A security issue has been reported in Ruby on Rails, which can be exploited by malicious people to bypass certain security restrictions.

The security issue is caused due to the "validate_digest_response()" function in actionpack/lib/action_controller/http_authentication.rb not returning "false" when processing "nil" credentials. This can be exploited to bypass the HTTP authentication by e.g. sending empty authentication credentials.

The security issue is reported in version 2.3.2. Other versions may also be affected.

Solution
Fixed in the GIT repository.
Further details available in Customer Area

Provided and/or discovered by
Nate

Changelog
Further details available in Customer Area

Original Advisory
Ruby on Rails:
http://weblog.rubyonrails.org/2009/6/3/security-problem-with-authenticate_with_http_digest

Nate:
http://n8.tumblr.com/post/117477059/security-hole-found-in-rails-2-3s

Deep Links
Links available in Customer Area