Critical · 1 source · latest 6h

Critical Rails Active Storage flaw patched; Socket offers free interim fix

CRITICAL · VULNERABILITYImageMagickredteam/daily · 1 source

Severity: Critical
Sources: 1

What happened

Ruby on Rails has released security updates for 21 vulnerabilities, including a critical flaw in Active Storage that allows unauthenticated arbitrary file writes and, under some configurations, file reads that could lead to remote code execution. The issue affects apps that use ImageMagick through MiniMagick and accept untrusted uploads, and exploitation does not need a separate preview step. Socket has released a free Certified Patch as an interim option for teams that cannot upgrade immediately.

For IT people · Written by AI from 1 source · Wrong?

What to do

Upgrade Ruby on Rails to 8.1.4.1, or to 8.0.5.2 if remaining on the 8.0 series.
Update MiniMagick to version 5.1 or later if the application uses :minimagick.
Apply Socket's free Certified Patch for GHSA-f3w6-w445-fwh9 if an immediate Rails upgrade is not practical.
Rotate potentially exposed credentials for applications using Active Storage's Disk service.

Written by AI from the sources, checked against them

Read the full story at the source