Red Hat Security Advisory

RHSA-2013:1794

ruby193-rubygem-actionpack security update

Released 2013-12-05 · Red Hat rating Important · View on Red Hat →

Fixed in

Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) ruby193-rubygem-actionpack-1:3.2.8-5.1.el6, ruby193-rubygem-actionpack-doc-1:3.2.8-5.1.el6
Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6) ruby193-rubygem-actionpack-1:3.2.8-5.1.el6, ruby193-rubygem-actionpack-doc-1:3.2.8-5.1.el6

Fixes 4 records

TI-2013-05368 CVE-2013-6414 · GHSA-mpxf-gcw2-pw5q

actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before…

MEDIUM 42

actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an inv…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.207 Published 2013-12-07 Partial fix · 3.2.16, 4.0.2 CWE-20

TI-2013-05371 CVE-2013-6417 · GHSA-wpw7-wxjm-cw8r

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x…

LOW 33

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementat…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.02371 Published 2013-12-07 Partial fix · 3.2.16, 4.0.2 CWE-264

TI-2013-05369 CVE-2013-6415 · GHSA-6h5q-96hp-9jgm

Cross-site scripting (XSS) vulnerability in the number_to_currency helper in…

LOW 26

Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbit…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03171 Published 2013-12-07 Partial fix · 3.2.16, 4.0.2 CWE-79

TI-2013-03940 CVE-2013-4491 · GHSA-699m-mcjm-9cw8

Cross-site scripting (XSS) vulnerability in…

LOW 24

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers t…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02233 Published 2013-12-07 Partial fix · 3.2.16, 4.0.2 CWE-79