actionpack Improper Authentication vulnerability
Moderate severity
GitHub Reviewed
Published
Oct 24, 2017
to the GitHub Advisory Database
•
Updated Jan 22, 2025
Package
Affected versions
>= 3.1.0, < 3.1.7
>= 3.2.0, < 3.2.7
>= 3.0.0.beta, < 3.0.16
< 2.3.5
Patched versions
3.1.7
3.2.7
3.0.16
2.3.5
Description
Published by the National Vulnerability Database
Aug 8, 2012
Published to the GitHub Advisory Database
Oct 24, 2017
Reviewed
Jun 16, 2020
Last updated
Jan 22, 2025
Credits
-
ShayAry Analyst
-
levpachmanov Analyst
The
decode_credentialsmethod inactionpack/lib/action_controller/metal/http_authentication.rbin Ruby on Rails before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses awith_http_digesthelper method, as demonstrated by theauthenticate_or_request_with_http_digestmethod.References