Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.Test your applications
- Snyk ID SNYK-RUBY-RAILTIES-5851410
- published 23 Aug 2023
- disclosed 23 Aug 2023
- credit maxfell
How to fix?
railties to version 188.8.131.52, 184.108.40.206 or higher.
railties is an application bootup, plugins, generators, and rake tasks.
Affected versions of this package are vulnerable to Information Exposure. The
ImpactActiveSupport::EncryptedFile method writes contents that will be encrypted to a temporary file. The temporary file’s permissions are defaulted to the user’s current umask settings, meaning that it’s possible for other users on the same system to read the contents of the temporary file.
Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.
Users can set the umask to be more restrictive:
ruby$ umask 0077