Information Exposure Affecting activesupport package, versions >=5.2.0, <6.1.7.5 >=7.0.0, <7.0.7.1
Snyk CVSS
Do your applications use this vulnerable package?
In a few clicks we can analyze your entire application and see what components are vulnerable in your application, and suggest you quick fixes.
Test your applications- Snyk ID SNYK-RUBY-ACTIVESUPPORT-5851458
- published 23 Aug 2023
- disclosed 23 Aug 2023
- credit maxfell
Introduced: 23 Aug 2023
CVE-2023-38037 Open this link in a new tabHow to fix?
Upgrade activesupport to version 6.1.7.5, 7.0.7.1 or higher.
Overview
activesupport is a toolkit of support libraries and Ruby core extensions extracted from the Rails framework.
Affected versions of this package are vulnerable to Information Exposure. The ImpactActiveSupport::EncryptedFile method writes contents that will be encrypted to a temporary file. The temporary file’s permissions are defaulted to the user’s current umask settings, meaning that it’s possible for other users on the same system to read the contents of the temporary file.
Note:
Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.
Workaround
Users can set the umask to be more restrictive: ruby$ umask 0077