Read the docs
Red Hat Security Advisory

RHSA-2014:0008

ruby193-rubygem-actionpack security update

Released 2014-01-06 · Red Hat rating Important · View on Red Hat →

Fixed in

Fixes 4 records

TI-2013-05368 CVE-2013-6414 · GHSA-mpxf-gcw2-pw5q

actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before…

Priority MEDIUM 42

actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an inv…

CVSS 2.0MEDIUM 5.0 Network No auth Interaction — EPSS 0.207 Published 2013-12-07 Partial fix · 3.2.16, 4.0.2 CWE-20
TI-2013-05371 CVE-2013-6417 · GHSA-wpw7-wxjm-cw8r

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x…

Priority LOW 33

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementat…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.02371 Published 2013-12-07 Partial fix · 3.2.16, 4.0.2 CWE-264
TI-2013-05369 CVE-2013-6415 · GHSA-6h5q-96hp-9jgm

Cross-site scripting (XSS) vulnerability in the number_to_currency helper in…

Priority LOW 26

Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbit…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.03171 Published 2013-12-07 Partial fix · 3.2.16, 4.0.2 CWE-79
TI-2013-03940 CVE-2013-4491 · GHSA-699m-mcjm-9cw8

Cross-site scripting (XSS) vulnerability in…

Priority LOW 24

Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers t…

CVSS 2.0MEDIUM 4.3 Network No auth Interaction — EPSS 0.02233 Published 2013-12-07 Partial fix · 3.2.16, 4.0.2 CWE-79