GHSA-p692-7mm3-3fxg
Suggest an improvement- Source
- https://github.com/advisories/GHSA-p692-7mm3-3fxg
- Import Source
- https://github.com/github/advisory-database/blob/main/advisories/github-reviewed/2017/10/GHSA-p692-7mm3-3fxg/GHSA-p692-7mm3-3fxg.json
- JSON Data
- https://api.osv.dev/v1/vulns/GHSA-p692-7mm3-3fxg
- Aliases
- Published
- 2017-10-24T18:33:36Z
- Modified
- 2023-11-10T05:39:48.113982Z
- Severity
-
- 3.7 (Low) CVSS_V3 - CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:N/A:N CVSS Calculator
- Summary
- actionpack is vulnerable to remote bypass authentication
- Details
-
The httpbasicauthenticatewith method in actionpack/lib/actioncontroller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.
- References
-
- https://nvd.nist.gov/vuln/detail/CVE-2015-7576
- https://github.com/rails/rails/commit/17e6f1507b7f2c2a883c180f4f9548445d6dfbd
- https://github.com/rails/rails
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2015-7576.yml
- https://groups.google.com/forum/#!topic/rubyonrails-security/ANv0HDHEC3k
- https://groups.google.com/forum/message/raw?msg=ruby-security-ann/ANv0HDHEC3k/T8Hgq-hYEgAJ
- https://web.archive.org/web/20160405205300/http://www.securitytracker.com/id/1034816
- https://web.archive.org/web/20200228001849/http://www.securityfocus.com/bid/81803
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178043.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178047.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178067.html
- http://lists.fedoraproject.org/pipermail/package-announce/2016-February/178068.html
- http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00034.html
- http://lists.opensuse.org/opensuse-updates/2016-02/msg00043.html
- http://rhn.redhat.com/errata/RHSA-2016-0296.html
- http://www.debian.org/security/2016/dsa-3464
- http://www.openwall.com/lists/oss-security/2016/01/25/8
Affected packages
RubyGems / actionpack
Package
- Name
- actionpack
- Purl
- pkg:gem/actionpack
Affected versions
3.*
3.1.0
3.1.1.rc1
3.1.1.rc2
3.1.1.rc3
3.1.1
3.1.2.rc1
3.1.2.rc2
3.1.2
3.1.3
3.1.4.rc1
3.1.4
3.1.5.rc1
3.1.5
3.1.6
3.1.7
3.1.8
3.1.9
3.1.10
3.1.11
3.1.12
3.2.0.rc1
3.2.0.rc2
3.2.0
3.2.1
3.2.2.rc1
3.2.2
3.2.3.rc1
3.2.3.rc2
3.2.3
3.2.4.rc1
3.2.4
3.2.5
3.2.6
3.2.7.rc1
3.2.7
3.2.8.rc1
3.2.8.rc2
3.2.8
3.2.9.rc1
3.2.9.rc2
3.2.9.rc3
3.2.9
3.2.10
3.2.11
3.2.12
3.2.13.rc1
3.2.13.rc2
3.2.13
3.2.14.rc1
3.2.14.rc2
3.2.14
3.2.15.rc1
3.2.15.rc2
3.2.15.rc3
3.2.15
3.2.16
3.2.17
3.2.18
3.2.19
3.2.20
3.2.21
3.2.22
RubyGems / actionpack
Package
- Name
- actionpack
- Purl
- pkg:gem/actionpack
Affected versions
4.*
4.0.0
4.0.1.rc1
4.0.1.rc2
4.0.1.rc3
4.0.1.rc4
4.0.1
4.0.2
4.0.3
4.0.4.rc1
4.0.4
4.0.5
4.0.6.rc1
4.0.6.rc2
4.0.6.rc3
4.0.6
4.0.7
4.0.8
4.0.9
4.0.10.rc1
4.0.10.rc2
4.0.10
4.0.11
4.0.11.1
4.0.12
4.0.13.rc1
4.0.13
4.1.0.beta1
4.1.0.beta2
4.1.0.rc1
4.1.0.rc2
4.1.0
4.1.1
4.1.2.rc1
4.1.2.rc2
4.1.2.rc3
4.1.2
4.1.3
4.1.4
4.1.5
4.1.6.rc1
4.1.6.rc2
4.1.6
4.1.7
4.1.7.1
4.1.8
4.1.9.rc1
4.1.9
4.1.10.rc1
4.1.10.rc2
4.1.10.rc3
4.1.10.rc4
4.1.10
4.1.11
4.1.12.rc1
4.1.12
4.1.13.rc1
4.1.13
4.1.14.rc1
4.1.14.rc2
4.1.14