CVE-2015-7576

The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.

The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not use a constant-time algorithm for verifying credentials, which makes it easier for remote attackers to bypass authentication by measuring timing differences.

This update for rubygem-activesupport-4_2 fixes the following issues:

• CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller (bsc#963329)
• CVE-2016-0753: Input Validation Circumvention (bsc#963334)

This update for rubygem-actionpack-4_2 fixes the following issues:

• CVE-2016-0751: Object Leak DoS (bsc#963331)
• CVE-2015-7581: unbounded memory growth DoS via wildcard controller routes (bsc#963335)
• CVE-2016-0752: directory traversal and information leak in Action View (bsc#963332)
• CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller (bsc#963329)

This update for rubygem-activesupport-4_1 fixes the following issues:

• CVE-2016-0753: Input Validation Circumvention (bsc#963334)
• CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller (bsc#963329)

This update for rubygem-actionpack-3_2 fixes the following issues:

• CVE-2016-0751: Object Leak DoS (bsc#963331)
• CVE-2016-0752: Directory traversal and information leak in Action View (bsc#963332)
• CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller (bsc#963329)

This update for rubygem-activesupport-3_2 fixes the following issues:

• CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller (bsc#963329)

This update for rubygem-activesupport-4_1 fixes the following issues:

The previous security patch for CVE-2015-7576 was adding a new file but this file was not being added in the gemspec, thus the resulting gem didn't have it. This update includes the patch in the gem file too.

This update for rubygem-actionpack-4_1 fixes the following issues:

• CVE-2016-0751: Object Leak DoS (bsc#963331)
• CVE-2015-7581: unbounded memory growth DoS via wildcard controller routes (bsc#963335)
• CVE-2016-0752: directory traversal and information leak in Action View (bsc#963332)
• CVE-2015-7576: Timing attack vulnerability in basic authentication in Action Controller (bsc#963329)

This update for rubygem-activesupport-3_2 fixes the following issues:

The previous patch for CVE-2015-7576 was adding the file lib/active_support/security_utils.rb but this file was not being added into the gemspec,thus the final gem did not contain that file.

Portus was updated to version 2.0.3, which brings several fixes and enhancements:

• Fixed crono job when a repository could not be found.
• Fixed compatibility issues with Docker 1.10 and Distribution 2.3.
• Handle multiple scopes in token requests.
• Add optional fields to token response.
• Fixed notification events for Distribution v2.3.
• Paginate through the catalog properly.
• Do not remove all the repositories if fetching one fails.
• Fixed SMTP setup.
• Don't let crono overflow the 'log' column on the DB.
• Show the actual LDAP error on invalid login.
• Fixed the location of crono logs.
• Always use relative paths.
• Set RUBYLIB when using portusctl.
• Don't count hidden teams on the admin panel.
• Warn developers on unsupported docker-compose versions.
• Directly invalidate LDAP logins without name and password.
• Don't show the 'I forgot my password' link on LDAP.

The following Rubygems bundled within Portus have been updated to fix security issues:

• CVE-2016-2098: rubygem-actionpack (bsc#969943).
• CVE-2015-7578: rails-html-sanitizer (bsc#963326).
• CVE-2015-7579: rails-html-sanitizer (bsc#963327).
• CVE-2015-7580: rails-html-sanitizer (bsc#963328).
• CVE-2015-7576: rubygem-actionpack, rubygem-activesupport (bsc#963563).
• CVE-2015-7577: rubygem-activerecord (bsc#963604).
• CVE-2016-0751: rugygem-actionpack (bsc#963627).
• CVE-2016-0752: rubygem-actionpack, rubygem-actionview (bsc#963608).
• CVE-2016-0753: rubygem-activemodel, rubygem-activesupport, rubygem-activerecord (bsc#963617).
• CVE-2015-7581: rubygem-actionpack (bsc#963625).

This update provides SUSE Studio Runner 1.3.14, which brings fixes for the following issues:

• bsc#968797: 11 SP3 appliance gets invalid distribution upgrade from SLMS.
• bsc#947225: Second build of appliance will not register to SLMS, wrong product name.
• bsc#983404: UEFI boot missing for SLE11 SP4.
• bsc#972406: Kiwi export config.sh script has /build-custom out of order.
• bsc#981095: Add user 'ldap' to default_users list for assigning owners for overlay files.
• bsc#972425: Runlevel 3 is being ignored in appliance configuration.
• bsc#983999: SLES 12 appliance build does not include gpg keys from base product.
• bsc#979110: SLES 12 will not build for EC2.
• bsc#929102: Plaintext Password Local Disclosure in rubygem-rest-client. (CVE-2015-3448)
• bsc#963741: Security fixes for Rails v3.2.22. (CVE-2015-7576, CVE-2015-7577, CVE-2016-0751, CVE-2016-0752)