|
|
| |
|
| |
rails: multiple vulnerabilities
| Package(s): | rails |
CVE #(s): | CVE-2007-6077
CVE-2008-7248
CVE-2009-2422
|
| Created: | December 21, 2009 |
Updated: | March 15, 2010 |
| Description: |
From the Gentoo advisory:
sameer reported that lib/action_controller/cgi_process.rb removes
the :cookie_only attribute from the default session options
(CVE-2007-6077), due to an incomplete fix for CVE-2007-5380 (GLSA
200711-17).
Steve from Coderrr reported that the CRSF protection in
protect_from_forgery() does not parse the text/plain MIME format
(CVE-2008-7248).
Nate reported a documentation error that leads to the assumption
that a block returning nil passed to
authenticate_or_request_with_http_digest() would deny access to the
requested resource (CVE-2009-2422).
|
| Alerts: |
|
( Log in to post comments)
|
|
|