204 Rails 3.2 LTS Changelog

October 17th 2024, Rails version 3.2.22.48

Fixed ReDoS vulnerabilities CVE-2024-41128 and CVE-2024-47889. Read the announcement Show archive.org snapshot .

May 14th 2024, Rails version 3.2.22.47

Added support for Ruby 3.3. See our upgrade guide.

May 14th 2024, Rack version 1.4.7.19

Added support for Ruby 3.3. See our upgrade guide.

Feb 23rd 2024, Rack version 1.4.7.18

Fixed DoS vulnerabilities CVE-2024-25126 and CVE-2024-26141, see here Show archive.org snapshot for more details.

Feb 23rd 2024, Rails version 3.2.22.46

Fixed a regression for CVE-2013-0269, CVE-2020-10663 introducing a vulnerability for JSON.parse on Ruby version 2.7+, see here Show archive.org snapshot for more details. Thanks to Severin Schoepke for bringing this to our attention.

Feb 19th 2024, Rails version 3.2.22.45

Relaxed requirement on the mysql2 gem to allow Rails LTS to work with mysql2 version 0.5.6+.

Oct 18th 2023, Rack version 1.4.7.17

Fixed an incompatibility with newer version of the rack-cache gem.

Oct 18th 2023, Rails version 3.2.22.44

Fixed a bug for Ruby 3.1, where it was not possible to use scopes or class methods on scopes with keyword arguments.

July 21st 2023, Rack version 1.4.7.16

The fix for CWE-444 (a potential cache poisoning attack; see https://github.com/rack/rack/issues/1732 Show archive.org snapshot for an explanation) has been lost in an earlier Rack release. It is now reinstanted.

Jun 27th 2023, Rails version 3.2.22.43

Fixed a possible XSS vulnerability via User Supplied Values to redirect_to (CVE-2023-28362), see here Show archive.org snapshot for more details

May 22th 2023, Rails versions 3.2.22.42

Fixed a potential (non-security) issue with the 3.2.22.40 / 3.2.22.41 release with certain Ruby versions / version of the uri gem.

Apr 4th 2023, Rails versions 3.2.22.41

Fixed a potential issue with the 3.2.22.40 release for certain webserver configurations

Apr 4th 2023, Rails version 3.2.22.40

Added monkey patches to address ReDoS vulnerabilities in the time and uri stdlibs (CVE-2023-28755, CVE-2023-28756), see here Show archive.org snapshot for more details
Relaxed i18n dependency to allow versions 1.x. To avoid getting a newer version, add gem 'i18n', '< 1' to your Gemfile. This has no security implications.

Mar 27th 2023, Rack version 1.4.7.15

The earlier fix for CVE-2022-44571 was incomplete. This release corrects the issue.

Mar 23rd 2023, Rails version 3.2.22.39

Added partial mitigation for CVE-2013-3221, which is relevant when querying MySQL string columns with integers. See here Show archive.org snapshot for more details.

Mar 14th 2023: Rails version 3.2.22.38

Fixed XSS issue with SafeBuffer#bytesplice (CVE-2023-28120, only on Ruby 3.2, which is not currently supported), see here Show archive.org snapshot for more details.

Mar 14th 2023: Rack version 1.4.7.14

Backported fix for DOS vulnerability CVE-2023-27539, see here Show archive.org snapshot for more details.

Mar 3rd, 2023: Rails version 3.2.22.37

We've added the Rack::TempfileReaper middleware to the default middleware stack, see below.

Mar 3rd, 2023: Rack version 1.4.7.13

Backported fix for [CVE-2023-27530] to address a potential DOS attack with rack multipart requests.
Also backported the Rack::TempfileReaper middleware.
See here Show archive.org snapshot for additional details and a potential breaking change.

Feb 27th, 2023: Rails version 3.2.22.36

Relaxed version requirement for rack-ssl. You can upgrade rack-ssl to 1.4.x to fix CVE-2014-2538 (a low severity XSS vulnerability that is unlikely to affect a properly configured production instance).

Jan 24th, 2023: Rails version 3.2.22.35

Bugfix for an issue with cookie domains introduced by [CVE-2023-22792]. Please read the details Show archive.org snapshot , if you had 3.2.22.34 running in production.

Jan 20th, 2023: Rails version 3.2.22.34

Fixed multiple ReDoS vulnerabilities in Rails: [CVE-2023-22792], [CVE-2023-22796]
Fixed a DOS vulnerability in the PostgreSQL adapter for ActiveRecord [CVE-2022-44566]
- ActiveRecord will now throw an exception, if you pass an integer > 64bit. You can opt out using
```
config.active_record.raise_int_wider_than_64bit = false
```
See here Show archive.org snapshot for more details

Jan 20th, 2023: Rack version 1.4.7.12

Fixed multiple ReDos vulnerabilites in Rack: [CVE-2022-44570], [CVE-2022-44571]
See here Show archive.org snapshot for more details

Dec 21st, 2022: Rack version 1.4.7.11

Fixed an issue that made rails server fail with certain web servers on Ruby 3.1.

Dec 13th, 2022: Rails version 3.2.22.33

Added compatibility for Ruby 3.1.
Fix a compatbility issue with mysql2 version 0.5 (you probably still want to use our fork of 0.3.x Show archive.org snapshot .

Dec 13th, 2022: Rack version 1.4.7.10

Based on our fork of rack.
Added support for ruby 3.1.
Includes fixes for CVE-2018-16471, CVE-2020-8161, CVE-2020-8184, CVE-2022-30122, CVE-2022-30123, CWE-444, CWE-290.
More info

Aug 19th, 2022: Version 3.2.22.32

Removed "rdoc" dependency, since some rdoc versions depend on a vulnerable version of the "json" gem

Jul 21st, 2022: Version 3.2.22.31

Updated required tzinfo version to address CVE-2022-31163; see details Show archive.org snapshot

Jul 14th, 2022: Version 3.2.22.30

Merged upstream bug fix for [CVE-2022-32224] Possible RCE escalation bug with Serialized Columns in Active Record. We tried to make it less of a breaking change than the official patch by adding a default set of permitted serializable classes. Note this patch has no effect for Rubies < 2.1 see details

May 18th, 2022: Version 3.2.22.29

Bug fix for recent security fix for CVE-2022-27777; see details Show archive.org snapshot .

Apr 27th, 2022: Version 3.2.22.28

Backported fix for possible XSS vulnerabilities via content_tag or tag helpers (CVE-2022-27777); see details Show archive.org snapshot .

Mar 11th, 2022: Version 3.2.22.27

Relaxed version requirement for bycrypt. Old bcrypt versions have issues on some newer Linux distros, but it was not possible to update to a fixed version. With this version of 3.2 LTS, you can now set bcrypt-ruby to ~> 3.0 in your Gemfile and do a bundle upgrade bcrypt-ruby with Rails complaining.

Dec 21st, 2021: Version 3.2.22.26

Improved compatibility with newer Postgresql Versions. 3.2 LTS should now work with Postgresql up to version 14.

Sep 14th, 2021: Version 3.2.22.25

Relaxed requirement for Bundler. It is now possible to use Rails 3.2 LTS with Bundler 2 (given a compatible version of Ruby and Rubygems).

Mar 06th, 2021: Version 3.2.22.24

Fixed an information disclosure / unexpected method invocation vulnerability in Action Pack (CVE-2021-22885), see details Show archive.org snapshot
This contains a breaking change.

Feb 11th, 2021: Version 3.2.22.23 (bugfix release)

Fixed a "cannot modify frozen string" with params parsing in Ruby 2.7 (does not seem to occur with usual configuration).
Reduce occurance of some deprecation warnings. We still recommend to use Ruby 2.7.2 which has these warning disabled by default.

Jan 27th, 2021: Version 3.2.22.22

Fixed regression in #translate helper, see details Show archive.org snapshot .

Jan 25th, 2021: Version 3.2.22.21

Added Ruby 2.7 compatibility.

Sep 10th, 2020: Version 3.2.22.20

Backported fix for potential XSS vulnerability in Action View (CVE-2020-15169), see details Show archive.org snapshot .

Jun 17th, 2020: Announcement regarding CVE-2020-8184

No Rails 3.2 LTS release was necessary.
We backported the patch to our forked Show archive.org snapshot version of rack 1.4.

May 19th, 2020: Version 3.2.22.19

Addressed "Potentially unintended unmarshalling of user-provided objects in MemCacheStore" [CVE-2020-8165] Show archive.org snapshot .
Note that potential code changes are needed, see here for details Show archive.org snapshot

May 16th, 2020: Version 3.2.22.18

Backported fix for potential remote code execution of user-provided local names CVE-2020-8163 Show archive.org snapshot , see details Show archive.org snapshot .

May 15th, 2020: Announcement regarding CVE-2020-8161 and CVE-2018-16471

No Rails 3.2 LTS release was necessary.
We forked rack Show archive.org snapshot to backport CVE-2020-8161 Show archive.org snapshot .
For more information read our advisory Show archive.org snapshot .

May 07th, 2020: Version 3.2.22.17

Backported fix for arbitrary file write/potential remote code execution attack in actionpack (CVE-2020-8159), see details Show archive.org snapshot

May 06th, 2020: Version 3.2.22.16

Backported fix for information disclosure vulnerability in Active Resource (CVE-2020-8151), see details Show archive.org snapshot

Mar 20th, 2020: Version 3.2.22.15

Fixed an XSS vulnerability in #escape_javascript (CVE-2020-5267), see details Show archive.org snapshot .
Fixed additional XSS vulnerabilities in #escape_javascript and #escape_json, see details Show archive.org snapshot

Dec 22nd, 2019: Version 3.2.22.14

Fixed ActiveRecord::SessionStore to not be vulnerable to timing attacks that can lead to session hijacking (CVE-2019-16782). see details Show archive.org snapshot

Mar 22nd, 2019: Amendment to CVE-2019-5418

The previously reported CVE 2019-5418 has been upgraded to possible remote code execution. Rails LTS 3.2.22.13 protects your application against this exploit.

Mar 14th, 2019: Version 3.2.22.13

Backport fixes for ActionView format / MIME type parsing (CVE-2019-5418 and CVE-2019-5419) ( see details Show archive.org snapshot )
Confirmed that 3.2 LTS is not affected by CVE-2019-5420.

Jan 30th, 2019: Version 3.2.22.12

Fix a crash in rake db:structure:dump (and sometimes rake db:migrate) when using a modern postgresql installation.

Jan 23rd, 2019: Version 3.2.22.11

Add compatibility for Ruby 2.5.

Aug 27th, 2018: Version 3.2.22.10

Fixes a DOS vulnerability in activerecord (CVE-2018-15578).

Jun 21st, 2018: Version 3.2.22.9

Require sprockets version 2.2.3, since 2.2.1 and 2.2.2 are vulnerable to an information leak attack. More Details Show archive.org snapshot

In our own investigations we found that Sprockets 2.2.3 is not vulnerable to CVE-2018-3760, despite the original advisory claiming so. Since no fixed sprockets versions were compatible with Rails 3.2, we've decided to freeze the dependency to 2.2.3, which has no vulnerability known to us.

Mar 20th, 2018: Not affected by sanitization CVEs

A vulnerability was disclosed for some Ruby sanitization gems like loofah ( CVE-2018-8048 Show archive.org snapshot ) and sanitize ( CVE-2018-3740 Show archive.org snapshot ). This also affects recent Rails versions, whose sanitize() helper depends on loofah.

We have confirmed that the sanitize() helper in Rails 3.2 is not affected by this issue.

Note that if your application uses one of the affected gems directly, you may still be affected and should update to the latest version of these gems.