Oct 18th 2023, Rack version 1.4.7.17
- Fixed an incompatibility with newer version of the
rack-cache
gem.
Oct 18th 2023, Rails version 3.2.22.44
- Fixed a bug for Ruby 3.1, where it was not possible to use scopes or class methods on scopes with keyword arguments.
July 21st 2023, Rack version 1.4.7.16
Jun 27th 2023, Rails version 3.2.22.43
May 22th 2023, Rails versions 3.2.22.42
- Fixed a potential (non-security) issue with the 3.2.22.40 / 3.2.22.41 release with certain Ruby versions / version of the
uri
gem.
Apr 4th 2023, Rails versions 3.2.22.41
- Fixed a potential issue with the 3.2.22.40 release for certain webserver configurations
Apr 4th 2023, Rails version 3.2.22.40
- Added monkey patches to address ReDoS vulnerabilities in the
time
and uri
stdlibs (CVE-2023-28755, CVE-2023-28756), see
here
Show archive.org snapshot
for more details
- Relaxed
i18n
dependency to allow versions 1.x
. To avoid getting a newer version, add gem 'i18n', '< 1'
to your Gemfile. This has no security implications.
Mar 27th 2023, Rack version 1.4.7.15
- The earlier fix for CVE-2022-44571 was incomplete. This release corrects the issue.
Mar 23rd 2023, Rails version 3.2.22.39
- Added partial mitigation for CVE-2013-3221, which is relevant when querying MySQL string columns with integers. See
here
Show archive.org snapshot
for more details.
Mar 14th 2023: Rails version 3.2.22.38
- Fixed XSS issue with
SafeBuffer#bytesplice
(only on Ruby 3.2, which is not currently supported), see
here
Show archive.org snapshot
for more details.
Mar 14th 2023: Rack version 1.4.7.14
Mar 3rd, 2023: Rails version 3.2.22.37
- We've added the
Rack::TempfileReaper
middleware to the default middleware stack, see below.
Mar 3rd, 2023: Rack version 1.4.7.13
- Backported fix for [CVE-2023-27530] to address a potential DOS attack with rack multipart requests.
- Also backported the
Rack::TempfileReaper
middleware.
- See
here
Show archive.org snapshot
for additional details and a potential breaking change.
Feb 27th, 2023: Rails version 3.2.22.36
- Relaxed version requirement for
rack-ssl
. You can upgrade rack-ssl
to 1.4.x to fix CVE-2014-2538 (a low severity XSS vulnerability that is unlikely to affect a properly configured production instance).
Jan 24th, 2023: Rails version 3.2.22.35
Jan 20th, 2023: Rails version 3.2.22.34
- Fixed multiple ReDoS vulnerabilities in Rails: [CVE-2023-22792], [CVE-2023-22796]
- Fixed a DOS vulnerability in the PostgreSQL adapter for ActiveRecord [CVE-2022-44566]
- See
here
Show archive.org snapshot
for more details
Jan 20th, 2023: Rack version 1.4.7.12
Dec 21st, 2022: Rack version 1.4.7.11
- Fixed an issue that made
rails server
fail with certain web servers on Ruby 3.1.
Dec 13th, 2022: Rails version 3.2.22.33
Dec 13th, 2022: Rack version 1.4.7.10
- Based on our fork of rack.
- Added support for ruby 3.1.
- Includes fixes for CVE-2018-16471, CVE-2020-8161, CVE-2020-8184, CVE-2022-30122, CVE-2022-30123, CWE-444, CWE-290.
- More info
Aug 19th, 2022: Version 3.2.22.32
- Removed "rdoc" dependency, since some rdoc versions depend on a vulnerable version of the "json" gem
Jul 21st, 2022: Version 3.2.22.31
Jul 14th, 2022: Version 3.2.22.30
- Merged upstream bug fix for [CVE-2022-32224] Possible RCE escalation bug with Serialized Columns in Active Record. We tried to make it less of a breaking change than the official patch by adding a default set of permitted serializable classes. Note this patch has no effect for Rubies < 2.1 see details
May 18th, 2022: Version 3.2.22.29
Apr 27th, 2022: Version 3.2.22.28
Mar 11th, 2022: Version 3.2.22.27
- Relaxed version requirement for bycrypt. Old bcrypt versions have issues on some newer Linux distros, but it was not possible to update to a fixed version. With this version of 3.2 LTS, you can now set bcrypt-ruby to
~> 3.0
in your Gemfile and do a bundle upgrade bcrypt-ruby
with Rails complaining.
Dec 21st, 2021: Version 3.2.22.26
- Improved compatibility with newer Postgresql Versions. 3.2 LTS should now work with Postgresql up to version 14.
Sep 14th, 2021: Version 3.2.22.25
- Relaxed requirement for Bundler. It is now possible to use Rails 3.2 LTS with Bundler 2 (given a compatible version of Ruby and Rubygems).
Mar 06th, 2021: Version 3.2.22.24
Feb 11th, 2021: Version 3.2.22.23 (bugfix release)
- Fixed a "cannot modify frozen string" with params parsing in Ruby 2.7 (does not seem to occur with usual configuration).
- Reduce occurance of some deprecation warnings. We still recommend to use Ruby 2.7.2 which has these warning disabled by default.
Jan 27th, 2021: Version 3.2.22.22
Jan 25th, 2021: Version 3.2.22.21
- Added Ruby 2.7 compatibility.
Sep 10th, 2020: Version 3.2.22.20
Jun 17th, 2020: Announcement regarding CVE-2020-8184
May 19th, 2020: Version 3.2.22.19
May 16th, 2020: Version 3.2.22.18
May 15th, 2020: Announcement regarding CVE-2020-8161 and CVE-2018-16471
May 07th, 2020: Version 3.2.22.17
May 06th, 2020: Version 3.2.22.16
Mar 20th, 2020: Version 3.2.22.15
Dec 22nd, 2019: Version 3.2.22.14
Mar 22nd, 2019: Amendment to CVE-2019-5418
- The previously reported CVE 2019-5418 has been upgraded to possible remote code execution. Rails LTS 3.2.22.13 protects your application against this exploit.
Mar 14th, 2019: Version 3.2.22.13
- Backport fixes for ActionView format / MIME type parsing (CVE-2019-5418 and CVE-2019-5419) (
see details
Show archive.org snapshot
)
- Confirmed that 3.2 LTS is not affected by CVE-2019-5420.
Jan 30th, 2019: Version 3.2.22.12
- Fix a crash in
rake db:structure:dump
(and sometimes rake db:migrate
) when using a modern postgresql installation.
Jan 23rd, 2019: Version 3.2.22.11
- Add compatibility for Ruby 2.5.
Aug 27th, 2018: Version 3.2.22.10
Jun 21st, 2018: Version 3.2.22.9
Require sprockets version 2.2.3, since 2.2.1 and 2.2.2 are vulnerable to an information leak attack.
More Details
Show archive.org snapshot
In our own investigations we found that Sprockets 2.2.3 is not vulnerable to CVE-2018-3760, despite the original advisory claiming so. Since no fixed sprockets versions were compatible with Rails 3.2, we've decided to freeze the dependency to 2.2.3, which has no vulnerability known to us.
Mar 20th, 2018: Not affected by sanitization CVEs
A vulnerability was disclosed for some Ruby sanitization gems like loofah (
CVE-2018-8048
Show archive.org snapshot
) and sanitize (
CVE-2018-3740
Show archive.org snapshot
). This also affects recent Rails versions, whose sanitize()
helper depends on loofah.
We have confirmed that the sanitize()
helper in Rails 3.2 is not affected by this issue.
Note that if your application uses one of the affected gems directly, you may still be affected and should update to the latest version of these gems.
Jan 16th, 2017: Version 3.2.22.8
Merged Ruby 2.3 compatibility fixes from the rails/3-2-stable branch.
Ruby 2.3 is now officially supported.
Aug 12th, 2016: Version 3.2.22.7
Merged a fix from the rails/3-2-stable branch:
Mar 1st, 2016: Version 3.2.22.6
- Change to the rails gemspec, to prevent Bundler from installing outdated rails versions under rare circumstances
- Functionally identical to 3.2.22.5.
Mar 1st, 2016: Version 3.2.22.5
More Details
Show archive.org snapshot
Jan 26th, 2016: Version 3.2.22.4
Merged several security fixes from the rails/3-2-stable branch, that include
Additionally backported the following:
More Details
Show archive.org snapshot
November 2nd, 2015: Version 3.2.22.3
- Add support for private gem servers.
June 17th, 2015: Version 3.2.22.2
June 17th, 2015: Version 3.2.22.1
- Ruby 2.2 compatibility
- Fix test suite
December 10th, 2014: Version 3.2.21.1