CVE-2015-2963: Content type spoofing vulnerability

July 10, 2015 (updated December 2, 2016)

There is an issue where if an HTML file is uploaded with a .html extension, but the content type is listed as being image/jpeg, this will bypass a validation checking for images. But it will also pass the spoof check, because a file named .html and containing actual HTML passes the spoof check.

References

robots.thoughtbot.com/paperclip-security-release

Code Behaviors & Features

Detect and mitigate CVE-2015-2963 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →