CVE-2016-2098: Input Validation

Q: What is the severity of CVE-2016-2098?

CVE-2016-2098 has a critical severity rating as it allows remote code execution due to improper handling of the render method in Ruby on Rails.

Q: How do I fix CVE-2016-2098?

To fix CVE-2016-2098, update Ruby on Rails to version 3.2.22.2, 4.1.14.2 or later, or 4.2.5.2 or later.

Q: What versions are affected by CVE-2016-2098?

CVE-2016-2098 affects Ruby on Rails versions prior to 3.2.22.2, 4.1.14.2, and 4.2.5.2.

Q: What types of applications are vulnerable to CVE-2016-2098?

Web applications built using vulnerable versions of the Ruby on Rails framework are at risk of CVE-2016-2098.

Q: Does CVE-2016-2098 affect all Ruby on Rails applications?

CVE-2016-2098 specifically affects applications that make unrestricted use of the render method in the affected versions of Ruby on Rails.

Published Apr 7, 2016

Updated

Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

Affected Software

73 affected components

Debian Debian Linux=8.0

rubyonrails Rails=4.0.0

rubyonrails Rails=4.0.0-beta

rubyonrails Rails=4.0.0-rc1

rubyonrails Rails=4.0.0-rc2

rubyonrails Rails=4.0.1

rubyonrails Rails=4.0.1-rc1

rubyonrails Rails=4.0.1-rc2

rubyonrails Rails=4.0.1-rc3

rubyonrails Rails=4.0.1-rc4

rubyonrails Rails=4.0.2

rubyonrails Rails=4.0.3

rubyonrails Rails=4.0.4

rubyonrails Rails=4.0.4-rc1

rubyonrails Rails=4.0.5

rubyonrails Rails=4.0.6

rubyonrails Rails=4.0.6-rc1

rubyonrails Rails=4.0.6-rc2

rubyonrails Rails=4.0.6-rc3

rubyonrails Rails=4.0.7

rubyonrails Rails=4.0.8

rubyonrails Rails=4.0.9

rubyonrails Rails=4.0.10-rc1

rubyonrails Rails=4.1.0

rubyonrails Rails=4.1.0-beta1

rubyonrails Rails=4.1.0-beta2

rubyonrails Rails=4.1.0-rc1

rubyonrails Rails=4.1.0-rc2

rubyonrails Rails=4.1.1

rubyonrails Rails=4.1.2

rubyonrails Rails=4.1.2-rc1

rubyonrails Rails=4.1.2-rc2

rubyonrails Rails=4.1.2-rc3

rubyonrails Rails=4.1.3

rubyonrails Rails=4.1.4

rubyonrails Rails=4.1.5

rubyonrails Rails=4.1.6-rc1

rubyonrails Rails=4.1.6-rc2

rubyonrails Rails=4.1.7

rubyonrails Rails=4.1.7.1

rubyonrails Rails=4.1.8

rubyonrails Rails=4.1.9-rc1

rubyonrails Rails=4.1.10-rc1

rubyonrails Rails=4.1.10-rc2

rubyonrails Rails=4.1.10-rc3

rubyonrails Rails=4.1.10-rc4

rubyonrails Rails=4.1.12-rc1

rubyonrails Rails=4.1.13-rc1

rubyonrails Rails=4.1.14-rc1

rubyonrails Rails=4.1.14-rc2

rubyonrails Rails=4.2.0-beta1

rubyonrails Rails=4.2.0-beta2

rubyonrails Rails=4.2.0-beta3

rubyonrails Rails=4.2.0-beta4

rubyonrails Rails=4.2.0-rc1

rubyonrails Rails=4.2.0-rc2

rubyonrails Rails=4.2.0-rc3

rubyonrails Rails=4.2.1

rubyonrails Rails=4.2.1-rc1

rubyonrails Rails=4.2.1-rc2

rubyonrails Rails=4.2.1-rc3

rubyonrails Rails=4.2.1-rc4

rubyonrails Rails=4.2.2

rubyonrails Rails=4.2.3

rubyonrails Rails=4.2.3-rc1

rubyonrails Rails=4.2.4

rubyonrails Rails=4.2.4-rc1

rubyonrails Rails=4.2.5

rubyonrails Rails=4.2.5-rc1

rubyonrails Rails=4.2.5-rc2

rubyonrails Rails=4.2.5.1

rubyonrails ruby on Rails<=3.2.22.1

rubyonrails ruby on Rails=4.1.14.1

Remediation

Patch Available

http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/

Event History

Apr 7, 2016

CVE Published

via MITRE·11:00 PM

Data Sourced

via MITRE·11:00 PM

Description

Frequently Asked Questions

What is the severity of CVE-2016-2098?

CVE-2016-2098 has a critical severity rating as it allows remote code execution due to improper handling of the render method in Ruby on Rails.

How do I fix CVE-2016-2098?