[DRE-maint] Bug#1024274: rails: CVE-2022-3704: XSS within Route Error Page

[Lucas Nussbaum]

On 16/11/22 at 22:42 +0100, Salvatore Bonaccorso wrote:
> Source: rails
> Version: 2:6.1.7+dfsg-2
> Severity: important
> Tags: security upstream
> Forwarded: https://github.com/rails/rails/issues/46244
> X-Debbugs-Cc: carnil at debian.org, Debian Security Team <team at security.debian.org>
> 
> Hi,
> 
> The following vulnerability was published for rails.
> 
> CVE-2022-3704[0]:
> | A vulnerability classified as problematic has been found in Ruby on
> | Rails. This affects an unknown part of the file actionpack/lib/action_
> | dispatch/middleware/templates/routes/_table.html.erb. The manipulation
> | leads to cross site scripting. It is possible to initiate the attack
> | remotely. The name of the patch is
> | be177e4566747b73ff63fd5f529fab564e475ed4. It is recommended to apply a
> | patch to fix this issue. The associated identifier of this
> | vulnerability is VDB-212319.
> 
> 
> If you fix the vulnerability please also make sure to include the
> CVE (Common Vulnerabilities & Exposures) id in your changelog entry.
> 
> For further information see:
> 
> [0] https://security-tracker.debian.org/tracker/CVE-2022-3704
>     https://www.cve.org/CVERecord?id=CVE-2022-3704
> [1] https://github.com/rails/rails/issues/46244
> [2] https://github.com/rails/rails/commit/be177e4566747b73ff63fd5f529fab564e475ed4
> 
> Please adjust the affected versions in the BTS as needed.

Hi,

The validity of this CVE has been contested by the rails team.
See last comment on https://github.com/rails/rails/issues/46244

It was fixed upstream in the 6.1 stable branch, but NOT in the 6.1.7.X
security releases. See
https://github.com/rails/rails/commit/1593b13665a62a49a4a5e15992e347227ea2cfdd

I think that we should stick with the rails team analysis on this CVE
and not backport the fix.

Lucas