[DRE-maint] Bug#900178: ruby-rails-admin: CVE-2017-12098

[Salvatore Bonaccorso]

Source: ruby-rails-admin
Version: 0.8.1+dfsg-3
Severity: grave
Tags: patch security upstream
Justification: user security hole
Forwarded: https://github.com/sferik/rails_admin/issues/2985

Hi,

The following vulnerability was published for ruby-rails-admin.

CVE-2017-12098[0]:
| An exploitable cross site scripting (XSS) vulnerability exists in the
| add filter functionality of the rails_admin rails gem version 1.2.0. A
| specially crafted URL can cause an XSS flaw resulting in an attacker
| being able to execute arbitrary javascript on the victim's browser. An
| attacker can phish an authenticated user to trigger this
| vulnerability.

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2017-12098
    https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-12098
[1] https://github.com/sferik/rails_admin/issues/2985
[2] https://github.com/sferik/rails_admin/commit/44f09ed72b5e0e917a5d61bd89c48d97c494b41c

Regards,
Salvatore