USN-9058-1: ruby-actionpack-page-caching vulnerability
It was discovered that Action Pack Page Caching incorrectly handled certain request paths when writing cached pages. A remote attacker could possibly use this issue to write arbitrary files to the web server, and possibly execute arbitrary code.
Affected Software
Remediation
Recommended actions to resolve this vulnerability, in priority order.
- Upgrade
Upgrade
ubuntu/ruby-actionpack-page-cachingto a version that resolves this vulnerability.Fixed in 1.0.2-4ubuntu0.16.04.1~esm1 - Upgrade
Upgrade
ubuntu/ruby-actionpack-page-cachingto a version that resolves this vulnerability.Fixed in 1.0.2-4ubuntu0.18.04.1~esm1 - Upgrade
Upgrade
ubuntu/ruby-actionpack-page-cachingto a version that resolves this vulnerability.Fixed in 1.1.0-1ubuntu0.1~esm1 - Upgrade
Upgrade
ubuntu/ruby-actionpack-page-cachingto a version that resolves this vulnerability.Fixed in Ubuntu Pro
Event History
Frequently Asked Questions
What access would an attacker need to exploit this issue?
The issue can be exploited remotely through certain request paths. The available information does not state that authentication or local access is required.
What is the potential impact if exploitation succeeds?
An attacker may be able to write arbitrary files to the web server. This could potentially lead to arbitrary code execution.