CVE-2011-2932: XSS
First published: Wed Aug 17 2011(Updated: )
An XSS vulnerability in the escaping code used by Ruby on Rails was reported [1] where, using a specially crafted malformed unicode string, an attacker can bypass the escaping code. Due to a bug in the Ruby 1.8 regular expression code, the Ruby on Rails replacement for ERB::Util.h will fail to escape certain malformed unicode strings, which could then be interpreted as HTML by some browsers. This is corrected in upstream 3.0.10, 2.3.13, and 3.1.0rc5 versions and only affects platforms using Ruby 1.8.x (Ruby 1.9.x renders this ineffective). Patches are available in the advisory [1] and in git [2]. [1] <a href="http://groups.google.com/group/rubyonrails-security/browse_thread/thread/56bffb5923ab1195">http://groups.google.com/group/rubyonrails-security/browse_thread/thread/56bffb5923ab1195</a> [2] <a href="https://github.com/rails/rails/commit/bfc432574d0b141fd7fe759edfe9b6771dd306bd">https://github.com/rails/rails/commit/bfc432574d0b141fd7fe759edfe9b6771dd306bd</a>
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Rubyonrails Ruby On Rails | =3.0.4 | |
| Rubyonrails Rails | =2.0.1 | |
| Rubyonrails Rails | =2.0.2 | |
| Rubyonrails Rails | =2.0.4 | |
| Rubyonrails Rails | =2.1.0 | |
| Rubyonrails Rails | =2.1.1 | |
| Rubyonrails Rails | =2.1.2 | |
| Rubyonrails Rails | =2.2.0 | |
| Rubyonrails Rails | =2.2.1 | |
| Rubyonrails Rails | =2.2.2 | |
| Rubyonrails Rails | =2.3.2 | |
| Rubyonrails Rails | =2.3.3 | |
| Rubyonrails Rails | =2.3.4 | |
| Rubyonrails Rails | =2.3.9 | |
| Rubyonrails Rails | =2.3.10 | |
| Rubyonrails Rails | =2.3.11 | |
| Rubyonrails Rails | =2.3.12 | |
| Rubyonrails Rails | =2.0.0-rc1 | |
| Rubyonrails Rails | =2.0.0-rc2 | |
| Rubyonrails Rails | =2.0.0 | |
| Rubyonrails Rails | =3.0.0-beta | |
| Rubyonrails Rails | =3.0.0-beta2 | |
| Rubyonrails Rails | =3.0.0-beta3 | |
| Rubyonrails Rails | =3.0.0-beta4 | |
| Rubyonrails Rails | =3.0.0-rc | |
| Rubyonrails Rails | =3.0.0-rc2 | |
| Rubyonrails Rails | =3.0.1-pre | |
| Rubyonrails Rails | =3.0.2-pre | |
| Rubyonrails Rails | =3.0.0 | |
| Rubyonrails Rails | =3.0.10-rc1 | |
| Rubyonrails Rails | =3.1.0-beta1 | |
| Rubyonrails Rails | =3.1.0-rc1 | |
| Rubyonrails Rails | =3.1.0-rc2 | |
| Rubyonrails Rails | =3.1.0-rc3 | |
| Rubyonrails Rails | =3.1.0-rc4 | |
| Rubyonrails Rails | =3.1.0 | |
| Rubyonrails Rails | =3.0.1 | |
| Rubyonrails Rails | =3.0.2 | |
| Rubyonrails Rails | =3.0.3 | |
| Rubyonrails Rails | =3.0.4-rc1 | |
| Rubyonrails Rails | =3.0.5 | |
| Rubyonrails Rails | =3.0.5-rc1 | |
| Rubyonrails Rails | =3.0.6-rc1 | |
| Rubyonrails Rails | =3.0.6-rc2 | |
| Rubyonrails Rails | =3.0.6 | |
| Rubyonrails Rails | =3.0.7-rc1 | |
| Rubyonrails Rails | =3.0.7-rc2 | |
| Rubyonrails Rails | =3.0.7 | |
| Rubyonrails Rails | =3.0.8-rc1 | |
| Rubyonrails Rails | =3.0.8-rc2 | |
| Rubyonrails Rails | =3.0.8-rc3 | |
| Rubyonrails Rails | =3.0.8-rc4 | |
| Rubyonrails Rails | =3.0.8 | |
| Rubyonrails Rails | =3.0.9-rc1 | |
| Rubyonrails Rails | =3.0.9-rc2 | |
| Rubyonrails Rails | =3.0.9-rc3 | |
| Rubyonrails Rails | =3.0.9-rc4 | |
| Rubyonrails Rails | =3.0.9 | |
| Rubyonrails Rails | =3.0.9-rc5 | |
| redhat/rubygem-activesupport | <2.3.13 | 2.3.13 |
| redhat/rubygem-activesupport | <3.0.10 | 3.0.10 |
| redhat/rubygem-activesupport | <3.1.0 | 3.1.0 |
| rubygems/activesupport | >=3.0.0<3.0.10 | 3.0.10 |
| rubygems/activesupport | >=2.0.0<2.3.13 | 2.3.13 |
Remedy
http://groups.google.com/group/rubyonrails-security/msg/f1d2749773db9f21?dmode=source&output=gplain
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.openwall.com/lists/oss-security/2011/08/20/1
- http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
- http://www.openwall.com/lists/oss-security/2011/08/19/11
- https://github.com/rails/rails/commit/bfc432574d0b141fd7fe759edfe9b6771dd306bd
- http://www.openwall.com/lists/oss-security/2011/08/22/13
- https://bugzilla.redhat.com/show_bug.cgi?id=731435
- http://www.openwall.com/lists/oss-security/2011/08/17/1
- http://www.openwall.com/lists/oss-security/2011/08/22/14
- http://groups.google.com/group/rubyonrails-security/msg/f1d2749773db9f21?dmode=source&output=gplain
- http://www.openwall.com/lists/oss-security/2011/08/22/5
- http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065114.html
- http://secunia.com/advisories/45917
- http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065189.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html
- https://nvd.nist.gov/vuln/detail/CVE-2011-2932
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2011-2932.yml
- https://github.com/advisories/GHSA-9fh3-vh3h-q4g3 (Advisory)
- http://groups.google.com/group/rubyonrails-security/browse_thread/thread/56bffb5923ab1195
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=731449
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=731450
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=731451
- https://admin.fedoraproject.org/updates/rubygem-activesupport-2.3.8-4.fc14
- https://admin.fedoraproject.org/updates/rubygem-activesupport-3.0.5-4.fc15
- collector/nvd-historical
- collector/nvd-index
- collector/github-advisory-latest
- alias/GHSA-9fh3-vh3h-q4g3
- alias/CVE-2011-2932
- collector/nvd-cve
- collector/github-advisory
- agent/author
- agent/type
- agent/softwarecombine
- agent/first-publish-date
- collector/mitre-cve
- source/MITRE
- collector/redhat-bugzilla
- source/Red Hat
- agent/software-canonical-lookup
- agent/weakness
- agent/last-modified-date
- agent/severity
- agent/references
- agent/remedy
- agent/description
- agent/event
- agent/tags
- agent/trending
- vendor/rubyonrails
- canonical/rubyonrails ruby on rails
- version/rubyonrails ruby on rails/3.0.4
- canonical/rubyonrails rails
- version/rubyonrails rails/2.0.1
- version/rubyonrails rails/2.0.2
- version/rubyonrails rails/2.0.4
- version/rubyonrails rails/2.1.0
- version/rubyonrails rails/2.1.1
- version/rubyonrails rails/2.1.2
- version/rubyonrails rails/2.2.0
- version/rubyonrails rails/2.2.1
- version/rubyonrails rails/2.2.2
- version/rubyonrails rails/2.3.2
- version/rubyonrails rails/2.3.3
- version/rubyonrails rails/2.3.4
- version/rubyonrails rails/2.3.9
- version/rubyonrails rails/2.3.10
- version/rubyonrails rails/2.3.11
- version/rubyonrails rails/2.3.12
- version/rubyonrails rails/2.0.0-rc1
- version/rubyonrails rails/2.0.0-rc2
- version/rubyonrails rails/2.0.0
- version/rubyonrails rails/3.0.0-beta
- version/rubyonrails rails/3.0.0-beta2
- version/rubyonrails rails/3.0.0-beta3
- version/rubyonrails rails/3.0.0-beta4
- version/rubyonrails rails/3.0.0-rc
- version/rubyonrails rails/3.0.0-rc2
- version/rubyonrails rails/3.0.1-pre
- version/rubyonrails rails/3.0.2-pre
- version/rubyonrails rails/3.0.0
- version/rubyonrails rails/3.0.10-rc1
- version/rubyonrails rails/3.1.0-beta1
- version/rubyonrails rails/3.1.0-rc1
- version/rubyonrails rails/3.1.0-rc2
- version/rubyonrails rails/3.1.0-rc3
- version/rubyonrails rails/3.1.0-rc4
- version/rubyonrails rails/3.1.0
- version/rubyonrails rails/3.0.1
- version/rubyonrails rails/3.0.2
- version/rubyonrails rails/3.0.3
- version/rubyonrails rails/3.0.4-rc1
- version/rubyonrails rails/3.0.5
- version/rubyonrails rails/3.0.5-rc1
- version/rubyonrails rails/3.0.6-rc1
- version/rubyonrails rails/3.0.6-rc2
- version/rubyonrails rails/3.0.6
- version/rubyonrails rails/3.0.7-rc1
- version/rubyonrails rails/3.0.7-rc2
- version/rubyonrails rails/3.0.7
- version/rubyonrails rails/3.0.8-rc1
- version/rubyonrails rails/3.0.8-rc2
- version/rubyonrails rails/3.0.8-rc3
- version/rubyonrails rails/3.0.8-rc4
- version/rubyonrails rails/3.0.8
- version/rubyonrails rails/3.0.9-rc1
- version/rubyonrails rails/3.0.9-rc2
- version/rubyonrails rails/3.0.9-rc3
- version/rubyonrails rails/3.0.9-rc4
- version/rubyonrails rails/3.0.9
- version/rubyonrails rails/3.0.9-rc5
- package-manager/rubygems
- package-manager/redhat