SB2012013103 - Cross-site scripting in ruby-actionpack (Alpine package)

Description

This security bulletin contains information about 1 security vulnerability.

1) Cross-site scripting (CVE-ID: CVE-2011-2931)

Vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability is caused by an input validation error in the strip_tags helper in actionpack/lib/action_controller/vendor/html-scanner/html/node.rb in Ruby on Rails before 2.3.13, 3.0.x before 3.0.10, and 3.1.x before 3.1.0.rc5. A remote attacker can trick the victim to follow a specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Remediation

Install update from vendor's website.

References

• https://git.alpinelinux.org/aports/commit/?id=269e7f25545e02034cead0c65442326f1a346ba5
• https://git.alpinelinux.org/aports/commit/?id=b26e3b6ec1ec742d6822d36fd791dfa309869e25