CVE-2018-16477

Name	CVE-2018-16477
Description	A bypass vulnerability in Active Storage >= 5.2.0 for Google Cloud Storage and Disk services allow an attacker to modify the `content-disposition` and `content-type` parameters which can be used in with HTML files and have them executed inline. Additionally, if combined with other techniques such as cookie bombing and specially crafted AppCache manifests, an attacker can gain access to private signed URLs within a specific storage path. This vulnerability has been fixed in version 5.2.1.1.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub code/issues, web search, more)
NVD severity	medium
Debian Bugs	914848

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rails (PTS)	stretch	2:4.2.7.1-1+deb9u2	fixed
	stretch (security)	2:4.2.7.1-1+deb9u5	fixed
	buster, buster (security)	2:5.2.2.1+dfsg-1+deb10u3	fixed
	bullseye	2:6.0.3.7+dfsg-2	fixed
	bookworm, sid	2:6.1.4.1+dfsg-8	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Debian Bugs
rails	source	jessie	(not affected)
rails	source	stretch	(not affected)
rails	source	(unstable)	2:5.2.2+dfsg-1	914848

Notes

[stretch] - rails <not-affected> (Only affects >= 5.2.0; vulnerable code not present)
[jessie] - rails <not-affected> (Only affects >= 5.2.0; vulnerable code not present)
https://www.openwall.com/lists/oss-security/2018/11/27/5
Originally no version was affected until 2:5.2.0+dfsg-2 was uploaded to unstable.