CVE-2007-5379

NameCVE-2007-5379
DescriptionRails before 1.2.4, as used for Ruby on Rails, allows remote attackers and ActiveResource servers to determine the existence of arbitrary files and read arbitrary XML files via the Hash.from_xml (Hash#from_xml) method, which uses XmlSimple (XML::Simple) unsafely, as demonstrated by reading passwords from the Pidgin (Gaim) .purple/accounts.xml file.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
rails (PTS)buster2:5.2.2.1+dfsg-1+deb10u3fixed
buster (security)2:5.2.2.1+dfsg-1+deb10u5fixed
bullseye2:6.0.3.7+dfsg-2fixed
bookworm2:6.1.7+dfsg-2fixed
sid2:6.1.7+dfsg-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
railssourceetch(not affected)
railssource(unstable)1.2.5-1

Notes

[etch] - rails <not-affected> (Vulnerable code not present)

Search for package or bug name: Reporting problems