| Package | Affected versions | Patched versions |
|---|---|---|
| actionpack | ≥ 6.1.0, < 6.1.7.8≥ 7.0.0, < 7.0.8.4≥ 7.1.0, < 7.1.3.4≥ 7.2.0.beta1, < 7.2.0.beta2 | 6.1.7.87.0.8.47.1.3.47.2.0.beta2 |
| rails | = 7.2.0≥ 6.1.0, < 6.1.7.8≥ 7.0.0, < 7.0.8.4≥ 7.1.0, < 7.1.3.4 | 6.1.7.87.0.8.47.1.3.4 |
The application configurable Permissions-Policy is only served on responses with an HTML related Content-Type.
This has been assigned the CVE identifier CVE-2024-28103.
Versions Affected: >= 6.1.0 Not affected: < 6.1.0 Fixed Versions: 6.1.7.8, 7.0.8.4, and 7.1.3.4
Responses with a non-HTML Content-Type are not serving the configured Permissions-Policy. There are certain non-HTML Content-Types that would benefit from having the Permissions-Policy enforced.
The fixed releases are available at the normal locations.
N/A
To aid users who aren't able to upgrade immediately we have provided patches for the supported release series in accordance with our maintenance policy regarding security issues. They are in git-am format and consist of a single changeset.
Thank you shinkbr for reporting this!
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free