Information disclosure in Ruby on Rails - CVE-2024-26144

CSH
CYBERSECURITY HELP
Sign In REGISTER
 
Main Vulnerability Database Vulnerabilities #VU86810

Information disclosure in Ruby on Rails - CVE-2024-26144

Published: February 27, 2024


Vulnerability identifier: #VU86810
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2024-26144
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker to gain access to potentially sensitive information.

The vulnerability exists due to the Active Storage send a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Such cookie can be cached certain proxies and lead to information disclosure.


Affected software

Ruby on Rails
Red Hat Satellite
Red Hat Enterprise Linux for x86_64
openEuler
foreman-fapolicyd (Red Hat package)
pulpcore-obsolete-packages (Red Hat package)
rubygem-rack (Red Hat package)
python-pulp-container (Red Hat package)
rubygem-smart_proxy_ansible (Red Hat package)
foreman (Red Hat package)
foreman-installer (Red Hat package)
rubygem-katello (Red Hat package)
rubygem-activestorage
rubygem-activestorage-doc
rubygem-rails (Red Hat package)
rubygem-actionmailbox (Red Hat package)
rubygem-activesupport (Red Hat package)
rubygem-activestorage (Red Hat package)
rubygem-activerecord (Red Hat package)
rubygem-activemodel (Red Hat package)
rubygem-activejob (Red Hat package)
rubygem-actionview (Red Hat package)
rubygem-actiontext (Red Hat package)
rubygem-actionpack (Red Hat package)
rubygem-actionmailer (Red Hat package)
rubygem-actioncable (Red Hat package)
rubygem-railties (Red Hat package)
satellite (Red Hat package)
puppetserver (Red Hat package)
rubygem-foreman_rh_cloud (Red Hat package)
IBM License Metric Tool

How to mitigate CVE-2024-26144

Install updates from vendor's website.

Ruby on Rails - addressed in versions 6.1.7.7, 7.0.8.1
Red Hat Satellite - update to 6.15.5
foreman-fapolicyd (Red Hat package) - update to 1.0.1-3.el8sat
pulpcore-obsolete-packages (Red Hat package) - update to 1.0-10.el8pc
rubygem-rack (Red Hat package) - update to 2.2.8.1-1.el8sat
python-pulp-container (Red Hat package) - update to 2.16.9-2.el8pc
rubygem-smart_proxy_ansible (Red Hat package) - update to 3.5.6-0.1.el8sat
foreman (Red Hat package) - update to 3.9.1.12-1.el8sat
foreman-installer (Red Hat package) - update to 3.9.3.7-1.el8sat
rubygem-katello (Red Hat package) - update to 4.11.0.19-1.el8sat
rubygem-activestorage - update to 6.1.4.1-2
rubygem-activestorage-doc - update to 6.1.4.1-2
rubygem-rails (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-actionmailbox (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-activesupport (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-activestorage (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-activerecord (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-activemodel (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-activejob (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-actionview (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-actiontext (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-actionpack (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-actionmailer (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-actioncable (Red Hat package) - update to 6.1.7.7-1.el8sat
rubygem-railties (Red Hat package) - update to 6.1.7.7-2.el8sat
satellite (Red Hat package) - update to 6.15.5-1.el8sat
puppetserver (Red Hat package) - update to 7.17.2-1.el8sat
rubygem-foreman_rh_cloud (Red Hat package) - update to 9.0.59-1.el8sat
IBM License Metric Tool - update to 9.2.35

External References

Related Security Bulletins