "5.2.4.3", "5.2.4.2", "5.2.4.1", "5.2.4", "5.2.4.rc1", "5.2.3", "5.2.3.rc1", "5.2.2.1", "5.2.2", "5.2.2.rc1", "5.2.1.1", "5.2.1", "5.2.1.rc1", "5.2.0", "6.1.0.rc2", "6.1.0", "6.1.1", "6.1.2", "6.1.2.1", "6.0.3.5", "5.2.4.5", "6.1.3", "6.1.3.1", "6.0.3.6", "5.2.5", "6.1.3.2", "6.0.3.7", "5.2.6", "5.2.4.6", "6.0.4", "6.1.4", "6.1.4.1", "6.0.4.1", "7.0.0.alpha2", "7.0.0.alpha1", "7.0.0.rc1", "7.0.0.rc3", "7.0.0.rc2", "6.1.4.3", "6.1.4.2", "6.0.4.3", "6.0.4.2", "6.1.4.4", "6.0.4.4", "7.0.0", "7.0.1", "7.0.2", "7.0.2.2", "7.0.2.1", "6.1.4.6", "6.1.4.5", "6.0.4.6", "6.0.4.5", "5.2.6.2", "5.2.6.1", "7.0.2.3", "6.1.4.7", "6.0.4.7", "5.2.6.3", "6.1.5", "5.2.7", "7.0.2.4", "6.1.5.1", "6.0.4.8", "5.2.7.1", "7.0.3", "6.1.6", "6.0.5", "5.2.8", "7.0.3.1", "6.1.6.1", "6.0.5.1", "5.2.8.1", "7.0.4", "6.1.7", "6.0.6", "7.0.4.1", "6.1.7.1", "6.0.6.1", "7.0.4.2", "6.1.7.2", "7.0.4.3", "6.1.7.3", "7.0.5", "7.0.5.1", "6.1.7.4", "7.0.6", "7.0.7"]

Secure versions: [7.0.7.2, 7.0.7.1, 6.1.7.6, 6.1.7.5, 7.0.8, 7.1.0.beta1, 7.1.0.rc1, 7.1.0.rc2, 7.1.0, 7.1.1, 7.1.2, 7.1.3, 7.1.3.2, 7.1.3.1, 7.0.8.1, 6.1.7.7]

Recommendation: Update to version 7.1.3.2.

450 Other Versions

Version	License	Security	Released
3.2.14.rc2	MIT	8	2013-07-16 - 16:13	almost 11 years
3.2.14.rc1	MIT	8	2013-07-13 - 00:25	almost 11 years
3.2.13	UNKNOWN	8	2013-03-18 - 17:13	about 11 years
3.2.13.rc2	UNKNOWN	10	2013-03-06 - 23:06	about 11 years
3.2.13.rc1	UNKNOWN	10	2013-02-27 - 20:25	about 11 years
3.2.12	UNKNOWN	10	2013-02-11 - 18:17	about 11 years
3.2.11	UNKNOWN	10	2013-01-08 - 20:08	over 11 years
3.2.10	UNKNOWN	10	2013-01-02 - 21:19	over 11 years
3.2.9	UNKNOWN	10	2012-11-12 - 15:21	over 11 years
3.2.9.rc3	UNKNOWN	10	2012-11-09 - 18:00	over 11 years
3.2.9.rc2	UNKNOWN	10	2012-11-01 - 17:39	over 11 years
3.2.9.rc1	UNKNOWN	10	2012-10-29 - 17:07	over 11 years
3.2.8	UNKNOWN	10	2012-08-09 - 21:23	over 11 years
3.2.8.rc2	UNKNOWN	12	2012-08-03 - 14:28	almost 12 years
3.2.8.rc1	UNKNOWN	12	2012-08-01 - 20:57	almost 12 years
3.2.7	UNKNOWN	12	2012-07-26 - 22:08	almost 12 years
3.2.7.rc1	UNKNOWN	12	2012-07-23 - 21:45	almost 12 years
3.2.6	UNKNOWN	12	2012-06-12 - 21:26	almost 12 years
3.2.5	UNKNOWN	12	2012-06-01 - 03:39	almost 12 years
3.2.4	UNKNOWN	12	2012-05-31 - 18:24	almost 12 years
3.2.4.rc1	UNKNOWN	12	2012-05-28 - 19:01	almost 12 years
3.2.3	UNKNOWN	12	2012-03-30 - 22:26	about 12 years
3.2.3.rc2	UNKNOWN	12	2012-03-29 - 16:14	about 12 years
3.2.3.rc1	UNKNOWN	12	2012-03-27 - 17:11	about 12 years
3.2.2	UNKNOWN	12	2012-03-01 - 17:52	about 12 years
3.2.2.rc1	UNKNOWN	14	2012-02-22 - 21:39	about 12 years
3.2.1	UNKNOWN	14	2012-01-26 - 23:09	over 12 years
3.2.0	UNKNOWN	14	2012-01-20 - 16:46	over 12 years
3.2.0.rc2	UNKNOWN	10	2012-01-04 - 21:05	over 12 years
3.2.0.rc1	UNKNOWN	10	2011-12-20 - 00:40	over 12 years
3.1.12	UNKNOWN	8	2013-03-18 - 17:13	about 11 years
3.1.11	UNKNOWN	9	2013-02-11 - 18:17	about 11 years
3.1.10	UNKNOWN	9	2013-01-08 - 20:08	over 11 years
3.1.9	UNKNOWN	9	2013-01-02 - 21:19	over 11 years
3.1.8	UNKNOWN	9	2012-08-09 - 21:20	over 11 years
3.1.7	UNKNOWN	10	2012-07-26 - 22:08	almost 12 years
3.1.6	UNKNOWN	10	2012-06-12 - 21:25	almost 12 years
3.1.5	UNKNOWN	10	2012-05-31 - 18:24	almost 12 years
3.1.5.rc1	UNKNOWN	10	2012-05-28 - 19:01	almost 12 years
3.1.4	UNKNOWN	10	2012-03-01 - 17:52	about 12 years
3.1.4.rc1	UNKNOWN	11	2012-02-22 - 21:39	about 12 years
3.1.3	UNKNOWN	11	2011-11-20 - 22:50	over 12 years
3.1.2	UNKNOWN	11	2011-11-18 - 01:31	over 12 years
3.1.2.rc2	UNKNOWN	11	2011-11-14 - 15:47	over 12 years
3.1.2.rc1	UNKNOWN	11	2011-11-14 - 14:15	over 12 years
3.1.1	UNKNOWN	11	2011-10-07 - 15:29	over 12 years
3.1.1.rc3	UNKNOWN	11	2011-10-06 - 02:30	over 12 years
3.1.1.rc2	UNKNOWN	11	2011-09-29 - 22:16	over 12 years
3.1.1.rc1	UNKNOWN	11	2011-09-15 - 00:26	over 12 years
3.1.0	UNKNOWN	11	2011-08-31 - 02:18	over 12 years
3.1.0.rc8	UNKNOWN	9	2011-08-29 - 03:27	over 12 years
3.1.0.rc6	UNKNOWN	9	2011-08-16 - 22:33	over 12 years
3.1.0.rc5	UNKNOWN	9	2011-07-25 - 23:05	almost 13 years
3.1.0.rc4	UNKNOWN	9	2011-06-09 - 22:54	almost 13 years
3.1.0.rc3	UNKNOWN	9	2011-06-08 - 21:27	almost 13 years
3.1.0.rc2	UNKNOWN	9	2011-06-08 - 00:16	almost 13 years
3.1.0.rc1	UNKNOWN	9	2011-05-22 - 02:25	almost 13 years
3.1.0.beta1	UNKNOWN	9	2011-05-05 - 01:21	about 13 years
3.0.20	UNKNOWN	10	2013-01-28 - 21:01	over 11 years
3.0.19	UNKNOWN	12	2013-01-08 - 20:08	over 11 years
3.0.18	UNKNOWN	12	2013-01-02 - 21:19	over 11 years
3.0.17	UNKNOWN	12	2012-08-09 - 21:16	over 11 years
3.0.16	UNKNOWN	13	2012-07-26 - 22:08	almost 12 years
3.0.15	UNKNOWN	13	2012-06-13 - 03:06	almost 12 years
3.0.14	UNKNOWN	13	2012-06-12 - 21:25	almost 12 years
3.0.13	UNKNOWN	13	2012-05-31 - 18:24	almost 12 years
3.0.13.rc1	UNKNOWN	13	2012-05-28 - 19:01	almost 12 years
3.0.12	UNKNOWN	13	2012-03-01 - 17:51	about 12 years
3.0.12.rc1	UNKNOWN	14	2012-02-22 - 21:38	about 12 years
3.0.11	UNKNOWN	14	2011-11-18 - 01:21	over 12 years
3.0.10	UNKNOWN	14	2011-08-16 - 22:14	over 12 years
3.0.10.rc1	UNKNOWN	15	2011-08-05 - 00:11	almost 13 years
3.0.9	UNKNOWN	15	2011-06-16 - 10:03	almost 13 years
3.0.9.rc5	UNKNOWN	15	2011-06-12 - 21:28	almost 13 years
3.0.9.rc4	UNKNOWN	15	2011-06-12 - 21:22	almost 13 years
3.0.9.rc3	UNKNOWN	15	2011-06-09 - 22:49	almost 13 years
3.0.9.rc1	UNKNOWN	15	2011-06-08 - 21:20	almost 13 years
3.0.8	UNKNOWN	15	2011-06-08 - 00:16	almost 13 years
3.0.8.rc4	UNKNOWN	16	2011-05-31 - 00:08	almost 13 years
3.0.8.rc2	UNKNOWN	16	2011-05-27 - 16:32	almost 13 years
3.0.8.rc1	UNKNOWN	16	2011-05-26 - 00:11	almost 13 years
3.0.7	UNKNOWN	16	2011-04-18 - 21:05	about 13 years
3.0.7.rc2	UNKNOWN	17	2011-04-15 - 17:33	about 13 years
3.0.7.rc1	UNKNOWN	17	2011-04-14 - 21:56	about 13 years
3.0.6	UNKNOWN	17	2011-04-05 - 23:04	about 13 years
3.0.6.rc2	UNKNOWN	17	2011-03-31 - 05:28	about 13 years
3.0.6.rc1	UNKNOWN	17	2011-03-29 - 20:46	about 13 years
3.0.5	UNKNOWN	17	2011-02-27 - 02:30	about 13 years
3.0.5.rc1	UNKNOWN	17	2011-02-23 - 19:08	about 13 years
3.0.4	UNKNOWN	17	2011-02-08 - 21:13	about 13 years
3.0.4.rc1	UNKNOWN	17	2011-01-30 - 23:00	over 13 years
3.0.3	UNKNOWN	17	2010-11-16 - 16:27	over 13 years
3.0.2	UNKNOWN	17	2010-11-15 - 19:29	over 13 years
3.0.1	UNKNOWN	17	2010-10-14 - 20:55	over 13 years
3.0.0	UNKNOWN	17	2010-08-29 - 23:10	over 13 years
3.0.pre	UNKNOWN	11	2009-10-16 - 22:14	over 14 years
3.0.0.rc2	UNKNOWN	11	2010-08-24 - 03:04	over 13 years
3.0.0.rc	UNKNOWN	11	2010-07-26 - 21:42	almost 14 years
3.0.0.beta4	UNKNOWN	11	2010-06-08 - 22:30	almost 14 years
3.0.0.beta3	UNKNOWN	11	2010-04-13 - 19:22	about 14 years