CVE-2012-1099: XSS
First published: Fri Mar 02 2012(Updated: )
A cross-site scripting (XSS) flaw was found in the way 'select' helper method of the Ruby on Rails performed HTML escaping of 'select' HTML tag options, when the tags were created manually. In this case, the select tag values might end up unescaped. A remote-attacker could provide a specially-crafted input to Ruby on Rails application, using select tags this way, which potentially resulted into arbitrary HTML or webscript execution. References: [1] <a href="http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released">http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released</a> [2] <a href="http://groups.google.com/group/rubyonrails-security/browse_thread/thread/9da0c515a6c4664">http://groups.google.com/group/rubyonrails-security/browse_thread/thread/9da0c515a6c4664</a> [3] <a href="https://bugs.gentoo.org/show_bug.cgi?id=406547">https://bugs.gentoo.org/show_bug.cgi?id=406547</a> Proposed upstream patches: [4] <a href="http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-0-select_options.patch?part=3">http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-0-select_options.patch?part=3</a> (against v3.0 branch) [5] <a href="http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-1-select_options.patch?part=4">http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-1-select_options.patch?part=4</a> (against v3.1 branch) [6] <a href="http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-2-select_options.patch?part=5">http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-2-select_options.patch?part=5</a> (against v3.2 branch)
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| rubygems/actionpack | >=3.2.0<3.2.2 | 3.2.2 |
| rubygems/actionpack | >=3.1.0<3.1.4 | 3.1.4 |
| rubygems/actionpack | >=3.0.0<3.0.12 | 3.0.12 |
| redhat/rubygem-actionpack | <3.0.12 | 3.0.12 |
| redhat/rubygem-actionpack | <3.1.4 | 3.1.4 |
| redhat/rubygem-actionpack | <3.2.2 | 3.2.2 |
| rubyonrails Rails | =3.0.0 | |
| rubyonrails Rails | =3.0.0-beta | |
| rubyonrails Rails | =3.0.0-beta2 | |
| rubyonrails Rails | =3.0.0-beta3 | |
| rubyonrails Rails | =3.0.0-beta4 | |
| rubyonrails Rails | =3.0.0-rc | |
| rubyonrails Rails | =3.0.0-rc2 | |
| rubyonrails Rails | =3.0.1 | |
| rubyonrails Rails | =3.0.1-pre | |
| rubyonrails Rails | =3.0.2 | |
| rubyonrails Rails | =3.0.2-pre | |
| rubyonrails Rails | =3.0.3 | |
| rubyonrails Rails | =3.0.4-rc1 | |
| rubyonrails Rails | =3.0.5 | |
| rubyonrails Rails | =3.0.5-rc1 | |
| rubyonrails Rails | =3.0.6 | |
| rubyonrails Rails | =3.0.6-rc1 | |
| rubyonrails Rails | =3.0.6-rc2 | |
| rubyonrails Rails | =3.0.7 | |
| rubyonrails Rails | =3.0.7-rc1 | |
| rubyonrails Rails | =3.0.7-rc2 | |
| rubyonrails Rails | =3.0.8 | |
| rubyonrails Rails | =3.0.8-rc1 | |
| rubyonrails Rails | =3.0.8-rc2 | |
| rubyonrails Rails | =3.0.8-rc3 | |
| rubyonrails Rails | =3.0.8-rc4 | |
| rubyonrails Rails | =3.0.9 | |
| rubyonrails Rails | =3.0.9-rc1 | |
| rubyonrails Rails | =3.0.9-rc2 | |
| rubyonrails Rails | =3.0.9-rc3 | |
| rubyonrails Rails | =3.0.9-rc4 | |
| rubyonrails Rails | =3.0.9-rc5 | |
| rubyonrails Rails | =3.0.10 | |
| rubyonrails Rails | =3.0.10-rc1 | |
| rubyonrails Rails | =3.0.11 | |
| rubyonrails Rails | =3.0.12-rc1 | |
| Ruby on Rails | =3.0.4 | |
| rubyonrails Rails | =3.1.0 | |
| rubyonrails Rails | =3.1.0-beta1 | |
| rubyonrails Rails | =3.1.0-rc1 | |
| rubyonrails Rails | =3.1.0-rc2 | |
| rubyonrails Rails | =3.1.0-rc3 | |
| rubyonrails Rails | =3.1.0-rc4 | |
| rubyonrails Rails | =3.1.0-rc5 | |
| rubyonrails Rails | =3.1.0-rc6 | |
| rubyonrails Rails | =3.1.0-rc7 | |
| rubyonrails Rails | =3.1.0-rc8 | |
| rubyonrails Rails | =3.1.1 | |
| rubyonrails Rails | =3.1.1-rc1 | |
| rubyonrails Rails | =3.1.1-rc2 | |
| rubyonrails Rails | =3.1.1-rc3 | |
| rubyonrails Rails | =3.1.2 | |
| rubyonrails Rails | =3.1.2-rc1 | |
| rubyonrails Rails | =3.1.2-rc2 | |
| rubyonrails Rails | =3.1.3 | |
| rubyonrails Rails | =3.1.4-rc1 | |
| rubyonrails Rails | =3.2.0 | |
| rubyonrails Rails | =3.2.0-rc1 | |
| rubyonrails Rails | =3.2.0-rc2 | |
| rubyonrails Rails | =3.2.1 | |
| rubyonrails Rails | =3.2.2-rc1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2012-1099
- https://bugzilla.redhat.com/show_bug.cgi?id=799276
- https://github.com/advisories/GHSA-2xjj-5x6h-8vmf (Advisory)
- http://groups.google.com/group/rubyonrails-security/msg/6fca4f5c47705488?dmode=source&output=gplain
- http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075675.html
- http://lists.fedoraproject.org/pipermail/package-announce/2012-March/075740.html
- http://weblog.rubyonrails.org/2012/3/1/ann-rails-3-0-12-has-been-released
- http://www.debian.org/security/2012/dsa-2466
- http://www.openwall.com/lists/oss-security/2012/03/02/6
- http://www.openwall.com/lists/oss-security/2012/03/03/1
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2012-1099.yml
- http://groups.google.com/group/rubyonrails-security/browse_thread/thread/9da0c515a6c4664
- https://bugs.gentoo.org/show_bug.cgi?id=406547
- http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-0-select_options.patch?part=3
- http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-1-select_options.patch?part=4
- http://groups.google.com/group/rubyonrails-security/attach/6fca4f5c47705488/3-2-select_options.patch?part=5
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=799279
- collector/github-advisory-latest
- alias/GHSA-2xjj-5x6h-8vmf
- alias/CVE-2012-1099
- collector/github-advisory
- collector/redhat-bugzilla
- agent/author
- agent/type
- agent/first-publish-date
- agent/last-modified-date
- agent/severity
- agent/weakness
- agent/references
- agent/tags
- agent/softwarecombine
- agent/description
- agent/event
- collector/nvd-cve
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/rubygems
- package-manager/redhat
- vendor/rubyonrails
- canonical/rubyonrails rails
- version/rubyonrails rails/3.0.0
- version/rubyonrails rails/3.0.0-beta
- version/rubyonrails rails/3.0.0-beta2
- version/rubyonrails rails/3.0.0-beta3
- version/rubyonrails rails/3.0.0-beta4
- version/rubyonrails rails/3.0.0-rc
- version/rubyonrails rails/3.0.0-rc2
- version/rubyonrails rails/3.0.1
- version/rubyonrails rails/3.0.1-pre
- version/rubyonrails rails/3.0.2
- version/rubyonrails rails/3.0.2-pre
- version/rubyonrails rails/3.0.3
- version/rubyonrails rails/3.0.4-rc1
- version/rubyonrails rails/3.0.5
- version/rubyonrails rails/3.0.5-rc1
- version/rubyonrails rails/3.0.6
- version/rubyonrails rails/3.0.6-rc1
- version/rubyonrails rails/3.0.6-rc2
- version/rubyonrails rails/3.0.7
- version/rubyonrails rails/3.0.7-rc1
- version/rubyonrails rails/3.0.7-rc2
- version/rubyonrails rails/3.0.8
- version/rubyonrails rails/3.0.8-rc1
- version/rubyonrails rails/3.0.8-rc2
- version/rubyonrails rails/3.0.8-rc3
- version/rubyonrails rails/3.0.8-rc4
- version/rubyonrails rails/3.0.9
- version/rubyonrails rails/3.0.9-rc1
- version/rubyonrails rails/3.0.9-rc2
- version/rubyonrails rails/3.0.9-rc3
- version/rubyonrails rails/3.0.9-rc4
- version/rubyonrails rails/3.0.9-rc5
- version/rubyonrails rails/3.0.10
- version/rubyonrails rails/3.0.10-rc1
- version/rubyonrails rails/3.0.11
- version/rubyonrails rails/3.0.12-rc1
- canonical/ruby on rails
- version/ruby on rails/3.0.4
- version/rubyonrails rails/3.1.0
- version/rubyonrails rails/3.1.0-beta1
- version/rubyonrails rails/3.1.0-rc1
- version/rubyonrails rails/3.1.0-rc2
- version/rubyonrails rails/3.1.0-rc3
- version/rubyonrails rails/3.1.0-rc4
- version/rubyonrails rails/3.1.0-rc5
- version/rubyonrails rails/3.1.0-rc6
- version/rubyonrails rails/3.1.0-rc7
- version/rubyonrails rails/3.1.0-rc8
- version/rubyonrails rails/3.1.1
- version/rubyonrails rails/3.1.1-rc1
- version/rubyonrails rails/3.1.1-rc2
- version/rubyonrails rails/3.1.1-rc3
- version/rubyonrails rails/3.1.2
- version/rubyonrails rails/3.1.2-rc1
- version/rubyonrails rails/3.1.2-rc2
- version/rubyonrails rails/3.1.3
- version/rubyonrails rails/3.1.4-rc1
- version/rubyonrails rails/3.2.0
- version/rubyonrails rails/3.2.0-rc1
- version/rubyonrails rails/3.2.0-rc2
- version/rubyonrails rails/3.2.1
- version/rubyonrails rails/3.2.2-rc1