Critical Rails Active Storage flaw patched; Socket offers free interim fix
CRITICAL · VULNERABILITYImageMagickredteam/daily · 1 source
- Severity
- Critical
- Sources
- 1
What happened
Ruby on Rails, a popular framework for building websites, has fixed 21 security issues, including a serious one that lets attackers upload files to a server without logging in. In some setups this could also expose secret data and let attackers run their own code on the server. Socket has released a free temporary fix for teams that cannot update straight away.
Like I’m new · Written by AI from 1 source · Wrong?
What to do
- Upgrade Ruby on Rails to 8.1.4.1, or to 8.0.5.2 if remaining on the 8.0 series.
- Update MiniMagick to version 5.1 or later if the application uses :minimagick.
- Apply Socket's free Certified Patch for GHSA-f3w6-w445-fwh9 if an immediate Rails upgrade is not practical.
- Rotate potentially exposed credentials for applications using Active Storage's Disk service.
Written by AI from the sources, checked against them
Full story timeline · 1 update
Who reported · 1 outlet
Socket Blog
Who and what is in it
Companies