Red Hat Security AdvisoryRHSA-2016:0454
ror40 security update
Released 2016-03-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) ror40-rubygem-actionpack-1:4.0.2-7.el6, ror40-rubygem-actionpack-doc-1:4.0.2-7.el6, ror40-rubygem-activerecord-1:4.0.2-6.el6 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) ror40-rubygem-actionpack-1:4.0.2-7.el7, ror40-rubygem-actionpack-doc-1:4.0.2-7.el7, ror40-rubygem-activerecord-1:4.0.2-6.el7 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) ror40-rubygem-actionpack-1:4.0.2-7.el6, ror40-rubygem-actionpack-doc-1:4.0.2-7.el6, ror40-rubygem-activerecord-1:4.0.2-6.el6 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) ror40-rubygem-actionpack-1:4.0.2-7.el6, ror40-rubygem-actionpack-doc-1:4.0.2-7.el6, ror40-rubygem-activerecord-1:4.0.2-6.el6 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) ror40-rubygem-actionpack-1:4.0.2-7.el7, ror40-rubygem-actionpack-doc-1:4.0.2-7.el7, ror40-rubygem-activerecord-1:4.0.2-6.el7 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) ror40-rubygem-actionpack-1:4.0.2-7.el7, ror40-rubygem-actionpack-doc-1:4.0.2-7.el7, ror40-rubygem-activerecord-1:4.0.2-6.el7 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) ror40-rubygem-actionpack-1:4.0.2-7.el6, ror40-rubygem-actionpack-doc-1:4.0.2-7.el6, ror40-rubygem-activerecord-1:4.0.2-6.el6 +2
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) ror40-rubygem-actionpack-1:4.0.2-7.el7, ror40-rubygem-actionpack-doc-1:4.0.2-7.el7, ror40-rubygem-activerecord-1:4.0.2-6.el7 +2
Fixes 7 records
Priority CRITICAL 90KEV
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 allows remote attackers to read arbitrary files by le…
CVSS 3.1HIGH 7.5· Network · No auth · No interaction · EPSS 0.95537 · Published 2016-02-16 · Partial fix · 4.1.14.1, 4.2.5.1 +1 CWE-22
Priority HIGH 73
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
CVSS 3.0HIGH 7.3· Network · No auth · No interaction · EPSS 0.81445 · Published 2016-04-07 · Partial fix · 3.2.22.2, 4.1.14.2 +1 CWE-20
Priority MEDIUM 45
actionpack/lib/action_dispatch/http/mime_type.rb in Action Pack in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly restrict use of the…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.09731 · Published 2016-02-16 · Partial fix · 4.2.5.1, 3.2.22.1 +1 CWE-399
Priority MEDIUM 42
actionpack/lib/action_dispatch/routing/route_set.rb in Action Pack in Ruby on Rails 4.x before 4.2.5.1 and 5.x before 5.0.0.beta1.1 allows remote attackers to cause a denial of service (superfluous caching and memory con…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.06715 · Published 2016-02-16 · Fixed in 4.2.5.1 CWE-399
Priority LOW 31
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render meth…
CVSS 3.0MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.04423 · Published 2016-04-07 · Partial fix · 3.2.22.2, 4.1.14.2 CWE-22
Priority LOW 31
activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly…
CVSS 3.0MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.0425 · Published 2016-02-16 · Partial fix · 3.2.22.1, 4.1.14.1 +2 CWE-284
Priority LOW 25
The http_basic_authenticate_with method in actionpack/lib/action_controller/metal/http_authentication.rb in the Basic Authentication implementation in Action Controller in Ruby on Rails before 3.2.22.1, 4.0.x and 4.1.x b…
CVSS 3.0LOW 3.7· Network · No auth · No interaction · EPSS 0.04879 · Published 2016-02-16 · Partial fix · 3.2.22.1, 4.1.14.1 CWE-254
THREATIST.IORead the docs