GHSA-jp5v-5gx4-jmj9 Ability to forge per-form CSRF tokens in Rails

• RubyGems actionpack: >= 5.0.0, < 5.2.4.3 → fixed in 5.2.4.3 • RubyGems actionpack: >= 6.0.0, < 6.0.3.1 → fixed in 6.0.3.1

It is possible to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token for any action for that session. Impact ------ Given the ability to extract the global CSRF token, an attacker would be able to construct a per-form CSRF token for that session. Workarounds ----------- This is a low-severity security issue. As such, no workaround is necessarily until such time as the application can be upgraded.