[DRE-maint] Bug#1085376: rails: CVE-2024-47889 CVE-2024-47888 CVE-2024-47887 CVE-2024-41128

[Moritz Mühlenhoff]

Source: rails
X-Debbugs-CC: team at security.debian.org
Severity: important
Tags: security

Hi,

The following vulnerabilities were published for rails.

CVE-2024-47889[0]:
| Action Mailer is a framework for designing email service layers.
| Starting in version 3.0.0 and prior to versions 6.1.7.9, 7.0.8.5,
| 7.1.4.1, and 7.2.1.1, there is a possible ReDoS vulnerability in the
| block_format helper in Action Mailer. Carefully crafted text can
| cause the block_format helper to take an unexpected amount of time,
| possibly resulting in a DoS vulnerability. All users running an
| affected release should either upgrade to versions 6.1.7.9, 7.0.8.5,
| 7.1.4.1, or 7.2.1.1 or apply the relevant patch immediately. As a
| workaround, users can avoid calling the `block_format` helper or
| upgrade to Ruby 3.2. Ruby 3.2 has mitigations for this problem, so
| Rails applications using Ruby 3.2 or newer are unaffected. Rails
| 8.0.0.beta1 requires Ruby 3.2 or greater so is unaffected.

https://github.com/rails/rails/security/advisories/GHSA-h47h-mwp9-c6q6
https://github.com/rails/rails/commit/985f1923fa62806ff676e41de67c3b4552131ab9

CVE-2024-47888[1]:
| Action Text brings rich text content and editing to Rails. Starting
| in version 6.0.0 and prior to versions 6.1.7.9, 7.0.8.5, 7.1.4.1,
| and 7.2.1.1, there is a possible ReDoS vulnerability in the
| `plain_text_for_blockquote_node helper` in Action Text. Carefully
| crafted text can cause the `plain_text_for_blockquote_node` helper
| to take an unexpected amount of time, possibly resulting in a DoS
| vulnerability. All users running an affected release should either
| upgrade to versions 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply
| the relevant patch immediately. As a workaround, users can avoid
| calling `plain_text_for_blockquote_node` or upgrade to Ruby 3.2.
| Ruby 3.2 has mitigations for this problem, so Rails applications
| using Ruby 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on
| Ruby 3.2 or greater so is unaffected.

https://github.com/rails/rails/security/advisories/GHSA-wwhv-wxv9-rpgw
https://github.com/rails/rails/commit/4f4312b21a6448336de7c7ab0c4d94b378def468

CVE-2024-47887[2]:
| Action Pack is a framework for handling and responding to web
| requests. Starting in version 4.0.0 and prior to versions 6.1.7.9,
| 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS
| vulnerability in Action Controller's HTTP Token authentication. For
| applications using HTTP Token authentication via
| `authenticate_or_request_with_http_token` or similar, a carefully
| crafted header may cause header parsing to take an unexpected amount
| of time, possibly resulting in a DoS vulnerability. All users
| running an affected release should either upgrade to versions
| 6.1.7.9, 7.0.8.5, 7.1.4.1, or 7.2.1.1 or apply the relevant patch
| immediately. One may choose to use Ruby 3.2 as a workaround.Ruby 3.2
| has mitigations for this problem, so Rails applications using Ruby
| 3.2 or newer are unaffected. Rails 8.0.0.beta1 depends on Ruby 3.2
| or greater so is unaffected.

https://github.com/rails/rails/security/advisories/GHSA-vfg9-r3fq-jvx4
https://github.com/rails/rails/commit/8e057db25bff1dc7a98e9ae72e0083825b9ac545

CVE-2024-41128[3]:
| Action Pack is a framework for handling and responding to web
| requests. Starting in version 3.1.0 and prior to versions 6.1.7.9,
| 7.0.8.5, 7.1.4.1, and 7.2.1.1, there is a possible ReDoS
| vulnerability in the query parameter filtering routines of Action
| Dispatch. Carefully crafted query parameters can cause query
| parameter filtering to take an unexpected amount of time, possibly
| resulting in a DoS vulnerability. All users running an affected
| release should either upgrade to version 6.1.7.9, 7.0.8.5, 7.1.4.1,
| or 7.2.1.1 or apply the relevant patch immediately. One may use Ruby
| 3.2 as a workaround. Ruby 3.2 has mitigations for this problem, so
| Rails applications using Ruby 3.2 or newer are unaffected. Rails
| 8.0.0.beta1 depends on Ruby 3.2 or greater so is unaffected.

https://github.com/rails/rails/security/advisories/GHSA-x76w-6vjr-8xgj
https://github.com/rails/rails/commit/fb493bebae1a9b83e494fe7edbf01f6167d606fd


If you fix the vulnerabilities please also make sure to include the
CVE (Common Vulnerabilities & Exposures) ids in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2024-47889
    https://www.cve.org/CVERecord?id=CVE-2024-47889
[1] https://security-tracker.debian.org/tracker/CVE-2024-47888
    https://www.cve.org/CVERecord?id=CVE-2024-47888
[2] https://security-tracker.debian.org/tracker/CVE-2024-47887
    https://www.cve.org/CVERecord?id=CVE-2024-47887
[3] https://security-tracker.debian.org/tracker/CVE-2024-41128
    https://www.cve.org/CVERecord?id=CVE-2024-41128

Please adjust the affected versions in the BTS as needed.