Vulnerability advisory
BIT-rails-2024-28103
Action Pack is missing security headers on non-HTML responses
Also known as CVE-2024-28103GHSA-fwhr-88qx-h9g7
Severity
Severity not reported.
Affected versions
rails Bitnami
| Affected | Fixed in |
|---|---|
6.1.0 to before 6.1.8 | 6.1.8 |
7.0.0 to before 7.0.9 | 7.0.9 |
7.1.0 to before 7.1.4 | 7.1.4 |
Severity for this package
| |
Description
Action Pack is a framework for handling and responding to web requests. Since 6.1.0, the application configurable Permissions-Policy is only served on responses with an HTML related Content-Type. This vulnerability is fixed in 6.1.7.8, 7.0.8.2, and 7.1.3.3.