Red Hat Security AdvisoryRHSA-2016:0456
rh-ror41 security update
Released 2016-03-15 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6) rh-ror41-rubygem-actionpack-1:4.1.5-4.el6, rh-ror41-rubygem-actionpack-doc-1:4.1.5-4.el6, rh-ror41-rubygem-actionview-4.1.5-5.el6 +1
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-ror41-rubygem-actionpack-1:4.1.5-4.el7, rh-ror41-rubygem-actionpack-doc-1:4.1.5-4.el7, rh-ror41-rubygem-actionview-4.1.5-5.el7 +1
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6) rh-ror41-rubygem-actionpack-1:4.1.5-4.el6, rh-ror41-rubygem-actionpack-doc-1:4.1.5-4.el6, rh-ror41-rubygem-actionview-4.1.5-5.el6 +1
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7) rh-ror41-rubygem-actionpack-1:4.1.5-4.el6, rh-ror41-rubygem-actionpack-doc-1:4.1.5-4.el6, rh-ror41-rubygem-actionview-4.1.5-5.el6 +1
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) rh-ror41-rubygem-actionpack-1:4.1.5-4.el7, rh-ror41-rubygem-actionpack-doc-1:4.1.5-4.el7, rh-ror41-rubygem-actionview-4.1.5-5.el7 +1
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) rh-ror41-rubygem-actionpack-1:4.1.5-4.el7, rh-ror41-rubygem-actionpack-doc-1:4.1.5-4.el7, rh-ror41-rubygem-actionview-4.1.5-5.el7 +1
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6) rh-ror41-rubygem-actionpack-1:4.1.5-4.el6, rh-ror41-rubygem-actionpack-doc-1:4.1.5-4.el6, rh-ror41-rubygem-actionview-4.1.5-5.el6 +1
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-ror41-rubygem-actionpack-1:4.1.5-4.el7, rh-ror41-rubygem-actionpack-doc-1:4.1.5-4.el7, rh-ror41-rubygem-actionview-4.1.5-5.el7 +1
Fixes 2 records
Priority HIGH 73
Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.
CVSS 3.0HIGH 7.3· Network · No auth · No interaction · EPSS 0.81445 · Published 2016-04-07 · Partial fix · 3.2.22.2, 4.1.14.2 +1 CWE-20
Priority LOW 31
Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render meth…
CVSS 3.0MEDIUM 5.3· Network · No auth · No interaction · EPSS 0.04423 · Published 2016-04-07 · Partial fix · 3.2.22.2, 4.1.14.2 CWE-22
