CVE-2018-16477

Name	CVE-2018-16477
Description	A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-disposition` and `content-type` parameters which can be used in with HTML files and have them executed inline. Additionally, if combined with other techniques such as cookie bombing and specially crafted AppCache manifests, an attacker can gain access to private signed URLs within a specific storage path. This vulnerability has been fixed in version 5.2.1.1.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium (attack range: remote)
Debian Bugs	914848

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rails (PTS)	jessie	2:4.1.8-1+deb8u4	fixed
	jessie (security)	2:4.1.8-1+deb8u5	fixed
	stretch	2:4.2.7.1-1+deb9u1	fixed
	buster	2:5.2.2.1+dfsg-1	fixed
	bullseye, sid	2:5.2.3+dfsg-1	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Urgency	Debian Bugs
rails	source	(unstable)	2:5.2.2+dfsg-1	medium	914848
rails	source	jessie	(not affected)
rails	source	stretch	(not affected)

Notes

[stretch] - rails <not-affected> (Only affects >= 5.2.0; vulnerable code not present)
[jessie] - rails <not-affected> (Only affects >= 5.2.0; vulnerable code not present)
https://www.openwall.com/lists/oss-security/2018/11/27/5
Originally no version was affected until 2:5.2.0+dfsg-2 was uploaded to unstable.