CVE-2015-9284

RubyGems/omniauth CVE-2015-9284: high 8.8

OmniAuth Ruby gem Cross-site Request Forgery in request phase

Action: Upgrade omniauth to 2.0.0 or later.

bundle update omniauth

Affected

Fixed versions

Sources

• osv: GHSA-ww4x-rwq6-qpgf
• https://nvd.nist.gov/vuln/detail/CVE-2015-9284
• https://github.com/omniauth/omniauth/issues/1031
• https://github.com/omniauth/omniauth-rails/pull/1
• https://github.com/omniauth/omniauth/pull/809
• https://github.com/rubysec/ruby-advisory-db/commit/aef9f623c0be838234d53baf18977564804da397
• https://github.com/omniauth/omniauth
• https://github.com/omniauth/omniauth/releases/tag/v1.9.2
• https://github.com/omniauth/omniauth/releases/tag/v2.0.0
• https://github.com/omniauth/omniauth/wiki/Resolving-CVE-2015-9284
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/omniauth/CVE-2015-9284.yml
• https://www.openwall.com/lists/oss-security/2015/05/26/11

CVE-2015-9284 · published 2019-05-29T19:11:31Z · modified 2024-02-16T08:21:54.381778Z · JSON