Vulnerability advisory

GHSA-fjfg-q662-gm6j

Moderate severity vulnerability that affects rails

Published Oct 24, 2017Updated May 1, 2025OSV record ↗

Also known as CVE-2007-5379

Severity

Severity not reported.

Affected versions

rails RubyGems

All rails advisories →

Affected	Fixed in
All versions before 1.2.4	`1.2.4`Advisories →
Also listed as affected (33) `0.10.0` `0.10.1` `0.11.0` `0.11.1` `0.12.0` `0.12.1` `0.13.0` `0.13.1` `0.14.1` `0.14.2` `0.14.3` `0.14.4` `0.8.0` `0.8.5` `0.9.0` `0.9.1` `0.9.2` `0.9.3` `0.9.4` `0.9.4.1` `0.9.5` `1.0.0` `1.1.0` `1.1.1` `1.1.2` `1.1.3` `1.1.4` `1.1.5` `1.1.6` `1.2.0` `1.2.1` `1.2.2` `1.2.3`

Description

Rails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.

References

Advisorynvd.nist.gov/vuln/detail/CVE-2007-5379 ↗
Packagegithub.com/rails/rails ↗
Webgithub.com/rubysec/ruby-advisory-db/blob/master/gems/rails/CVE-2007-5379.yml ↗
Webrubyonrails.org/2007/10/5/rails-1-2-4-maintenance-release ↗
Webweb.archive.org/web/20090602000500/http://dev.rubyonrails.org/ticket/8453 ↗
Webbugs.gentoo.org/show_bug.cgi?id=195315 ↗
Webdocs.info.apple.com/article.html?artnum=307179 ↗
Weblists.apple.com/archives/security-announce/2007/Dec/msg00002.html ↗
Websecurity.gentoo.org/glsa/glsa-200711-17.xml ↗
Webwww.us-cert.gov/cas/techalerts/TA07-352A.html ↗
Webwww.vupen.com/english/advisories/2007/3508 ↗
Webwww.vupen.com/english/advisories/2007/4238 ↗