ALT-PU-2019-1438-1
Package ruby-rails updated to version 5.2.2.1-alt1 for branch sisyphus in task 225026.
Closed vulnerabilities
BDU:2019-01180
Уязвимость программной платформы Ruby on Rails, связанная с ошибками в коде генератора псевдослучайных чисел, позволяющая нарушителю выполнить произвольный код
BDU:2019-01506
Уязвимость компонента Action View программной платформы Ruby on Rails, позволяющая нарушителю читать произвольные файлы
Modified: 2024-11-21
CVE-2019-5418
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.
- openSUSE-SU-2019:1344
- openSUSE-SU-2019:1344
- http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html
- http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html
- [oss-security] 20190322 [CVE-2019-5418] Amendment: Possible Remote Code Execution Exploit in Action View
- [oss-security] 20190322 [CVE-2019-5418] Amendment: Possible Remote Code Execution Exploit in Action View
- RHSA-2019:0796
- RHSA-2019:0796
- RHSA-2019:1147
- RHSA-2019:1147
- RHSA-2019:1149
- RHSA-2019:1149
- RHSA-2019:1289
- RHSA-2019:1289
- https://groups.google.com/forum/#%21topic/rubyonrails-security/pFRKI96Sm8Q
- https://groups.google.com/forum/#%21topic/rubyonrails-security/pFRKI96Sm8Q
- [debian-lts-announce] 20190331 [SECURITY] [DLA 1739-1] rails security update
- [debian-lts-announce] 20190331 [SECURITY] [DLA 1739-1] rails security update
- FEDORA-2019-1cfe24db5c
- FEDORA-2019-1cfe24db5c
- https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/
- https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/
- 46585
- 46585
Modified: 2024-11-21
CVE-2019-5420
A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.
- http://packetstormsecurity.com/files/152704/Ruby-On-Rails-DoubleTap-Development-Mode-secret_key_base-Remote-Code-Execution.html
- http://packetstormsecurity.com/files/152704/Ruby-On-Rails-DoubleTap-Development-Mode-secret_key_base-Remote-Code-Execution.html
- https://groups.google.com/forum/#%21topic/rubyonrails-security/IsQKvDqZdKw
- https://groups.google.com/forum/#%21topic/rubyonrails-security/IsQKvDqZdKw
- FEDORA-2019-1cfe24db5c
- FEDORA-2019-1cfe24db5c
- https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/
- https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/
- 46785
- 46785