{"id":"CVE-2024-28103","aliases":["BIT-rails-2024-28103","DEBIAN-CVE-2024-28103","DSA-5881-1","EUVD-2024-2044","GHSA-fwhr-88qx-h9g7","OESA-2024-1708","OESA-2024-1709","OESA-2024-1710","SUSE-SU-2024:1973-1","SUSE-SU-2024:1974-1","SUSE-SU-2024:1986-1","SUSE-SU-2024:2140-1","UBUNTU-CVE-2024-28103","openSUSE-SU-2024:14067-1","openSUSE-SU-2024:14074-1","openSUSE-SU-2024:14110-1","openSUSE-SU-2025:15110-1","openSUSE-SU-2025:15124-1"],"status":"published","title":"Action Pack is missing security headers on non-HTML responses","description":"Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in  6.1.7.8, 7.0.8.2, and 7.1.3.3.","severity":{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-09","score":0.00658,"percentile":0.51762,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-20"],"published":"2024-06-04T19:47:44Z","modified":"2026-11-02T12:02:12Z","fixes":[{"ecosystem":"RubyGems","package":"actionpack","fixed_in":["6.1.7.8","7.0.8.4","7.1.3.4","7.2.0.beta2"],"sources":["ghsa","osv"]},{"ecosystem":"Bitnami","package":"rails","fixed_in":["6.1.8","7.0.9","7.1.4"],"sources":["osv"]},{"ecosystem":"Debian:12","package":"rails","fixed_in":["2:6.1.7.10+dfsg-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rails","fixed_in":["2:7.2.2.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rails","fixed_in":["2:7.2.2.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"rubygem-actionpack","fixed_in":["6.1.4.1-5.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP3","package":"rubygem-actionpack","fixed_in":["6.1.4.1-5.oe2203sp3"],"sources":["osv"]},{"ecosystem":"openEuler:24.03-LTS","package":"rubygem-actionpack","fixed_in":["7.0.7-3.oe2403"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"rmt-server","fixed_in":["2.17-150200.3.45.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"rmt-server","fixed_in":["2.17-150200.3.45.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"rmt-server","fixed_in":["2.17-150200.3.45.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"rmt-server","fixed_in":["2.17-150200.3.45.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"rmt-server","fixed_in":["2.17-150500.3.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"rmt-server","fixed_in":["2.17-150500.3.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"rmt-server","fixed_in":["2.17-150500.3.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"rmt-server","fixed_in":["2.17-150500.3.16.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"rmt-server","fixed_in":["2.17-150500.3.16.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.6","package":"rmt-server","fixed_in":["2.17-150500.3.16.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"rmt-server","fixed_in":["2.17-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"rmt-server","fixed_in":["2.17-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"rmt-server","fixed_in":["2.17-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"rmt-server","fixed_in":["2.17-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"rmt-server","fixed_in":["2.17-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Proxy 4.3","package":"rmt-server","fixed_in":["2.17-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Manager Server 4.3","package":"rmt-server","fixed_in":["2.17-150400.3.25.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP3","package":"rmt-server","fixed_in":["2.17-150300.3.37.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"rmt-server","fixed_in":["2.17-150300.3.37.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"rmt-server","fixed_in":["2.17-150300.3.37.1"],"sources":["osv"]},{"ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"rmt-server","fixed_in":["2.17-150300.3.37.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 7.1","package":"rmt-server","fixed_in":["2.17-150300.3.37.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rmt-server","fixed_in":["2.18-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"fixed":"6.1.7.8"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.8.4"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0"},{"fixed":"7.1.3.4"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.2.0.beta1"},{"last_affected":"7.2.0.beta1"},{"fixed":"7.2.0.beta2"}]}],"versions":["7.2.0.beta1"]},{"source":"osv","ecosystem":"Bitnami","package":"rails","ranges":[{"type":"SEMVER","events":[{"introduced":"6.1.0"},{"fixed":"6.1.8"},{"introduced":"7.0.0"},{"fixed":"7.0.9"},{"introduced":"7.1.0"},{"fixed":"7.1.4"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.1.7.10+dfsg-1~deb12u1"}]}],"versions":["2:6.1.7.3+dfsg-1","2:6.1.7.3+dfsg-10","2:6.1.7.3+dfsg-11","2:6.1.7.3+dfsg-12","2:6.1.7.3+dfsg-13","2:6.1.7.3+dfsg-2","2:6.1.7.3+dfsg-2~deb12u1","2:6.1.7.3+dfsg-3","2:6.1.7.3+dfsg-4","2:6.1.7.3+dfsg-5","2:6.1.7.3+dfsg-6","2:6.1.7.3+dfsg-7","2:6.1.7.3+dfsg-7~exp1","2:6.1.7.3+dfsg-8","2:6.1.7.3+dfsg-9"]},{"source":"osv","ecosystem":"Debian:13","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.2.2.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.2.2.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.1.7.10+dfsg-1~deb12u1"}]}],"versions":["2:6.1.7.3+dfsg-1","2:6.1.7.3+dfsg-10","2:6.1.7.3+dfsg-11","2:6.1.7.3+dfsg-12","2:6.1.7.3+dfsg-13","2:6.1.7.3+dfsg-2","2:6.1.7.3+dfsg-2~deb12u1","2:6.1.7.3+dfsg-3","2:6.1.7.3+dfsg-4","2:6.1.7.3+dfsg-5","2:6.1.7.3+dfsg-6","2:6.1.7.3+dfsg-7","2:6.1.7.3+dfsg-7~exp1","2:6.1.7.3+dfsg-8","2:6.1.7.3+dfsg-9"],"bundled":9},{"source":"osv","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"6.1.0"},{"fixed":"6.1.7.8"}]}],"versions":["6.1.0","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.2","6.1.7.3","6.1.7.4","6.1.7.5","6.1.7.6","6.1.7.7"]},{"source":"osv","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.8.4"}]}],"versions":["7.0.0","7.0.1","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7","7.0.7.1","7.0.7.2","7.0.8","7.0.8.1","7.0.8.2","7.0.8.3"]},{"source":"osv","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.1.0"},{"fixed":"7.1.3.4"}]}],"versions":["7.1.0","7.1.1","7.1.2","7.1.3","7.1.3.1","7.1.3.2","7.1.3.3"]},{"source":"osv","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.2.0.beta1"},{"fixed":"7.2.0.beta2"}]}],"versions":["7.2.0.beta1"]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4.1-5.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP3","package":"rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4.1-5.oe2203sp3"}]}]},{"source":"osv","ecosystem":"openEuler:24.03-LTS","package":"rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.7-3.oe2403"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP2","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150200.3.45.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP2-LTSS","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150200.3.45.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP2-LTSS","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150200.3.45.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP2","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150200.3.45.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP5","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150500.3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP6","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150500.3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP5","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150500.3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Server Applications 15 SP6","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150500.3.16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150500.3.16.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.6","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150500.3.16.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP4","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-ESPOS","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP4-LTSS","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP4-LTSS","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP4","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Proxy 4.3","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Manager Server 4.3","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150400.3.25.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Public Cloud 15 SP3","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150300.3.37.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise High Performance Computing 15 SP3-LTSS","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150300.3.37.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server 15 SP3-LTSS","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150300.3.37.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Server for SAP Applications 15 SP3","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150300.3.37.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 7.1","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.17-150300.3.37.1"}]}]},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.1.10-1","2:4.2.5-1","2:4.2.5.1-1","2:4.2.5.2-2","2:4.2.6-1","2:4.2.6-1ubuntu0.1~esm1","2:4.2.6-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.2.9-2","2:4.2.9-4","2:4.2.10-0ubuntu4","2:4.2.10-0ubuntu4+esm1","2:4.2.10-0ubuntu4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:5.2.2.1+dfsg-1ubuntu1","2:5.2.3+dfsg-3","2:5.2.3+dfsg-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.0.3.7+dfsg-2","2:6.1.4.1+dfsg-8ubuntu2","2:6.1.4.1+dfsg-8ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.1.7.3+dfsg-2build1","2:6.1.7.3+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.1.7.3+dfsg-7","2:7.2.2.1+dfsg-7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:7.2.3+dfsg-2","2:7.2.3.2+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:7.2.2.1+dfsg-7","2:7.2.2.2+dfsg-2","2:7.2.3+dfsg-2"]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-actionpack-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8.4-1.1"}]}],"bundled":6},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rails-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8.4-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rmt-server","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.18-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-actionpack-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8.6-1.3"}]}],"bundled":8},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rails-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8.6-1.3"}]}],"bundled":8}],"products":[{"vendor":"rails","product":"rails"},{"vendor":"rubyonrails","product":"rails"}],"references":[{"url":"https://github.com/rails/rails/security/advisories/GHSA-fwhr-88qx-h9g7","tags":["x_refsource_CONFIRM","x_transferred","Vendor Advisory","web","advisory","report"]},{"url":"https://github.com/rails/rails/commit/35858f1d9d57f6c4050a8d9ab754bd5d088b4523","tags":["x_refsource_MISC","x_transferred","Patch","web","fix","report"]},{"url":"https://security.netapp.com/advisory/ntap-20241206-0002/","tags":["web","advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-28103","tags":["web","advisory"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2024-28103.yml","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20241206-0002","tags":["web"]},{"url":"https://github.com/advisories/GHSA-fwhr-88qx-h9g7"},{"url":"https://github.com/CVEProject/cvelistV5/tree/main/cves/2024/28xxx/CVE-2024-28103.json","tags":["advisory"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2024-28103","tags":["advisory"]},{"url":"https://github.com/rails/rails","tags":["package"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1708","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1709","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2024-1710","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241973-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1203171","tags":["report"]},{"url":"https://bugzilla.suse.com/1225997","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28103","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241974-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20241986-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2024/suse-su-20242140-1/","tags":["advisory"]},{"url":"https://ubuntu.com/security/CVE-2024-28103","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-28103","tags":["report"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-23633","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22792","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22795","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22797","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38037","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34341","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47887","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3C5WPU2RXUSPKAI3EANLIGCY34ZDBZ4Y/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47889","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2024-28103","title":"Action Pack is missing security headers on non-HTML responses","description":"Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in  6.1.7.8, 7.0.8.2, and 7.1.3.3.","status":"published","published":"2024-06-04T19:47:44.199Z","modified":"2024-12-06T13:09:28.269Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"cna"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:34:18.951288Z"}],"euvd":[{"id":"EUVD-2024-2044","description":"Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in  6.1.7.8, 7.0.8.2, and 7.1.3.3.","status":"published","published":"2024-06-04T19:47:44Z","modified":"2024-12-06T13:09:28Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-03T00:04:39.149757Z"}],"ghsa":[{"id":"GHSA-fwhr-88qx-h9g7","title":"Missing security headers in Action Pack on non-HTML responses","description":"# Permissions-Policy is Only Served on HTML Content-Type\n\nThe application configurable Permissions-Policy is only served on responses\nwith an HTML related Content-Type.\n\nThis has been assigned the CVE identifier CVE-2024-28103.\n\n\nVersions Affected:  \u003e= 6.1.0\nNot affected:       \u003c 6.1.0\nFixed Versions:     6.1.7.8, 7.0.8.4, and 7.1.3.4\n\nImpact\n------\nResponses with a non-HTML Content-Type are not serving the configured Permissions-Policy. There are certain non-HTML Content-Types that would benefit from having the Permissions-Policy enforced.\n\n\nReleases\n--------\nThe fixed releases are available at the normal locations.\n\nWorkarounds\n-----------\nN/A\n\nPatches\n-------\nTo aid users who aren't able to upgrade immediately we have provided patches for\nthe supported release series in accordance with our \n[maintenance policy](https://guides.rubyonrails.org/maintenance_policy.html#security-issues)\nregarding security issues. They are in git-am format and consist of a\nsingle changeset.\n\n* 6-1-include-permissions-policy-header-on-non-html.patch - Patch for 6.1 series\n* 7-0-include-permissions-policy-header-on-non-html.patch - Patch for 7.0 series\n* 7-1-include-permissions-policy-header-on-non-html.patch - Patch for 7.1 series\n\n\n\nCredits\n-------\n\nThank you [shinkbr](https://hackerone.com/shinkbr) for reporting this!","status":"published","published":"2024-06-04T22:26:24Z","modified":"2024-12-06T15:32:22Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:38:24.542211Z"}],"nvd":[{"id":"CVE-2024-28103","description":"Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in  6.1.7.8, 7.0.8.2, and 7.1.3.3.","status":"published","published":"2024-06-04T20:15:10.237Z","modified":"2026-06-17T07:20:58.53Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium","assessor":"secondary"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:10:03.465199Z"}],"osv":[{"id":"CVE-2024-28103","title":"Action Pack is missing security headers on non-HTML responses","description":"Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in  6.1.7.8, 7.0.8.2, and 7.1.3.3.","status":"published","published":"2024-06-04T19:47:44.199Z","modified":"2026-10-28T02:30:25.679835163Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:44:39.569658Z"},{"id":"DEBIAN-CVE-2024-28103","description":"Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in  6.1.7.8, 7.0.8.2, and 7.1.3.3.","status":"published","published":"2024-06-04T20:15:10.237Z","modified":"2026-11-02T12:02:12.196455817Z","cvss":[{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T15:45:42.530184Z"},{"id":"GHSA-fwhr-88qx-h9g7","title":"Missing security headers in Action Pack on non-HTML responses","description":"# Permissions-Policy is Only Served on HTML Content-Type\n\nThe application configurable Permissions-Policy is only served on responses\nwith an HTML related Content-Type.\n\nThis has been assigned the CVE identifier CVE-2024-28103.\n\n\nVersions Affected:  \u003e= 6.1.0\nNot affected:       \u003c 6.1.0\nFixed Versions:     6.1.7.8, 7.0.8.4, and 7.1.3.4\n\nImpact\n------\nResponses with a non-HTML Content-Type are not serving the configured Permissions-Policy. There are certain non-HTML Content-Types that would benefit from having the Permissions-Policy enforced.\n\n\nReleases\n--------\nThe fixed releases are available at the normal locations.\n\nWorkarounds\n-----------\nN/A\n\nPatches\n-------\nTo aid users who aren't able to upgrade immediately we have provided patches for\nthe supported release series in accordance with our \n[maintenance policy](https://guides.rubyonrails.org/maintenance_policy.html#security-issues)\nregarding security issues. They are in git-am format and consist of a\nsingle changeset.\n\n* 6-1-include-permissions-policy-header-on-non-html.patch - Patch for 6.1 series\n* 7-0-include-permissions-policy-header-on-non-html.patch - Patch for 7.0 series\n* 7-1-include-permissions-policy-header-on-non-html.patch - Patch for 7.1 series\n\n\n\nCredits\n-------\n\nThank you [shinkbr](https://hackerone.com/shinkbr) for reporting this!","status":"published","published":"2024-06-04T22:26:24Z","modified":"2026-09-10T03:50:15.333571958Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:47.119724Z"},{"id":"OESA-2024-1708","title":"rubygem-actionpack security update","description":"Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn\u0026apos;t require a browser.\r\n\r\nSecurity Fix(es):\r\n\r\nAction Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in  6.1.7.8, 7.0.8.2, and 7.1.3.3.(CVE-2024-28103)","status":"published","published":"2024-06-14T11:07:10Z","modified":"2026-08-18T01:17:24.046851943Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1709","title":"rubygem-actionpack security update","description":"Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn\u0026apos;t require a browser.\r\n\r\nSecurity Fix(es):\r\n\r\nAction Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in  6.1.7.8, 7.0.8.2, and 7.1.3.3.(CVE-2024-28103)","status":"published","published":"2024-06-14T11:07:10Z","modified":"2026-08-18T01:17:24.141752536Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"OESA-2024-1710","title":"rubygem-actionpack security update","description":"Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn\u0026apos;t require a browser.\r\n\r\nSecurity Fix(es):\r\n\r\nAction Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in  6.1.7.8, 7.0.8.2, and 7.1.3.3.(CVE-2024-28103)","status":"published","published":"2024-06-14T11:07:10Z","modified":"2026-08-18T01:17:24.170854188Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"}],"updated_at":"2026-11-02T15:52:41.095407Z"},{"id":"UBUNTU-CVE-2024-28103","description":"Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in  6.1.7.8, 7.0.8.2, and 7.1.3.3.","status":"published","published":"2024-06-04T20:15:00Z","modified":"2026-10-17T12:56:44.430880483Z","cvss":[{"version":"3.1","score":5.4,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:N","level":"medium"},{"version":"3.1","score":9.8,"vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H","level":"critical"}],"updated_at":"2026-11-02T16:54:48.333535Z"},{"id":"BIT-rails-2024-28103","title":"Action Pack is missing security headers on non-HTML responses","description":"Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in  6.1.7.8, 7.0.8.2, and 7.1.3.3.","status":"published","published":"2024-12-20T09:49:58.439Z","modified":"2025-10-06T09:42:16.629521Z","updated_at":"2026-11-02T15:28:35.111822Z"},{"id":"DSA-5881-1","title":"rails - security update","status":"published","published":"2025-03-17T00:00:00Z","modified":"2026-03-09T02:09:54.381319Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"openSUSE-SU-2024:14067-1","title":"ruby3.3-rubygem-actionpack-7.0-7.0.8.4-1.1 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-actionpack-7.0-7.0.8.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-24T00:00:00Z","modified":"2026-02-04T04:00:08.348611Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14074-1","title":"ruby3.3-rubygem-rails-7.0-7.0.8.4-1.1 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-rails-7.0-7.0.8.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-24T00:00:00Z","modified":"2026-02-04T02:52:31.850939Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14110-1","title":"rmt-server-2.18-1.1 on GA media","description":"These are all security issues fixed in the rmt-server-2.18-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-07-05T00:00:00Z","modified":"2026-02-04T03:46:35.728677Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2025:15110-1","title":"ruby3.4-rubygem-actionpack-7.0-7.0.8.6-1.3 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-actionpack-7.0-7.0.8.6-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-17T00:00:00Z","modified":"2026-02-04T02:49:58.777457Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:15124-1","title":"ruby3.4-rubygem-rails-7.0-7.0.8.6-1.3 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-rails-7.0-7.0.8.6-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-17T00:00:00Z","modified":"2026-02-04T03:52:20.531012Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"SUSE-SU-2024:1973-1","title":"Security update for rmt-server","description":"This update for rmt-server fixes the following issues:\n\n\n- Update to version 2.17\n- CVE-2024-28103: Fixed Permissions-Policy that was only served on responses with an HTML related Content-Type. (bsc#1225997)\n  ","status":"published","published":"2024-06-11T07:35:03Z","modified":"2026-02-04T03:47:51.867095Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1974-1","title":"Security update for rmt-server","description":"This update for rmt-server fixes the following issues:\n\n\n- Update to version 2.17\n- CVE-2024-28103: Fixed Permissions-Policy that was only served on responses with an HTML related Content-Type. (bsc#1225997)\n  ","status":"published","published":"2024-06-11T07:35:26Z","modified":"2026-02-04T03:51:43.524702Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:1986-1","title":"Security update for rmt-server","description":"This update for rmt-server fixes the following issues:\n\n\n- Update to version 2.17\n- CVE-2024-28103: Fixed Permissions-Policy that was only served on responses with an HTML related Content-Type. (bsc#1225997)\n  ","status":"published","published":"2024-06-11T11:47:29Z","modified":"2026-02-04T04:06:14.563426Z","updated_at":"2026-11-02T15:53:54.652421Z"},{"id":"SUSE-SU-2024:2140-1","title":"Security update for rmt-server","description":"This update for rmt-server fixes the following issues:\n\n\n- Update to version 2.17\n- CVE-2024-28103: Fixed Permissions-Policy that was only served on responses with an HTML related Content-Type. (bsc#1225997)\n  ","status":"published","published":"2024-06-21T11:34:35Z","modified":"2026-02-04T03:40:59.14621Z","updated_at":"2026-11-02T15:53:55.136363Z"}]}}