Red Hat Security AdvisoryRHSA-2016:1855
rh-ror42 security update
Released 2016-09-13 · Red Hat rating Moderate · View on Red Hat →
Fixed in
- Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7) rh-ror42-rubygem-actionpack-1:4.2.6-3.el7, rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7, rh-ror42-rubygem-actionview-4.2.6-3.el7 +3
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1) rh-ror42-rubygem-actionpack-1:4.2.6-3.el7, rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7, rh-ror42-rubygem-actionview-4.2.6-3.el7 +3
- Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2) rh-ror42-rubygem-actionpack-1:4.2.6-3.el7, rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7, rh-ror42-rubygem-actionview-4.2.6-3.el7 +3
- Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7) rh-ror42-rubygem-actionpack-1:4.2.6-3.el7, rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7, rh-ror42-rubygem-actionview-4.2.6-3.el7 +3
Fixes 2 records
Priority LOW 39
Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass in…
CVSS 3.0HIGH 7.5· Network · No auth · No interaction · EPSS 0.03903 · Published 2016-09-07 · Fixed in 4.2.7.1 CWE-284
Priority LOW 33
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declar…
CVSS 3.0MEDIUM 6.1· Network · No auth · User interaction · EPSS 0.03438 · Published 2016-09-07 · Partial fix · 3.2.22.3, 4.2.7.1 +1 CWE-79
