RAILS PATCHES CRITICAL ACTIVE STORAGE FLAW WITH RCE POTENTIAL

Summary from the TLDR InfoSec newsletter

The Rails framework for Ruby disclosed a new vulnerability in Active Storage that could enable arbitrary reads. The vulnerability is exploitable when libvips is used, and the server allows for image uploads from untrusted users. Security researchers highlighted that this vulnerability could be exploited to read the Rails master key, which could compromise all cryptographic operations and lead to RCE.