All errata/sisyphus/ALT-PU-2019-1438-2
ALT-PU-2019-1438-2

Package update ruby-rails in branch sisyphus

Version5.2.2.1-alt1
Task#225026
Published2026-02-04
Max severityCRITICAL
Severity:

Closed issues (6)

BDU:2019-01180
HIGH8.1

Уязвимость программной платформы Ruby on Rails, связанная с ошибками в коде генератора псевдослучайных чисел, позволяющая нарушителю выполнить произвольный код

Published: 2019-03-27Modified: 2021-03-23
CVSS 3.xHIGH 8.1
CVSS:3.x/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CVSS 2.0HIGH 7.6
CVSS:2.0/AV:N/AC:H/Au:N/C:C/I:C/A:C
References
BDU:2019-01506
HIGH7.5

Уязвимость компонента Action View программной платформы Ruby on Rails, позволяющая нарушителю читать произвольные файлы

Published: 2019-04-23Modified: 2025-09-10
CVSS 3.xHIGH 7.5
CVSS:3.x/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
References
CVE-2019-5418
HIGH7.5

There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.

Published: 2019-03-27Modified: 2025-10-30
CVSS 2.0MEDIUM 5.0
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:N/A:N
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
References
CVE-2019-5420
CRITICAL9.8

A remote code execution vulnerability in development mode Rails <5.2.2.1, <6.0.0.beta3 can allow an attacker to guess the automatically generated development mode secret token. This secret token can be used in combination with other Rails internals to escalate to a remote code execution exploit.

Published: 2019-03-27Modified: 2024-11-21
CVSS 2.0HIGH 7.5
CVSS:2.0/AV:N/AC:L/Au:N/C:P/I:P/A:P
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References
GHSA-86g5-2wh3-gc9j
HIGH7.5

Path Traversal in Action View

Published: 2019-03-13Modified: 2025-10-22
CVSS 3.xHIGH 7.5
CVSS:3.x/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H
References
GHSA-m42h-mh85-4qgc
CRITICAL9.8

Use of Insufficiently Random Values in Railties Allows Remote Code Execution

Published: 2019-03-13Modified: 2023-07-05
CVSS 3.xCRITICAL 9.8
CVSS:3.x/CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
References