Ruby on Rails v6.1.3.2 and v6.0.3.7 released!

[NewsBot]

Ruby on Rails v6.1.3.2 and v6.0.3.7 has been released.

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• Prevent open redirects by correctly escaping the host allow list
  CVE-2021-22903

• Prevent catastrophic backtracking during mime parsing
  CVE-2021-22902

• Prevent regex DoS in HTTP token authentication
  CVE-2021-22904

• Prevent string polymorphic route arguments.

  `url_…

Link: Release 6.1.3.2 · rails/rails · GitHub

Active Support

• No changes.

Active Model

• No changes.

Active Record

• No changes.

Action View

• No changes.

Action Pack

• Prevent catastrophic backtracking during mime parsing
  CVE-2021-22902

• Prevent regex DoS in HTTP token authentication
  CVE-2021-22904

• Prevent string polymorphic route arguments.

  url_for supports building polymorphic URLs via an array
  of arguments (usually symbols an…

Link: Release 6.0.3.7 · rails/rails · GitHub