{ "document" : { "aggregate_severity" : { "text" : "mittel" }, "category" : "csaf_base", "csaf_version" : "2.0", "distribution" : { "tlp" : { "label" : "WHITE", "url" : "https://www.first.org/tlp/" } }, "lang" : "de-DE", "notes" : [ { "category" : "legal_disclaimer", "text" : "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen." }, { "category" : "description", "text" : "Ruby on Rails ist ein in der Programmiersprache Ruby geschriebenes und quelloffenes Web Application Framework.", "title" : "Produktbeschreibung" }, { "category" : "summary", "text" : "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um Sicherheitsvorkehrungen zu umgehen und um einen Cross-Site Scripting Angriff durchzuführen.", "title" : "Angriff" }, { "category" : "general", "text" : "- Sonstiges\n- UNIX", "title" : "Betroffene Betriebssysteme" } ], "publisher" : { "category" : "other", "contact_details" : "csaf-provider@cert-bund.de", "name" : "Bundesamt für Sicherheit in der Informationstechnik", "namespace" : "https://www.bsi.bund.de" }, "references" : [ { "category" : "self", "summary" : "WID-SEC-W-2024-1292 - CSAF Version", "url" : "https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-1292.json" }, { "category" : "self", "summary" : "WID-SEC-2024-1292 - Portal Version", "url" : "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2024-1292" }, { "category" : "external", "summary" : "Rails Security Releases vom 2024-06-04", "url" : "https://rubyonrails.org/2024/6/4/Rails-Versions-6-1-7-8-7-0-8-4-and-7-1-3-4-have-been-released" }, { "category" : "external", "summary" : "SUSE Security Update SUSE-SU-2024:1973-1 vom 2024-06-11", "url" : "https://lists.suse.com/pipermail/sle-security-updates/2024-June/018691.html" }, { "category" : "external", "summary" : "SUSE Security Update SUSE-SU-2024:1974-1 vom 2024-06-11", "url" : "https://lists.suse.com/pipermail/sle-security-updates/2024-June/018690.html" }, { "category" : "external", "summary" : "SUSE Security Update SUSE-SU-2024:1986-1 vom 2024-06-11", "url" : "https://lists.suse.com/pipermail/sle-security-updates/2024-June/018697.html" }, { "category" : "external", "summary" : "SUSE Security Update SUSE-SU-2024:2140-1 vom 2024-06-21", "url" : "https://lists.suse.com/pipermail/sle-security-updates/2024-June/018780.html" }, { "category" : "external", "summary" : "Debian Security Advisory DSA-5881 vom 2025-03-17", "url" : "https://lists.debian.org/debian-security-announce/2025/msg00043.html" }, { "category" : "external", "summary" : "openSUSE Security Update OPENSUSE-SU-2025:15124-1 vom 2025-05-18", "url" : "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/3C5WPU2RXUSPKAI3EANLIGCY34ZDBZ4Y/" }, { "category" : "external", "summary" : "Fedora Security Advisory FEDORA-2025-203B7DB566 vom 2025-07-17", "url" : "https://bodhi.fedoraproject.org/updates/FEDORA-2025-203b7db566" } ], "source_lang" : "en-US", "title" : "Ruby on Rails: Mehrere Schwachstellen", "tracking" : { "current_release_date" : "2025-07-16T22:00:00.000+00:00", "generator" : { "date" : "2025-07-17T06:22:52.718+00:00", "engine" : { "name" : "BSI-WID", "version" : "1.4.0" } }, "id" : "WID-SEC-W-2024-1292", "initial_release_date" : "2024-06-04T22:00:00.000+00:00", "revision_history" : [ { "date" : "2024-06-04T22:00:00.000+00:00", "number" : "1", "summary" : "Initiale Fassung" }, { "date" : "2024-06-10T22:00:00.000+00:00", "number" : "2", "summary" : "Neue Updates von SUSE aufgenommen" }, { "date" : "2024-06-11T22:00:00.000+00:00", "number" : "3", "summary" : "Neue Updates von SUSE aufgenommen" }, { "date" : "2024-06-23T22:00:00.000+00:00", "number" : "4", "summary" : "Neue Updates von SUSE aufgenommen" }, { "date" : "2025-03-17T23:00:00.000+00:00", "number" : "5", "summary" : "Neue Updates von Debian aufgenommen" }, { "date" : "2025-05-18T22:00:00.000+00:00", "number" : "6", "summary" : "Neue Updates von openSUSE aufgenommen" }, { "date" : "2025-07-16T22:00:00.000+00:00", "number" : "7", "summary" : "Neue Updates von Fedora aufgenommen" } ], "status" : "final", "version" : "7" } }, "product_tree" : { "branches" : [ { "branches" : [ { "category" : "product_name", "name" : "Debian Linux", "product" : { "name" : "Debian Linux", "product_id" : "2951", "product_identification_helper" : { "cpe" : "cpe:/o:debian:debian_linux:-" } } } ], "category" : "vendor", "name" : "Debian" }, { "branches" : [ { "category" : "product_name", "name" : "Fedora Linux", "product" : { "name" : "Fedora Linux", "product_id" : "74185", "product_identification_helper" : { "cpe" : "cpe:/o:fedoraproject:fedora:-" } } } ], "category" : "vendor", "name" : "Fedora" }, { "branches" : [ { "branches" : [ { "category" : "product_version_range", "name" : "<6.1.7.8", "product" : { "name" : "Open Source Ruby on Rails <6.1.7.8", "product_id" : "T035205" } }, { "category" : "product_version", "name" : "6.1.7.8", "product" : { "name" : "Open Source Ruby on Rails 6.1.7.8", "product_id" : "T035205-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:rubyonrails:ruby_on_rails:6.1.7.8" } } }, { "category" : "product_version_range", "name" : "<7.0.8.4", "product" : { "name" : "Open Source Ruby on Rails <7.0.8.4", "product_id" : "T035206" } }, { "category" : "product_version", "name" : "7.0.8.4", "product" : { "name" : "Open Source Ruby on Rails 7.0.8.4", "product_id" : "T035206-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:rubyonrails:ruby_on_rails:7.0.8.4" } } }, { "category" : "product_version_range", "name" : "<7.1.3.4", "product" : { "name" : "Open Source Ruby on Rails <7.1.3.4", "product_id" : "T035207" } }, { "category" : "product_version", "name" : "7.1.3.4", "product" : { "name" : "Open Source Ruby on Rails 7.1.3.4", "product_id" : "T035207-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:rubyonrails:ruby_on_rails:7.1.3.4" } } }, { "category" : "product_version_range", "name" : "<7.2.0.beta2", "product" : { "name" : "Open Source Ruby on Rails <7.2.0.beta2", "product_id" : "T035213" } }, { "category" : "product_version_range", "name" : "<7.2.0.beta2", "product" : { "name" : "Open Source Ruby on Rails <7.2.0.beta2", "product_id" : "T035213-fixed" } } ], "category" : "product_name", "name" : "Ruby on Rails" } ], "category" : "vendor", "name" : "Open Source" }, { "branches" : [ { "category" : "product_name", "name" : "SUSE Linux", "product" : { "name" : "SUSE Linux", "product_id" : "T002207", "product_identification_helper" : { "cpe" : "cpe:/o:suse:suse_linux:-" } } }, { "category" : "product_name", "name" : "SUSE openSUSE", "product" : { "name" : "SUSE openSUSE", "product_id" : "T027843", "product_identification_helper" : { "cpe" : "cpe:/o:suse:opensuse:-" } } } ], "category" : "vendor", "name" : "SUSE" } ] }, "vulnerabilities" : [ { "cve" : "CVE-2024-28103", "product_status" : { "known_affected" : [ "T035207", "T035206", "T035205", "2951", "T002207", "T027843", "74185" ] }, "release_date" : "2024-06-04T22:00:00.000+00:00", "title" : "CVE-2024-28103" }, { "cve" : "CVE-2024-32464", "product_status" : { "known_affected" : [ "T035207", "2951", "T002207", "T027843", "T035213", "74185" ] }, "release_date" : "2024-06-04T22:00:00.000+00:00", "title" : "CVE-2024-32464" } ] }