CVE-2024-28103
1 advisory.
RubyGems/actionpack CVE-2024-28103: medium 5.4, EPSS 0.66%
Missing security headers in Action Pack on non-HTML responses
Action: Upgrade actionpack to 6.1.7.8 or later.
bundle update actionpackAffected
| introduced | fixed | last affected |
|---|---|---|
| 6.1.0 | 6.1.7.8 | - |
| 7.0.0 | 7.0.8.4 | - |
| 7.1.0 | 7.1.3.4 | - |
| 7.2.0.beta1 | 7.2.0.beta2 | - |
Fixed versions
| 6.1.7.8 | 7.0.8.4 | 7.1.3.4 | 7.2.0.beta2 |
Sources
- osv: GHSA-fwhr-88qx-h9g7
- https://github.com/rails/rails/security/advisories/GHSA-fwhr-88qx-h9g7
- https://nvd.nist.gov/vuln/detail/CVE-2024-28103
- https://github.com/rails/rails/commit/35858f1d9d57f6c4050a8d9ab754bd5d088b4523
- https://github.com/rails/rails
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-28103.yml
- https://security.netapp.com/advisory/ntap-20241206-0002
CVE-2024-28103 · published · modified · JSON