A rails security update has been released for Debian GNU/Linux 8 Extended LTS to address two security issues.

ELA-425-1 rails security update

Package rails
Version 2:4.1.8-1+deb8u9
Related CVEs CVE-2021-22885 CVE-2021-22904

CVE-2021-22885

There is a possible information disclosure/unintended method
execution vulnerability in Action Pack when using the
`redirect_to` or `polymorphic_url` helper with untrusted user
input.

CVE-2021-22904

There is a possible DoS vulnerability in the Token Authentication
logic in Action Controller. Impacted code uses
`authenticate_or_request_with_http_token` or
`authenticate_with_http_token` for request authentication.
For Debian 8 jessie, these problems have been fixed in version 2:4.1.8-1+deb8u9.

We recommend that you upgrade your rails packages.

Further information about Extended LTS security advisories can be found at: https://deb.freexian.com/extended-lts/

  ELA-425-1 rails security update