CVE-2015-7576
Fixed in a distro release EPSS 5%
The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.
Products: rubyonrails rails, rubyonrails ruby_on_rails
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | actionpack | 3.2.22.1 |
| RubyGems | actionpack | 4.1.14.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | rails | 2:4.2.5.1-1 |
| Debian 13 | rails | 2:4.2.5.1-1 |
| Debian 14 | rails | 2:4.2.5.1-1 |
| Debian 7 | ruby-actionpack-3.2 | 3.2.6-6+deb7u3 |
| Debian 8 | rails | 2:4.1.8-1+deb8u1 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-actionpack | 1:4.1.5-3.el6 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-actionpack | 1:4.1.5-3.el7 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-actionpack-doc | 1:4.1.5-3.el6 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-actionpack-doc | 1:4.1.5-3.el7 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-actionview | 0:4.1.5-4.el6 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-actionview | 0:4.1.5-4.el7 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-actionview-doc | 0:4.1.5-4.el6 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-actionview-doc | 0:4.1.5-4.el7 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-activemodel | 0:4.1.5-2.el7 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-activemodel | 0:4.1.5-2.el6 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-activemodel-doc | 0:4.1.5-2.el6 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-activemodel-doc | 0:4.1.5-2.el7 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-activerecord | 1:4.1.5-2.el7 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-activerecord | 1:4.1.5-2.el6 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-activerecord-doc | 1:4.1.5-2.el6 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-activerecord-doc | 1:4.1.5-2.el7 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-activesupport | 1:4.1.5-3.el7 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-activesupport | 1:4.1.5-3.el6 |
| Red Hat rhel software collections 2 | ror40-rubygem-actionpack | 1:4.0.2-7.el6 |
| Red Hat rhel software collections 2 | ror40-rubygem-actionpack | 1:4.0.2-7.el7 |
| Red Hat rhel software collections 2 | ror40-rubygem-actionpack-doc | 1:4.0.2-7.el7 |
| Red Hat rhel software collections 2 | ror40-rubygem-actionpack-doc | 1:4.0.2-7.el6 |
| Red Hat rhel software collections 2 | ror40-rubygem-activerecord | 1:4.0.2-6.el6 |
| Red Hat rhel software collections 2 | ror40-rubygem-activerecord | 1:4.0.2-6.el7 |
| Red Hat rhel software collections 2 | ror40-rubygem-activerecord-doc | 1:4.0.2-6.el6 |
| Red Hat rhel software collections 2 | ror40-rubygem-activerecord-doc | 1:4.0.2-6.el7 |
| Red Hat rhel software collections 2 | ror40-rubygem-activesupport | 1:4.0.2-4.el6 |
| Red Hat rhel software collections 2 | ror40-rubygem-activesupport | 1:4.0.2-4.el7 |
| Red Hat rhel software collections 2 | ruby193-rubygem-actionpack | 1:3.2.8-16.el6 |
| Red Hat rhel software collections 2 | ruby193-rubygem-actionpack | 1:3.2.8-16.el7 |
| Red Hat rhel software collections 2 | ruby193-rubygem-actionpack-doc | 1:3.2.8-16.el6 |
| Red Hat rhel software collections 2 | ruby193-rubygem-actionpack-doc | 1:3.2.8-16.el7 |
| Red Hat rhel software collections 2 | ruby193-rubygem-activerecord | 1:3.2.8-11.el6 |
| Red Hat rhel software collections 2 | ruby193-rubygem-activerecord | 1:3.2.8-11.el7 |
| Red Hat rhel software collections 2 | ruby193-rubygem-activerecord-doc | 1:3.2.8-11.el6 |
| Red Hat rhel software collections 2 | ruby193-rubygem-activerecord-doc | 1:3.2.8-11.el7 |
| Red Hat rhel software collections 2 | ruby193-rubygem-activesupport | 1:3.2.8-6.el6 |
| Red Hat rhel software collections 2 | ruby193-rubygem-activesupport | 1:3.2.8-6.el7 |
| SUSE Enterprise Storage 2.1 | rubygem-actionpack-4_2 | 4.2.2-6.1 |
| SUSE Enterprise Storage 2.1 | rubygem-activesupport-4_2 | 4.2.2-6.1 |
| SUSE Lifecycle Management Server 1.3 | rubygem-actionpack-3_2 | 3.2.12-0.23.1 |
| SUSE Lifecycle Management Server 1.3 | rubygem-activesupport-3_2 | 3.2.12-0.21.1 |
| SUSE Lifecycle Management Server 1.3 | rubygem-activesupport-3_2 | 3.2.12-0.18.1 |
| SUSE Linux Enterprise Module for Containers 12 | portus | 2.0.3-2.4 |
| SUSE Linux Enterprise Software Development Kit 11 SP3 | rubygem-activesupport-3_2 | 3.2.12-0.18.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | rubygem-actionpack-3_2 | 3.2.12-0.23.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | rubygem-activesupport-3_2 | 3.2.12-0.18.1 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | rubygem-activesupport-3_2 | 3.2.12-0.21.1 |
| SUSE OpenStack Cloud 5 | rubygem-actionpack-4_1 | 4.1.9-9.1 |
| SUSE OpenStack Cloud 5 | rubygem-activesupport-4_1 | 4.1.9-12.1 |
| SUSE OpenStack Cloud 5 | rubygem-activesupport-4_1 | 4.1.9-15.1 |
| SUSE Studio Onsite 1.3 | libjansson | 2.2.1-0.9.11.6 |
| SUSE Studio Onsite 1.3 | qemu-ext2 | 0.1.1-0.9.4.19 |
| SUSE Studio Onsite 1.3 | rubygem-actionpack-3_2 | 3.2.12-0.23.1 |
| SUSE Studio Onsite 1.3 | rubygem-activesupport-3_2 | 3.2.12-0.18.1 |
| SUSE Studio Onsite 1.3 | rubygem-activesupport-3_2 | 3.2.12-0.21.1 |
| SUSE Studio Onsite 1.3 | rubygem-bundler19 | 1.7.0-0.13.10 |
| SUSE Studio Onsite 1.3 | studio-help | 1.3.20-0.6.9 |
| SUSE Studio Onsite 1.3 | susestudio | 1.3.14-52.1 |
| SUSE Studio Onsite Runner 1.3 | libjansson | 2.2.1-0.9.11.6 |
| SUSE Studio Onsite Runner 1.3 | qemu-ext2 | 0.1.1-0.9.4.19 |
| SUSE Studio Onsite Runner 1.3 | rubygem-bundler19 | 1.7.0-0.13.10 |
| SUSE Studio Onsite Runner 1.3 | studio-help | 1.3.20-0.6.9 |
| SUSE Studio Onsite Runner 1.3 | susestudio | 1.3.14-52.1 |
| SUSE WebYast 1.3 | rubygem-actionpack-3_2 | 3.2.12-0.23.1 |
| SUSE WebYast 1.3 | rubygem-activesupport-3_2 | 3.2.12-0.18.1 |
| SUSE WebYast 1.3 | rubygem-activesupport-3_2 | 3.2.12-0.21.1 |