Add Rails 8.0.5.2 and 8.1.4.1 advisories

gems/actionmailbox/GHSA-5957-c7qm-m469.yml

@@ -0,0 +1,61 @@
+---
+gem: actionmailbox
+framework: rails
+ghsa: 5957-c7qm-m469
+url: https://github.com/rails/rails/security/advisories/GHSA-5957-c7qm-m469
+title: "Possible signature replay in Action Mailbox Mailgun ingress"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  The Action Mailbox Mailgun ingress authenticates a request with an HMAC of the
+  `timestamp` and `token` parameters concatenated without a separator, and
+  `ActionMailbox::Ingresses::Mailgun::InboundEmailsController::Authenticator#recent?`
+  rejects only timestamps more than 2 minutes in the past. Because the signature
+  does not fix the boundary between the two values, a captured signed request
+  can be presented with a timestamp far in the future, which the ingress then
+  accepts indefinitely. An attacker who obtains one signed Mailgun webhook
+  request, but not the signing key, could submit arbitrary inbound email that
+  Action Mailbox processes as genuine, possibly leading to forged messages
+  attributed to the sender of the attacker's choosing.
+
+  Applications that receive inbound email through the Action Mailbox Mailgun
+  ingress are affected.
+
+  ### Details
+
+  The fixed releases also reject a Mailgun request whose timestamp is more than
+  2 minutes ahead of the server's clock, as they already did for one more than 2
+  minutes behind it. An application whose clock runs more than 2 minutes behind
+  Mailgun's will now reject genuine webhooks and should synchronize its clock.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/c3a295c5c22266e8ec4d0e664e6923a299235e7a.patch
+  - 8.0:
+    https://github.com/rails/rails/commit/4aa2ec66822bc4eb8b341a0608f1c90a3e371a34.patch
+
+  ### Credit
+
+  This issue was responsibly reported by HackerOne researcher
+  [davutselcuk](https://hackerone.com/davutselcuk).
+cvss_v3: 3.7
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/actionmailbox/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/actionmailbox/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/c3a295c5c22266e8ec4d0e664e6923a299235e7a
+    - https://github.com/rails/rails/commit/4aa2ec66822bc4eb8b341a0608f1c90a3e371a34
+    - https://github.com/rails/rails/security/advisories/GHSA-5957-c7qm-m469
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA

gems/actionpack/GHSA-2586-8ghr-69fj.yml

@@ -0,0 +1,62 @@
+---
+gem: actionpack
+framework: rails
+ghsa: 2586-8ghr-69fj
+url: https://github.com/rails/rails/security/advisories/GHSA-2586-8ghr-69fj
+title: "Possible restoration of destroyed sessions in Action Dispatch
+  CacheStore"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  `ActionDispatch::Session::CacheStore` writes a session back to the cache at
+  the end of each request that loaded it, without checking that the session's
+  cache entry still exists. When a concurrent request destroys the session,
+  through `reset_session` on logout or by deleting its cache entry on the
+  server, a request that loaded the session earlier and finishes later restores
+  it under its original session ID. Logout and server-side revocation could
+  therefore fail to end a session, and an attacker who holds a stolen session
+  cookie could keep that session valid across the victim's logout.
+
+  Applications that use `config.session_store :cache_store` are affected, with
+  any cache backend. `ActionDispatch::Session::CookieStore` is not affected, nor
+  is `ActionDispatch::Session::MemCacheStore` with Dalli 4.0.0 or later, whose
+  session store does not write back a session that was deleted.
+
+  ### Details
+
+  The fixed releases record which session a request loaded and skip the write
+  when that session's cache entry no longer exists. Changes that such a request
+  makes to the destroyed session are discarded, and Rack logs a warning that the
+  session could not be saved. Each request that writes back a session it loaded
+  makes one additional cache read.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/d479192cf88a8b30a335a8bc25188a2d8e0f8d9f.patch
+  - 8.0:
+    https://github.com/rails/rails/commit/5bb5ec66ed8faaf590ffe1222d7a5eb6e9d050f5.patch
+
+  ### Credit
+
+  Found by the team during internal code review.
+cvss_v3: 4.2
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/actionpack/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/actionpack/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/d479192cf88a8b30a335a8bc25188a2d8e0f8d9f
+    - https://github.com/rails/rails/commit/5bb5ec66ed8faaf590ffe1222d7a5eb6e9d050f5
+    - https://github.com/rails/rails/security/advisories/GHSA-2586-8ghr-69fj
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA

gems/actionpack/GHSA-2gff-2mmg-m73p.yml

@@ -0,0 +1,99 @@
+---
+gem: actionpack
+framework: rails
+ghsa: 2gff-2mmg-m73p
+url: https://github.com/rails/rails/security/advisories/GHSA-2gff-2mmg-m73p
+title: "Possible IP spoofing in Action Dispatch RemoteIp"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  Since Rails 8.1.0, `ActionDispatch::RemoteIp` derives `request.remote_ip` from
+  `Rack::Request#forwarded_for`, which under Rack 3 reads the RFC 7239
+  `Forwarded` header in preference to `X-Forwarded-For`. When a reverse proxy
+  appends the client address to `X-Forwarded-For` but passes a client-supplied
+  `Forwarded` header through unchanged, `request.remote_ip` returns an address
+  chosen by the client, and the IP spoofing check does not raise, because it
+  compares only `Client-Ip` with the forwarded addresses. An unauthenticated
+  attacker could therefore spoof `request.remote_ip`, possibly bypassing
+  IP-based access controls and rate limits keyed on the client address
+  (including the default `by:` of `rate_limit`), and falsifying the client
+  address in logs.
+
+  ### Details
+
+  The 8.1.0 change
+  ([2d084af8](https://github.com/rails/rails/commit/2d084af8444a7b6b868c7cbb256172007871e78d))
+  switched `ActionDispatch::RemoteIp` from reading `X-Forwarded-For` directly to
+  Rack's `forwarded_for`, in order to reuse Rack's port handling. Rails
+  continues to honor `Forwarded`, the standard header.
+
+  In the fixed releases, when `config.action_dispatch.ip_spoofing_check` is
+  enabled (the default), `ActionDispatch::RemoteIp` also compares the first
+  untrusted client address in `Forwarded` with the first untrusted client
+  address in `X-Forwarded-For`, as exact strings, and raises
+  `ActionDispatch::RemoteIp::IpSpoofAttackError` when both headers are present
+  and the addresses differ. Deployments whose proxies report the client address
+  inconsistently between the two headers will receive this error after
+  upgrading. See the `actionpack` CHANGELOG.
+
+  ### Affected applications
+
+  An application is affected if it meets all of these requirements:
+  - Runs Rails 8.1.0 through 8.1.4 with Rack 3. Under Rack 2.2, `forwarded_for`
+    reads only `X-Forwarded-For`.
+  - Is served behind a proxy that does not remove or overwrite a client-supplied
+    `Forwarded` header.
+  - Relies on `request.remote_ip` for access control, rate limiting, or
+    auditing.
+
+  The fix detects a spoofed `Forwarded` header only when the proxy also sets
+  `X-Forwarded-For`. An application whose proxy passes a client-supplied
+  `Forwarded` header through and sets no `X-Forwarded-For` remains exposed after
+  upgrading, and should configure the proxy to remove or overwrite `Forwarded`,
+  or apply the workaround below.
+
+  ### Mitigation
+
+  - Upgrade to a fixed version of `actionpack`.
+  - Configure reverse proxies to remove or overwrite any client-supplied
+    `Forwarded` header.
+
+  ### Workarounds
+
+  Applications whose proxies set `X-Forwarded-For` can make Rack ignore the
+  `Forwarded` header, restoring the client address resolution of Rails 8.0, by
+  setting `Rack::Request.forwarded_priority = [:x_forwarded]` in an initializer.
+  This setting is available in Rack 3.0.0 and later, and it also causes Rack to
+  ignore `Forwarded` when determining the request scheme, host, and port.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/2a01a5ac521184419d9a92fa2c25e102e68cd227.patch
+
+  ### Versions affected
+
+  - actionpack >= 8.1, < 8.1.4.1
+
+  ### Credit
+
+  This issue was responsibly reported by HackerOne researcher
+  [luryus](https://hackerone.com/luryus).
+cvss_v3: 7.4
+unaffected_versions:
+  - "< 8.1.0"
+patched_versions:
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/actionpack/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://github.com/rails/rails/commit/2a01a5ac521184419d9a92fa2c25e102e68cd227
+    - https://github.com/rails/rails/security/advisories/GHSA-2gff-2mmg-m73p
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA

gems/actionpack/GHSA-gmj8-hvj3-49mw.yml

@@ -0,0 +1,68 @@
+---
+gem: actionpack
+framework: rails
+ghsa: gmj8-hvj3-49mw
+url: https://github.com/rails/rails/security/advisories/GHSA-gmj8-hvj3-49mw
+title: "Missing SameSite attribute on session cookies from Action Pack session
+  stores"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  Action Pack session stores other than `ActionDispatch::Session::CookieStore`
+  (`CacheStore`, `MemCacheStore`, and third-party stores built on
+  `AbstractStore`, `AbstractSecureStore` or the session mixins) write the
+  session cookie without a `SameSite` attribute, regardless of
+  `config.action_dispatch.cookies_same_site_protection`, which defaults to
+  `:lax`. Only `CookieStore` applies the configured policy. In browsers that do
+  not treat a cookie without the attribute as `SameSite=Lax`, a cross-site
+  request could carry the session cookie, possibly leading to cross-site request
+  forgery against actions that do not verify an authenticity token, such as
+  those of API-only applications.
+
+  Applications are affected when they use a session store other than
+  `CookieStore` and do not pass `same_site:` to `config.session_store`.
+
+  ### Details
+
+  In the fixed releases, every session store sets the session cookie's
+  `SameSite` attribute from `cookies_same_site_protection` when its options have
+  no `:same_site` key. An explicit `same_site:` option, including
+  `same_site: nil`, and a `:same_site` value in a store's `DEFAULT_OPTIONS`
+  still take precedence.
+
+  ### Workarounds
+
+  Pass `same_site:` when configuring the session store, for example
+  `config.session_store :cache_store, same_site: :lax`.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/2d9f502df941e31ce9bad0e846564f49396bed46.patch
+  - 8.0:
+    https://github.com/rails/rails/commit/f2392996be723708271a8d30bfcf0edc221e53ef.patch
+
+  ### Credit
+
+  This issue was responsibly reported by HackerOne researcher
+  [tjvc](https://hackerone.com/tjvc).
+cvss_v3: 3.1
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/actionpack/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/actionpack/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/2d9f502df941e31ce9bad0e846564f49396bed46
+    - https://github.com/rails/rails/commit/f2392996be723708271a8d30bfcf0edc221e53ef
+    - https://github.com/rails/rails/security/advisories/GHSA-gmj8-hvj3-49mw
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA

gems/actionpack/GHSA-r9jg-fmfx-2gv6.yml

@@ -0,0 +1,75 @@
+---
+gem: actionpack
+framework: rails
+ghsa: r9jg-fmfx-2gv6
+url: https://github.com/rails/rails/security/advisories/GHSA-r9jg-fmfx-2gv6
+title: "Possible cache poisoning in Action Pack content negotiation"
+date: 2026-11-04
+description: |
+  ### Impact
+
+  Action Pack negotiates the format of a rendered response from the `Accept`,
+  `X-Requested-With` and, for XHR requests without `Accept`, `Content-Type`
+  request headers, but `ActionController::Rendering#_set_vary_header` adds
+  `Vary: Accept` only when the request carries a usable `Accept` header and the
+  response has no `Vary` header yet. A response to a request without `Accept`,
+  or to an XHR request, therefore omits the headers that selected its
+  representation, and a response whose `Vary` the application set before
+  rendering (for example `Vary: Accept-Language`) never gains `Accept`. A shared
+  cache that honours `Vary` could store such a response and serve it to later
+  clients that request a different representation, possibly leading to cache
+  poisoning in which visitors receive, until the entry expires, a page without
+  its layout or HTML in place of JSON. The attacker cannot choose the content of
+  the response.
+
+  Applications that render negotiated responses from actions marked `public`
+  (for example with `expires_in ..., public: true`) behind a shared cache that
+  honours `Vary`, such as Thruster or `Rack::Cache`, are affected.
+
+  ### Details
+
+  In the fixed releases, a rendered response whose format is not given by the
+  URL lists `Accept` and `X-Requested-With` in `Vary`, and also `Content-Type`
+  for an XHR request without `Accept`; when
+  `config.action_dispatch.ignore_accept_header` is enabled, it lists only
+  `X-Requested-With`. These fields are appended to an existing `Vary` value
+  rather than skipped, and `Vary: *` is left unchanged. Shared caches can store
+  more variants of such responses than before. See the Action Pack CHANGELOG for
+  details.
+
+  ### Workarounds
+
+  Set `Vary: Accept, X-Requested-With` on negotiated responses in the
+  application, for example in an `after_action`, or do not mark negotiated
+  responses `public`.
+
+  ### Releases
+
+  The fixed releases are available at the normal locations.
+
+  Patches for those who cannot upgrade at once:
+  - 8.1:
+    https://github.com/rails/rails/commit/7a955ca36779938267c93902c47d1f55bab99b4b.patch
+  - 8.0:
+    https://github.com/rails/rails/commit/b58c107abe9c1f10c1d6a4941402c60e4dc4742c.patch
+
+  ### Credit
+
+  This issue was found by the Anthropic OSS Scanner (ANT-2026-7GHGLQGO,
+  ANT-2026-5MT6C2R3).
+cvss_v3: 4.8
+patched_versions:
+  - "~> 8.0.5, >= 8.0.5.2"
+  - ">= 8.1.4.1"
+related:
+  url:
+    - https://rubygems.org/gems/actionpack/versions/8.1.4.1
+    - https://github.com/rails/rails/releases/tag/v8.1.4.1
+    - https://rubygems.org/gems/actionpack/versions/8.0.5.2
+    - https://github.com/rails/rails/releases/tag/v8.0.5.2
+    - https://github.com/rails/rails/commit/7a955ca36779938267c93902c47d1f55bab99b4b
+    - https://github.com/rails/rails/commit/b58c107abe9c1f10c1d6a4941402c60e4dc4742c
+    - https://github.com/rails/rails/security/advisories/GHSA-r9jg-fmfx-2gv6
+notes: |
+  - No CVE.
+  - cvss_v3 from GHSA