ELA-425-1 rails security update

multiple vulnerabilities

2021-05-12
Packagerails
Version2:4.1.8-1+deb8u9
Related CVEs CVE-2021-22885 CVE-2021-22904


CVE-2021-22885

There is a possible information disclosure/unintended method
execution vulnerability in Action Pack when using the
`redirect_to` or `polymorphic_url` helper with untrusted user
input.

CVE-2021-22904

There is a possible DoS vulnerability in the Token Authentication
logic in Action Controller. Impacted code uses
`authenticate_or_request_with_http_token` or
`authenticate_with_http_token` for request authentication.


For Debian 8 jessie, these problems have been fixed in version 2:4.1.8-1+deb8u9.

We recommend that you upgrade your rails packages.

Further information about Extended LTS security advisories can be found at: debian Extended Long term support