CVE-2009-2422: Apple Mac OS X

Critical severity, CVSS 9.8. EPSS: 3.4% chance of exploitation in the next 30 days.

The example code for the digest authentication functionality (http_authentication.rb) in Ruby on Rails before 2.3.3 defines an authenticate_or_request_with_http_digest block that returns nil instead of false when the user does not exist, which allows context-dependent attackers to bypass authentication for applications that are derived from this example by sending an invalid username without a password.

Affected products

• Apple Mac OS X: from 10.6.0, before 10.6.3 (fixed in 10.6.3); version 10.5.8 only
• Apple Mac OS X Server: from 10.6.0, before 10.6.3 (fixed in 10.6.3); version 10.5.8 only
• Rubyonrails Ruby On Rails: before 2.3.3 (fixed in 2.3.3)

Published 2009-07-10. Last modified 2026-06-16.