Action not permitted
Modal body text goes here.
cve-2013-0256
Vulnerability from cvelistv5
Published
2013-03-01 02:00
Modified
2024-08-06 14:18
Severity ?
EPSS score ?
Summary
darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.
References
{ "containers": { "adp": [ { "providerMetadata": { "dateUpdated": "2024-08-06T14:18:09.523Z", "orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE" }, "references": [ { "name": "RHSA-2013:0701", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0701.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/" }, { "name": "52774", "tags": [ "third-party-advisory", "x_refsource_SECUNIA", "x_transferred" ], "url": "http://secunia.com/advisories/52774" }, { "name": "openSUSE-SU-2013:0303", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-updates/2013-02/msg00048.html" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "http://blog.segment7.net/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2" }, { "name": "RHSA-2013:0728", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0728.html" }, { "name": "RHSA-2013:0686", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0686.html" }, { "tags": [ "x_refsource_CONFIRM", "x_transferred" ], "url": "https://github.com/rdoc/rdoc/commit/ffa87887ee0517793df7541629a470e331f9fe60" }, { "name": "RHSA-2013:0548", "tags": [ "vendor-advisory", "x_refsource_REDHAT", "x_transferred" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0548.html" }, { "name": "USN-1733-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU", "x_transferred" ], "url": "http://www.ubuntu.com/usn/USN-1733-1" }, { "tags": [ "x_refsource_MISC", "x_transferred" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=907820" }, { "name": "SUSE-SU-2013:0647", "tags": [ "vendor-advisory", "x_refsource_SUSE", "x_transferred" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html" } ], "title": "CVE Program Container" } ], "cna": { "affected": [ { "product": "n/a", "vendor": "n/a", "versions": [ { "status": "affected", "version": "n/a" } ] } ], "datePublic": "2013-02-05T00:00:00", "descriptions": [ { "lang": "en", "value": "darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL." } ], "problemTypes": [ { "descriptions": [ { "description": "n/a", "lang": "en", "type": "text" } ] } ], "providerMetadata": { "dateUpdated": "2013-03-06T10:00:00", "orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat" }, "references": [ { "name": "RHSA-2013:0701", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0701.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/" }, { "name": "52774", "tags": [ "third-party-advisory", "x_refsource_SECUNIA" ], "url": "http://secunia.com/advisories/52774" }, { "name": "openSUSE-SU-2013:0303", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-updates/2013-02/msg00048.html" }, { "tags": [ "x_refsource_MISC" ], "url": "http://blog.segment7.net/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2" }, { "name": "RHSA-2013:0728", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0728.html" }, { "name": "RHSA-2013:0686", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0686.html" }, { "tags": [ "x_refsource_CONFIRM" ], "url": "https://github.com/rdoc/rdoc/commit/ffa87887ee0517793df7541629a470e331f9fe60" }, { "name": "RHSA-2013:0548", "tags": [ "vendor-advisory", "x_refsource_REDHAT" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0548.html" }, { "name": "USN-1733-1", "tags": [ "vendor-advisory", "x_refsource_UBUNTU" ], "url": "http://www.ubuntu.com/usn/USN-1733-1" }, { "tags": [ "x_refsource_MISC" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=907820" }, { "name": "SUSE-SU-2013:0647", "tags": [ "vendor-advisory", "x_refsource_SUSE" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html" } ], "x_legacyV4Record": { "CVE_data_meta": { "ASSIGNER": "secalert@redhat.com", "ID": "CVE-2013-0256", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "RHSA-2013:0701", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-0701.html" }, { "name": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/", "refsource": "CONFIRM", "url": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/" }, { "name": "52774", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/52774" }, { "name": "openSUSE-SU-2013:0303", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2013-02/msg00048.html" }, { "name": "http://blog.segment7.net/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2", "refsource": "MISC", "url": "http://blog.segment7.net/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2" }, { "name": "RHSA-2013:0728", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-0728.html" }, { "name": "RHSA-2013:0686", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-0686.html" }, { "name": "https://github.com/rdoc/rdoc/commit/ffa87887ee0517793df7541629a470e331f9fe60", "refsource": "CONFIRM", "url": "https://github.com/rdoc/rdoc/commit/ffa87887ee0517793df7541629a470e331f9fe60" }, { "name": "RHSA-2013:0548", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-0548.html" }, { "name": "USN-1733-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-1733-1" }, { "name": "https://bugzilla.redhat.com/show_bug.cgi?id=907820", "refsource": "MISC", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=907820" }, { "name": "SUSE-SU-2013:0647", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html" } ] } } } }, "cveMetadata": { "assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2013-0256", "datePublished": "2013-03-01T02:00:00", "dateReserved": "2012-12-06T00:00:00", "dateUpdated": "2024-08-06T14:18:09.523Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "nvd": "{\"cve\":{\"id\":\"CVE-2013-0256\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2013-03-01T05:40:17.583\",\"lastModified\":\"2021-09-09T12:28:13.300\",\"vulnStatus\":\"Analyzed\",\"evaluatorImpact\":\"Per http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/\\r\\nAffected versions\\r\\nAll ruby 1.9 versions prior to ruby 1.9.3 patchlevel 383\\r\\nAll ruby 2.0 versions prior to ruby 2.0.0 rc2 or prior to trunk revision 39102\\r\\n\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.\"},{\"lang\":\"es\",\"value\":\"darkfish.js de RDoc v2.3.0 hasta v3.12 y v4.x antes de v4.0.0.preview2.1, tal como se utiliza en Ruby, no se gener\u00f3 correctamente los documentos, que permite a atacantes remotos realizar ejecuci\u00f3n de secuencias de comandos en sitios cruzados (XSS) a trav\u00e9s de una URL manipulada.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\",\"baseScore\":4.3},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ruby-lang:rdoc:*:*:*:*:*:ruby:*:*\",\"versionStartIncluding\":\"2.3.0\",\"versionEndExcluding\":\"3.12\",\"matchCriteriaId\":\"C60BA6CA-3872-433E-9CDA-465EFB11F230\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ruby-lang:rdoc:4.0.0:preview2:*:*:*:ruby:*:*\",\"matchCriteriaId\":\"2C0C6748-AE0F-4E21-AA18-59583D5123AB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ruby-lang:ruby:1.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9237145-35F8-4E05-B730-77C0F386E5B2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ruby-lang:ruby:1.9.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C78BB1D8-0505-484D-B824-1AA219F8B247\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ruby-lang:ruby:1.9.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5178D04D-1C29-4353-8987-559AA07443EC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D0535DC9-EB0E-4745-80AC-4A020DF26E38\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ruby-lang:ruby:1.9.3:p0:*:*:*:*:*:*\",\"matchCriteriaId\":\"94F5AA37-B466-4E2E-B217-5119BADDD87B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ruby-lang:ruby:1.9.3:p125:*:*:*:*:*:*\",\"matchCriteriaId\":\"6DF0F0F5-4022-4837-9B40-4B1127732CC9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ruby-lang:ruby:1.9.3:p194:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3848B08-85C2-4AAD-AA33-CCEB80EF5B32\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ruby-lang:ruby:1.9.3:p286:*:*:*:*:*:*\",\"matchCriteriaId\":\"B7927D40-2A3A-43AD-99F6-CE61882A1FF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ruby-lang:ruby:1.9.3:p383:*:*:*:*:*:*\",\"matchCriteriaId\":\"AA406EC6-6CA5-40A6-A879-AA8940CBEF07\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ruby-lang:ruby:2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"90E0471D-1323-4E67-B66C-DEBF3BBAEEAA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B03B7561-A854-4EFA-9E4E-CFC4EEAE4EE1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ruby-lang:ruby:2.0.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"285A3431-BDFE-40C5-92CD-B18217757C23\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:ruby-lang:ruby:2.0.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"D66B32CB-AC49-4A1C-85ED-6389F27CB319\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*\",\"matchCriteriaId\":\"CB66DB75-2B16-4EBF-9B93-CE49D8086E41\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E2076871-2E80-4605-A470-A41C1A8EC7EE\"}]}]}],\"references\":[{\"url\":\"http://blog.segment7.net/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2013-02/msg00048.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Mailing List\",\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-0548.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-0686.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-0701.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-0728.html\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://secunia.com/advisories/52774\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.ubuntu.com/usn/USN-1733-1\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=907820\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Issue Tracking\"]},{\"url\":\"https://github.com/rdoc/rdoc/commit/ffa87887ee0517793df7541629a470e331f9fe60\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]}]}}" } }
gsd-2013-0256
Vulnerability from gsd
Modified
2013-02-06 00:00
Details
darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.
Aliases
Aliases
{ "GSD": { "alias": "CVE-2013-0256", "description": "darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.", "id": "GSD-2013-0256", "references": [ "https://www.suse.com/security/cve/CVE-2013-0256.html", "https://access.redhat.com/errata/RHSA-2013:0728", "https://access.redhat.com/errata/RHSA-2013:0701", "https://access.redhat.com/errata/RHSA-2013:0686", "https://access.redhat.com/errata/RHSA-2013:0548" ] }, "gsd": { "metadata": { "exploitCode": "unknown", "remediation": "unknown", "reportConfidence": "confirmed", "type": "vulnerability" }, "osvSchema": { "affected": [ { "package": { "ecosystem": "RubyGems", "name": "rdoc", "purl": "pkg:gem/rdoc" } } ], "aliases": [ "CVE-2013-0256", "OSVDB-90004" ], "details": "darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.", "id": "GSD-2013-0256", "modified": "2013-02-06T00:00:00.000Z", "published": "2013-02-06T00:00:00.000Z", "references": [ { "type": "WEB", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0256" } ], "schema_version": "1.4.0", "severity": [ { "score": 4.3, "type": "CVSS_V2" } ], "summary": "CVE-2013-0256 rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template" } }, "namespaces": { "cve.org": { "CVE_data_meta": { "ASSIGNER": "secalert@redhat.com", "ID": "CVE-2013-0256", "STATE": "PUBLIC" }, "affects": { "vendor": { "vendor_data": [ { "product": { "product_data": [ { "product_name": "n/a", "version": { "version_data": [ { "version_value": "n/a" } ] } } ] }, "vendor_name": "n/a" } ] } }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "eng", "value": "darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "eng", "value": "n/a" } ] } ] }, "references": { "reference_data": [ { "name": "RHSA-2013:0701", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-0701.html" }, { "name": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/", "refsource": "CONFIRM", "url": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/" }, { "name": "52774", "refsource": "SECUNIA", "url": "http://secunia.com/advisories/52774" }, { "name": "openSUSE-SU-2013:0303", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-updates/2013-02/msg00048.html" }, { "name": "http://blog.segment7.net/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2", "refsource": "MISC", "url": "http://blog.segment7.net/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2" }, { "name": "RHSA-2013:0728", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-0728.html" }, { "name": "RHSA-2013:0686", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-0686.html" }, { "name": "https://github.com/rdoc/rdoc/commit/ffa87887ee0517793df7541629a470e331f9fe60", "refsource": "CONFIRM", "url": "https://github.com/rdoc/rdoc/commit/ffa87887ee0517793df7541629a470e331f9fe60" }, { "name": "RHSA-2013:0548", "refsource": "REDHAT", "url": "http://rhn.redhat.com/errata/RHSA-2013-0548.html" }, { "name": "USN-1733-1", "refsource": "UBUNTU", "url": "http://www.ubuntu.com/usn/USN-1733-1" }, { "name": "https://bugzilla.redhat.com/show_bug.cgi?id=907820", "refsource": "MISC", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=907820" }, { "name": "SUSE-SU-2013:0647", "refsource": "SUSE", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html" } ] } }, "github.com/rubysec/ruby-advisory-db": { "cve": "2013-0256", "cvss_v2": 4.3, "date": "2013-02-06", "description": "darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.", "gem": "rdoc", "osvdb": 90004, "patched_versions": [ "~\u003e 3.9.5", "~\u003e 3.12.1", "\u003e= 4.0" ], "title": "CVE-2013-0256 rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0256" }, "gitlab.com": { "advisories": [ { "affected_range": "\u003e=2.3.0 \u003c3.9.5 || \u003e=3.10 \u003c3.12 || \u003e=4.0.0.preview2 \u003c4.0.0.rc.2", "affected_versions": "All versions starting from 2.3.0 before 3.9.5, all versions starting from 3.10 before 3.12, all versions starting from 4.0.0.preview2 before 4.0.0.rc.2", "cvss_v2": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "cwe_ids": [ "CWE-1035", "CWE-79", "CWE-937" ], "date": "2013-06-04", "description": "This exploit may lead to cookie disclosure to third parties. The exploit exists in darkfish.js which is copied from the RDoc install location to the generated documentation. RDoc is a static documentation generation tool. Patching the library itself is insufficient to correct this exploit.", "fixed_versions": [ "3.12.1", "3.9.5", "4.0.0.rc.2" ], "identifier": "CVE-2013-0256", "identifiers": [ "CVE-2013-0256" ], "not_impacted": "2.3.0 through rdoc 3.12 and prereleases up to rdoc 4.0.0.preview2.1", "package_slug": "gem/rdoc", "pubdate": "2013-03-01", "solution": "Upgrade abd patches available (see source)", "title": "XSS exploit of RDoc documentation generated by rdoc", "urls": [ "https://github.com/rdoc/rdoc/blob/master/CVE-2013-0256.rdoc" ], "uuid": "b48946f1-9df2-4019-862d-33bee381b7a1" } ] }, "nvd.nist.gov": { "configurations": { "CVE_data_version": "4.0", "nodes": [ { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:a:ruby-lang:rdoc:*:*:*:*:*:ruby:*:*", "cpe_name": [], "versionEndExcluding": "3.12", "versionStartIncluding": "2.3.0", "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ruby-lang:rdoc:4.0.0:preview2:*:*:*:ruby:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ruby-lang:ruby:1.9:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ruby-lang:ruby:1.9.1:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ruby-lang:ruby:1.9.2:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ruby-lang:ruby:1.9.3:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ruby-lang:ruby:1.9.3:p0:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ruby-lang:ruby:1.9.3:p125:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ruby-lang:ruby:1.9.3:p194:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ruby-lang:ruby:1.9.3:p286:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ruby-lang:ruby:1.9.3:p383:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ruby-lang:ruby:2.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ruby-lang:ruby:2.0.0:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ruby-lang:ruby:2.0.0:rc1:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:a:ruby-lang:ruby:2.0.0:rc2:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" }, { "children": [], "cpe_match": [ { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:12.04:*:*:*:-:*:*:*", "cpe_name": [], "vulnerable": true }, { "cpe23Uri": "cpe:2.3:o:canonical:ubuntu_linux:12.10:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true } ], "operator": "OR" } ] }, "cve": { "CVE_data_meta": { "ASSIGNER": "secalert@redhat.com", "ID": "CVE-2013-0256" }, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": { "description_data": [ { "lang": "en", "value": "darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL." } ] }, "problemtype": { "problemtype_data": [ { "description": [ { "lang": "en", "value": "CWE-79" } ] } ] }, "references": { "reference_data": [ { "name": "https://bugzilla.redhat.com/show_bug.cgi?id=907820", "refsource": "MISC", "tags": [ "Issue Tracking" ], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=907820" }, { "name": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/", "refsource": "CONFIRM", "tags": [ "Vendor Advisory" ], "url": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/" }, { "name": "https://github.com/rdoc/rdoc/commit/ffa87887ee0517793df7541629a470e331f9fe60", "refsource": "CONFIRM", "tags": [ "Third Party Advisory" ], "url": "https://github.com/rdoc/rdoc/commit/ffa87887ee0517793df7541629a470e331f9fe60" }, { "name": "RHSA-2013:0548", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0548.html" }, { "name": "http://blog.segment7.net/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2", "refsource": "MISC", "tags": [ "Third Party Advisory" ], "url": "http://blog.segment7.net/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2" }, { "name": "openSUSE-SU-2013:0303", "refsource": "SUSE", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-updates/2013-02/msg00048.html" }, { "name": "USN-1733-1", "refsource": "UBUNTU", "tags": [ "Third Party Advisory" ], "url": "http://www.ubuntu.com/usn/USN-1733-1" }, { "name": "52774", "refsource": "SECUNIA", "tags": [ "Third Party Advisory" ], "url": "http://secunia.com/advisories/52774" }, { "name": "RHSA-2013:0686", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0686.html" }, { "name": "RHSA-2013:0701", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0701.html" }, { "name": "SUSE-SU-2013:0647", "refsource": "SUSE", "tags": [ "Mailing List", "Third Party Advisory" ], "url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html" }, { "name": "RHSA-2013:0728", "refsource": "REDHAT", "tags": [ "Third Party Advisory" ], "url": "http://rhn.redhat.com/errata/RHSA-2013-0728.html" } ] } }, "impact": { "baseMetricV2": { "cvssV2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "exploitabilityScore": 8.6, "impactScore": 2.9, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "severity": "MEDIUM", "userInteractionRequired": true } }, "lastModifiedDate": "2021-09-09T12:28Z", "publishedDate": "2013-03-01T05:40Z" } } }
rhsa-2013_0701
Vulnerability from csaf_redhat
Published
2013-04-02 19:58
Modified
2024-11-05 18:04
Summary
Red Hat Security Advisory: ruby193-ruby, rubygem-json and rubygem-rdoc security update
Notes
Topic
Updated ruby193-ruby, rubygem-json and rubygem-rdoc packages that fix two
security issues are now available for Red Hat OpenShift Enterprise 1.1.3.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Ruby is an extensible, interpreted, object-oriented, scripting language. It
has features to process text files and to do system management tasks.
A flaw in rubygem-json and ruby193-rubygem-json allowed remote attacks by
creating different types of malicious objects. For example, it could
initiate a denial of service attack through resource consumption by using a
JSON document to create arbitrary Ruby symbols, which were never garbage
collected. It could also be exploited to create internal objects which
could allow a SQL injection attack. (CVE-2013-0269)
It was found that documentation created by rubygem-rdoc and
ruby193-rubygem-rdoc was vulnerable to a cross-site scripting (XSS) attack.
If such documentation was accessible over a network, and a remote attacker
could trick a user into visiting a specially-crafted URL, it would lead to
arbitrary web script execution in the context of the user's session. As
rubygem-rdoc and ruby193-rubygem-rdoc are used for creating documentation
for Ruby source files (such as classes, modules, and so on), it is not a
common scenario to make such documentation accessible over the network.
(CVE-2013-0256)
Red Hat would like to thank Ruby on Rails upstream for reporting
CVE-2013-0269, and Eric Hodel of RDoc upstream for reporting CVE-2013-0256.
Upstream acknowledges Thomas Hollstegge of Zweitag and Ben Murphy as the
original reporters of CVE-2013-0269, and Evgeny Ermakov as the original
reporter of CVE-2013-0256.
Users of Red Hat OpenShift Enterprise 1.1.3 are advised to upgrade to these
updated packages, which correct these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Updated ruby193-ruby, rubygem-json and rubygem-rdoc packages that fix two\nsecurity issues are now available for Red Hat OpenShift Enterprise 1.1.3.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.", "title": "Topic" }, { "category": "general", "text": "Ruby is an extensible, interpreted, object-oriented, scripting language. It\nhas features to process text files and to do system management tasks.\n\nA flaw in rubygem-json and ruby193-rubygem-json allowed remote attacks by\ncreating different types of malicious objects. For example, it could\ninitiate a denial of service attack through resource consumption by using a\nJSON document to create arbitrary Ruby symbols, which were never garbage\ncollected. It could also be exploited to create internal objects which\ncould allow a SQL injection attack. (CVE-2013-0269)\n\nIt was found that documentation created by rubygem-rdoc and\nruby193-rubygem-rdoc was vulnerable to a cross-site scripting (XSS) attack.\nIf such documentation was accessible over a network, and a remote attacker\ncould trick a user into visiting a specially-crafted URL, it would lead to\narbitrary web script execution in the context of the user\u0027s session. As\nrubygem-rdoc and ruby193-rubygem-rdoc are used for creating documentation\nfor Ruby source files (such as classes, modules, and so on), it is not a\ncommon scenario to make such documentation accessible over the network.\n(CVE-2013-0256)\n\nRed Hat would like to thank Ruby on Rails upstream for reporting\nCVE-2013-0269, and Eric Hodel of RDoc upstream for reporting CVE-2013-0256.\nUpstream acknowledges Thomas Hollstegge of Zweitag and Ben Murphy as the\noriginal reporters of CVE-2013-0269, and Evgeny Ermakov as the original\nreporter of CVE-2013-0256.\n\nUsers of Red Hat OpenShift Enterprise 1.1.3 are advised to upgrade to these\nupdated packages, which correct these issues.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2013:0701", "url": "https://access.redhat.com/errata/RHSA-2013:0701" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "907820", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=907820" }, { "category": "external", "summary": "909029", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=909029" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0701.json" } ], "title": "Red Hat Security Advisory: ruby193-ruby, rubygem-json and rubygem-rdoc security update", "tracking": { "current_release_date": "2024-11-05T18:04:33+00:00", "generator": { "date": "2024-11-05T18:04:33+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2013:0701", "initial_release_date": "2013-04-02T19:58:00+00:00", "revision_history": [ { "date": "2013-04-02T19:58:00+00:00", "number": "1", "summary": "Initial version" }, { "date": "2013-04-02T20:06:00+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T18:04:33+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Enterprise Infrastructure", "product": { "name": "Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:1::el6" } } }, { "category": "product_name", "name": "Red Hat OpenShift Enterprise Node", "product": { "name": "Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:1::el6" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "ruby193-rubygem-json-0:1.5.4-28.el6.x86_64", "product": { "name": "ruby193-rubygem-json-0:1.5.4-28.el6.x86_64", "product_id": "ruby193-rubygem-json-0:1.5.4-28.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-json@1.5.4-28.el6?arch=x86_64" } } }, { "category": "product_version", "name": "ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64", "product": { "name": "ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64", "product_id": "ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-ruby-libs@1.9.3.327-28.el6?arch=x86_64" } } }, { "category": "product_version", "name": "ruby193-rubygem-io-console-0:0.3-28.el6.x86_64", "product": { "name": "ruby193-rubygem-io-console-0:0.3-28.el6.x86_64", "product_id": "ruby193-rubygem-io-console-0:0.3-28.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-io-console@0.3-28.el6?arch=x86_64" } } }, { "category": "product_version", "name": "ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64", "product": { "name": "ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64", "product_id": "ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-ruby-tcltk@1.9.3.327-28.el6?arch=x86_64" } } }, { "category": "product_version", "name": "ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64", "product": { "name": "ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64", "product_id": "ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-ruby-doc@1.9.3.327-28.el6?arch=x86_64" } } }, { "category": "product_version", "name": "ruby193-ruby-0:1.9.3.327-28.el6.x86_64", "product": { "name": "ruby193-ruby-0:1.9.3.327-28.el6.x86_64", "product_id": "ruby193-ruby-0:1.9.3.327-28.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-ruby@1.9.3.327-28.el6?arch=x86_64" } } }, { "category": "product_version", "name": "ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64", "product": { "name": "ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64", "product_id": "ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-bigdecimal@1.1.0-28.el6?arch=x86_64" } } }, { "category": "product_version", "name": "ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64", "product": { "name": "ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64", "product_id": "ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-ruby-debuginfo@1.9.3.327-28.el6?arch=x86_64" } } }, { "category": "product_version", "name": "ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64", "product": { "name": "ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64", "product_id": "ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-ruby-devel@1.9.3.327-28.el6?arch=x86_64" } } }, { "category": "product_version", "name": "ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64", "product": { "name": "ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64", "product_id": "ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-rdoc@3.9.4-28.el6?arch=x86_64" } } }, { "category": "product_version", "name": "rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64", "product": { "name": "rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64", "product_id": "rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-json-debuginfo@1.7.3-2.el6op?arch=x86_64" } } }, { "category": "product_version", "name": "rubygem-json-0:1.7.3-2.el6op.x86_64", "product": { "name": "rubygem-json-0:1.7.3-2.el6op.x86_64", "product_id": "rubygem-json-0:1.7.3-2.el6op.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-json@1.7.3-2.el6op?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" }, { "branches": [ { "category": "product_version", "name": "ruby193-rubygems-0:1.8.23-28.el6.noarch", "product": { "name": "ruby193-rubygems-0:1.8.23-28.el6.noarch", "product_id": "ruby193-rubygems-0:1.8.23-28.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygems@1.8.23-28.el6?arch=noarch" } } }, { "category": "product_version", "name": "ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch", "product": { "name": "ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch", "product_id": "ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-ruby-irb@1.9.3.327-28.el6?arch=noarch" } } }, { "category": "product_version", "name": "ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch", "product": { "name": "ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch", "product_id": "ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-minitest@2.5.1-28.el6?arch=noarch" } } }, { "category": "product_version", "name": "ruby193-rubygems-devel-0:1.8.23-28.el6.noarch", "product": { "name": "ruby193-rubygems-devel-0:1.8.23-28.el6.noarch", "product_id": "ruby193-rubygems-devel-0:1.8.23-28.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygems-devel@1.8.23-28.el6?arch=noarch" } } }, { "category": "product_version", "name": "ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch", "product": { "name": "ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch", "product_id": "ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-rake@0.9.2.2-28.el6?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-json-doc-0:1.7.3-2.el6op.noarch", "product": { "name": "rubygem-json-doc-0:1.7.3-2.el6op.noarch", "product_id": "rubygem-json-doc-0:1.7.3-2.el6op.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-json-doc@1.7.3-2.el6op?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-rdoc-0:3.8-9.el6op.noarch", "product": { "name": "rubygem-rdoc-0:3.8-9.el6op.noarch", "product_id": "rubygem-rdoc-0:3.8-9.el6op.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rdoc@3.8-9.el6op?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-rdoc-doc-0:3.8-9.el6op.noarch", "product": { "name": "rubygem-rdoc-doc-0:3.8-9.el6op.noarch", "product_id": "rubygem-rdoc-doc-0:3.8-9.el6op.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rdoc-doc@3.8-9.el6op?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "ruby193-ruby-0:1.9.3.327-28.el6.src", "product": { "name": "ruby193-ruby-0:1.9.3.327-28.el6.src", "product_id": "ruby193-ruby-0:1.9.3.327-28.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-ruby@1.9.3.327-28.el6?arch=src" } } }, { "category": "product_version", "name": "rubygem-json-0:1.7.3-2.el6op.src", "product": { "name": "rubygem-json-0:1.7.3-2.el6op.src", "product_id": "rubygem-json-0:1.7.3-2.el6op.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-json@1.7.3-2.el6op?arch=src" } } }, { "category": "product_version", "name": "rubygem-rdoc-0:3.8-9.el6op.src", "product": { "name": "rubygem-rdoc-0:3.8-9.el6op.src", "product_id": "rubygem-rdoc-0:3.8-9.el6op.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rdoc@3.8-9.el6op?arch=src" } } } ], "category": "architecture", "name": "src" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "ruby193-ruby-0:1.9.3.327-28.el6.src as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.src" }, "product_reference": "ruby193-ruby-0:1.9.3.327-28.el6.src", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-ruby-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.x86_64" }, "product_reference": "ruby193-ruby-0:1.9.3.327-28.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64" }, "product_reference": "ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64" }, "product_reference": "ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64" }, "product_reference": "ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch" }, "product_reference": "ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64" }, "product_reference": "ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64" }, "product_reference": "ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64" }, "product_reference": "ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-io-console-0:0.3-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64" }, "product_reference": "ruby193-rubygem-io-console-0:0.3-28.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-json-0:1.5.4-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64" }, "product_reference": "ruby193-rubygem-json-0:1.5.4-28.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch" }, "product_reference": "ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch" }, "product_reference": "ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64" }, "product_reference": "ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygems-0:1.8.23-28.el6.noarch as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygems-0:1.8.23-28.el6.noarch" }, "product_reference": "ruby193-rubygems-0:1.8.23-28.el6.noarch", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygems-devel-0:1.8.23-28.el6.noarch as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch" }, "product_reference": "ruby193-rubygems-devel-0:1.8.23-28.el6.noarch", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-json-0:1.7.3-2.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.src" }, "product_reference": "rubygem-json-0:1.7.3-2.el6op.src", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-json-0:1.7.3-2.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.x86_64" }, "product_reference": "rubygem-json-0:1.7.3-2.el6op.x86_64", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64" }, "product_reference": "rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-json-doc-0:1.7.3-2.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:rubygem-json-doc-0:1.7.3-2.el6op.noarch" }, "product_reference": "rubygem-json-doc-0:1.7.3-2.el6op.noarch", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rdoc-0:3.8-9.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.noarch" }, "product_reference": "rubygem-rdoc-0:3.8-9.el6op.noarch", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rdoc-0:3.8-9.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.src" }, "product_reference": "rubygem-rdoc-0:3.8-9.el6op.src", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rdoc-doc-0:3.8-9.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:rubygem-rdoc-doc-0:3.8-9.el6op.noarch" }, "product_reference": "rubygem-rdoc-doc-0:3.8-9.el6op.noarch", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-ruby-0:1.9.3.327-28.el6.src as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.src" }, "product_reference": "ruby193-ruby-0:1.9.3.327-28.el6.src", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-ruby-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.x86_64" }, "product_reference": "ruby193-ruby-0:1.9.3.327-28.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64" }, "product_reference": "ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64" }, "product_reference": "ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64" }, "product_reference": "ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch" }, "product_reference": "ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64" }, "product_reference": "ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64" }, "product_reference": "ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64" }, "product_reference": "ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-io-console-0:0.3-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64" }, "product_reference": "ruby193-rubygem-io-console-0:0.3-28.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-json-0:1.5.4-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64" }, "product_reference": "ruby193-rubygem-json-0:1.5.4-28.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch" }, "product_reference": "ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch" }, "product_reference": "ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64" }, "product_reference": "ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygems-0:1.8.23-28.el6.noarch as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygems-0:1.8.23-28.el6.noarch" }, "product_reference": "ruby193-rubygems-0:1.8.23-28.el6.noarch", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygems-devel-0:1.8.23-28.el6.noarch as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch" }, "product_reference": "ruby193-rubygems-devel-0:1.8.23-28.el6.noarch", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-json-0:1.7.3-2.el6op.src as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.src" }, "product_reference": "rubygem-json-0:1.7.3-2.el6op.src", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-json-0:1.7.3-2.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.x86_64" }, "product_reference": "rubygem-json-0:1.7.3-2.el6op.x86_64", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64" }, "product_reference": "rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-json-doc-0:1.7.3-2.el6op.noarch as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:rubygem-json-doc-0:1.7.3-2.el6op.noarch" }, "product_reference": "rubygem-json-doc-0:1.7.3-2.el6op.noarch", "relates_to_product_reference": "6Server-RHOSE-NODE" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Eric Hodel" ], "organization": "RDoc upstream" }, { "names": [ "Evgeny Ermakov" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2013-0256", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2013-02-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "907820" } ], "notes": [ { "category": "description", "text": "darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.src", "6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygems-0:1.8.23-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch", "6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.src", "6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-INFRA:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-INFRA:rubygem-json-doc-0:1.7.3-2.el6op.noarch", "6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.noarch", "6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.src", "6Server-RHOSE-INFRA:rubygem-rdoc-doc-0:3.8-9.el6op.noarch", "6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.src", "6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygems-0:1.8.23-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch", "6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.src", "6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-NODE:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-NODE:rubygem-json-doc-0:1.7.3-2.el6op.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-0256" }, { "category": "external", "summary": "RHBZ#907820", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=907820" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0256", "url": "https://www.cve.org/CVERecord?id=CVE-2013-0256" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0256", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0256" }, { "category": "external", "summary": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/", "url": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/" } ], "release_date": "2013-02-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-04-02T19:58:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.src", "6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygems-0:1.8.23-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch", "6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.src", "6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-INFRA:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-INFRA:rubygem-json-doc-0:1.7.3-2.el6op.noarch", "6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.noarch", "6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.src", "6Server-RHOSE-INFRA:rubygem-rdoc-doc-0:3.8-9.el6op.noarch", "6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.src", "6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygems-0:1.8.23-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch", "6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.src", "6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-NODE:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-NODE:rubygem-json-doc-0:1.7.3-2.el6op.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0701" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0" }, "products": [ "6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.src", "6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygems-0:1.8.23-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch", "6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.src", "6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-INFRA:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-INFRA:rubygem-json-doc-0:1.7.3-2.el6op.noarch", "6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.noarch", "6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.src", "6Server-RHOSE-INFRA:rubygem-rdoc-doc-0:3.8-9.el6op.noarch", "6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.src", "6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygems-0:1.8.23-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch", "6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.src", "6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-NODE:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-NODE:rubygem-json-doc-0:1.7.3-2.el6op.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template" }, { "acknowledgments": [ { "names": [ "Ruby on Rails upstream" ] }, { "names": [ "Thomas Hollstegge" ], "organization": "Zweitag", "summary": "Acknowledged by upstream." }, { "names": [ "Ben Murphy" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2013-0269", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2013-02-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "909029" } ], "notes": [ { "category": "description", "text": "The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka \"Unsafe Object Creation Vulnerability.\"", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-json: Denial of Service and SQL Injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite tools ship RubyGem Json 1.4.6 which is earlier than affected 1.5.5 version however, this version of RubyGem is not affected to the flaw. We may update RubyGem in a future release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.src", "6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygems-0:1.8.23-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch", "6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.src", "6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-INFRA:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-INFRA:rubygem-json-doc-0:1.7.3-2.el6op.noarch", "6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.noarch", "6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.src", "6Server-RHOSE-INFRA:rubygem-rdoc-doc-0:3.8-9.el6op.noarch", "6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.src", "6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygems-0:1.8.23-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch", "6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.src", "6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-NODE:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-NODE:rubygem-json-doc-0:1.7.3-2.el6op.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-0269" }, { "category": "external", "summary": "RHBZ#909029", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=909029" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0269", "url": "https://www.cve.org/CVERecord?id=CVE-2013-0269" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0269", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0269" }, { "category": "external", "summary": "http://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/", "url": "http://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/" } ], "release_date": "2013-02-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-04-02T19:58:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.src", "6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygems-0:1.8.23-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch", "6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.src", "6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-INFRA:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-INFRA:rubygem-json-doc-0:1.7.3-2.el6op.noarch", "6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.noarch", "6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.src", "6Server-RHOSE-INFRA:rubygem-rdoc-doc-0:3.8-9.el6op.noarch", "6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.src", "6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygems-0:1.8.23-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch", "6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.src", "6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-NODE:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-NODE:rubygem-json-doc-0:1.7.3-2.el6op.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0701" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.src", "6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygems-0:1.8.23-28.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch", "6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.src", "6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-INFRA:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-INFRA:rubygem-json-doc-0:1.7.3-2.el6op.noarch", "6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.noarch", "6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.src", "6Server-RHOSE-INFRA:rubygem-rdoc-doc-0:3.8-9.el6op.noarch", "6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.src", "6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygems-0:1.8.23-28.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch", "6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.src", "6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-NODE:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64", "6Server-RHOSE-NODE:rubygem-json-doc-0:1.7.3-2.el6op.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-json: Denial of Service and SQL Injection" } ] }
rhsa-2013_0686
Vulnerability from csaf_redhat
Published
2013-03-26 19:10
Modified
2024-11-05 18:04
Summary
Red Hat Security Advisory: Subscription Asset Manager 1.2.1 update
Notes
Topic
Red Hat Subscription Asset Manager 1.2.1, which fixes several security
issues, multiple bugs, and adds various enhancements, is now available.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat Subscription Asset Manager acts as a proxy for handling
subscription information and software updates on client machines.
The latest packages for Subscription Asset Manager include a number of security fixes:
When a Subscription Asset Manager instance is created, its configuration
script automatically creates an RPM of the internal subscription service
CA certificate. However, this RPM incorrectly created the CA certificate
with file permissions of 0666. This allowed other users on a client system
to modify the CA certificate used to trust the remote subscription server.
All administrators are advised to update and deploy the subscription
service certificate on all systems which use Subscription Asset Manager
as their subscription service. This procedure is described in:
https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Subscription_Asset_Manager/1.2/html/Installation_Guide/sect-Installation_Guide-Administration-Upgrading_Subscription_Asset_Manager.html
(CVE-2012-6116)
Manifest signature checking was not implemented for early versions of
Subscription Asset Manager. This meant that a malicious user could edit
a manifest file, insert arbitrary data, and successfully upload the edited
manifest file into the Subscription Asset Manager server. (CVE-2012-6119)
Ruby's documentation generator had a flaw in the way it generated HTML
documentation. When a Ruby application exposed its documentation
on a network (such as a web page), an attacker could use a specially-
crafted URL to open an arbitrary web script or to execute HTML code
within the application's user session. (CVE-2013-0256)
A timing attack flaw was found in the way rubygem-rack and
ruby193-rubygem-rack processed HMAC digests in cookies. This flaw could aid
an attacker using forged digital signatures to bypass authentication
checks. (CVE-2013-0263)
A flaw in rubygem-json allowed remote attacks by creating different types
of malicious objects. For example, it could initiate a denial of service
(DoS) attack through resource consumption by using a JSON document to
create arbitrary Ruby symbols, which were never garbage collected. It
could also be exploited to create internal objects which could allow a SQL
injection attack. (CVE-2013-0269)
A flaw in ActiveRecord in Ruby on Rails allowed remote attackers to
circumvent attribute protections and to insert their own crafted requests
to change protected attribute values. (CVE-2013-0276)
HTML markup was not properly escaped when filling in the username field in
the Notifications form of the Subscription Asset Manager UI. This meant
that HTML code used in the value was then applied in the UI page when the
entry was viewed. This could have allowed malicious HTML code to be
entered. The field value is now validated and any HTML tags are escaped.
(CVE-2013-1823)
These updated packages also include bug fixes and enhancements:
* Previously, no SELinux policy for the subscription service was included
with the Subscription Asset Manager packages. The candlepin-selinux package
is now included with SELinux policies for the subscription server.
(BZ#906901)
* When attempting to use the subscription service's CA certificate to
validate a manifest during import, the comparison failed. The upstream
subscription service which generated the manifest is a different service
than the local subscription service; thus, they have different CA
certificates. This caused importing a manifest to fail with the error
'archive failed signature'. This has been fixed so that the proper
certificate is used for verification. (BZ#918778)
All users of Subscription Asset Manager are recommended to update to the
latest packages.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Red Hat Subscription Asset Manager 1.2.1, which fixes several security\nissues, multiple bugs, and adds various enhancements, is now available.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Subscription Asset Manager acts as a proxy for handling\nsubscription information and software updates on client machines.\n\nThe latest packages for Subscription Asset Manager include a number of security fixes:\n\nWhen a Subscription Asset Manager instance is created, its configuration\nscript automatically creates an RPM of the internal subscription service \nCA certificate. However, this RPM incorrectly created the CA certificate\nwith file permissions of 0666. This allowed other users on a client system\nto modify the CA certificate used to trust the remote subscription server.\nAll administrators are advised to update and deploy the subscription\nservice certificate on all systems which use Subscription Asset Manager\nas their subscription service. This procedure is described in:\nhttps://access.redhat.com/knowledge/docs/en-US/Red_Hat_Subscription_Asset_Manager/1.2/html/Installation_Guide/sect-Installation_Guide-Administration-Upgrading_Subscription_Asset_Manager.html\n(CVE-2012-6116)\n\nManifest signature checking was not implemented for early versions of \nSubscription Asset Manager. This meant that a malicious user could edit\na manifest file, insert arbitrary data, and successfully upload the edited\nmanifest file into the Subscription Asset Manager server. (CVE-2012-6119)\n\nRuby\u0027s documentation generator had a flaw in the way it generated HTML\ndocumentation. When a Ruby application exposed its documentation\non a network (such as a web page), an attacker could use a specially-\ncrafted URL to open an arbitrary web script or to execute HTML code\nwithin the application\u0027s user session. (CVE-2013-0256)\n\nA timing attack flaw was found in the way rubygem-rack and\nruby193-rubygem-rack processed HMAC digests in cookies. This flaw could aid\nan attacker using forged digital signatures to bypass authentication\nchecks. (CVE-2013-0263)\n\nA flaw in rubygem-json allowed remote attacks by creating different types\nof malicious objects. For example, it could initiate a denial of service\n(DoS) attack through resource consumption by using a JSON document to\ncreate arbitrary Ruby symbols, which were never garbage collected. It\ncould also be exploited to create internal objects which could allow a SQL\ninjection attack. (CVE-2013-0269)\n\nA flaw in ActiveRecord in Ruby on Rails allowed remote attackers to\ncircumvent attribute protections and to insert their own crafted requests\nto change protected attribute values. (CVE-2013-0276)\n\nHTML markup was not properly escaped when filling in the username field in\nthe Notifications form of the Subscription Asset Manager UI. This meant\nthat HTML code used in the value was then applied in the UI page when the\nentry was viewed. This could have allowed malicious HTML code to be\nentered. The field value is now validated and any HTML tags are escaped.\n(CVE-2013-1823)\n\nThese updated packages also include bug fixes and enhancements:\n\n* Previously, no SELinux policy for the subscription service was included\nwith the Subscription Asset Manager packages. The candlepin-selinux package\nis now included with SELinux policies for the subscription server. \n(BZ#906901)\n\n* When attempting to use the subscription service\u0027s CA certificate to\nvalidate a manifest during import, the comparison failed. The upstream\nsubscription service which generated the manifest is a different service\nthan the local subscription service; thus, they have different CA\ncertificates. This caused importing a manifest to fail with the error\n\u0027archive failed signature\u0027. This has been fixed so that the proper\ncertificate is used for verification. (BZ#918778)\n\nAll users of Subscription Asset Manager are recommended to update to the\nlatest packages.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2013:0686", "url": "https://access.redhat.com/errata/RHSA-2013:0686" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "906207", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=906207" }, { "category": "external", "summary": "906901", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=906901" }, { "category": "external", "summary": "907820", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=907820" }, { "category": "external", "summary": "908613", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=908613" }, { "category": "external", "summary": "909029", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=909029" }, { "category": "external", "summary": "909071", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=909071" }, { "category": "external", "summary": "909528", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=909528" }, { "category": "external", "summary": "918778", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=918778" }, { "category": "external", "summary": "918784", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=918784" }, { "category": "external", "summary": "922190", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=922190" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0686.json" } ], "title": "Red Hat Security Advisory: Subscription Asset Manager 1.2.1 update", "tracking": { "current_release_date": "2024-11-05T18:04:01+00:00", "generator": { "date": "2024-11-05T18:04:01+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2013:0686", "initial_release_date": "2013-03-26T19:10:00+00:00", "revision_history": [ { "date": "2013-03-26T19:10:00+00:00", "number": "1", "summary": "Initial version" }, { "date": "2013-03-26T19:16:44+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T18:04:01+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Subscription Asset Manager for RHEL 6 Server", "product": { "name": "Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12", "product_identification_helper": { "cpe": "cpe:/a:rhel_sam:1.2::el6" } } } ], "category": "product_family", "name": "Red Hat Subscription Asset Manager" }, { "branches": [ { "category": "product_version", "name": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "product": { "name": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "product_id": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rails_warden-doc@0.5.5-2.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "product": { "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "product_id": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rails_warden@0.5.5-2.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "product": { "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "product_id": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-delayed_job@2.1.4-3.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "product": { "name": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "product_id": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-delayed_job-doc@2.1.4-3.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "product": { "name": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "product_id": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-nokogiri-doc@1.5.0-0.9.beta4.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "product": { "name": "rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "product_id": "rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-actionpack@3.0.10-12.el6cf?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "candlepin-0:0.7.24-1.el6_3.noarch", "product": { "name": "candlepin-0:0.7.24-1.el6_3.noarch", "product_id": "candlepin-0:0.7.24-1.el6_3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin@0.7.24-1.el6_3?arch=noarch" } } }, { "category": "product_version", "name": "candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "product": { "name": "candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "product_id": "candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin-tomcat6@0.7.24-1.el6_3?arch=noarch" } } }, { "category": "product_version", "name": "candlepin-selinux-0:0.7.24-1.el6_3.noarch", "product": { "name": "candlepin-selinux-0:0.7.24-1.el6_3.noarch", "product_id": "candlepin-selinux-0:0.7.24-1.el6_3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin-selinux@0.7.24-1.el6_3?arch=noarch" } } }, { "category": "product_version", "name": "candlepin-devel-0:0.7.24-1.el6_3.noarch", "product": { "name": "candlepin-devel-0:0.7.24-1.el6_3.noarch", "product_id": "candlepin-devel-0:0.7.24-1.el6_3.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin-devel@0.7.24-1.el6_3?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-rack-1:1.3.0-4.el6cf.noarch", "product": { "name": "rubygem-rack-1:1.3.0-4.el6cf.noarch", "product_id": "rubygem-rack-1:1.3.0-4.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rack@1.3.0-4.el6cf?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "product": { "name": "rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "product_id": "rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-activemodel-doc@3.0.10-3.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "product": { "name": "rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "product_id": "rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-activemodel@3.0.10-3.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "product": { "name": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "product_id": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rdoc-doc@3.8-6.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-rdoc-0:3.8-6.el6cf.noarch", "product": { "name": "rubygem-rdoc-0:3.8-6.el6cf.noarch", "product_id": "rubygem-rdoc-0:3.8-6.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rdoc@3.8-6.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "product": { "name": "katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "product_id": "katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-headpin@1.2.1.1-1h.el6_4?arch=noarch" } } }, { "category": "product_version", "name": "katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "product": { "name": "katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "product_id": "katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-glue-candlepin@1.2.1.1-1h.el6_4?arch=noarch" } } }, { "category": "product_version", "name": "katello-common-0:1.2.1.1-1h.el6_4.noarch", "product": { "name": "katello-common-0:1.2.1.1-1h.el6_4.noarch", "product_id": "katello-common-0:1.2.1.1-1h.el6_4.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-common@1.2.1.1-1h.el6_4?arch=noarch" } } }, { "category": "product_version", "name": "katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "product": { "name": "katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "product_id": "katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-headpin-all@1.2.1.1-1h.el6_4?arch=noarch" } } }, { "category": "product_version", "name": "thumbslug-0:0.0.28.1-1.el6_4.noarch", "product": { "name": "thumbslug-0:0.0.28.1-1.el6_4.noarch", "product_id": "thumbslug-0:0.0.28.1-1.el6_4.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/thumbslug@0.0.28.1-1.el6_4?arch=noarch" } } }, { "category": "product_version", "name": "thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch", "product": { "name": "thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch", "product_id": "thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/thumbslug-selinux@0.0.28.1-1.el6_4?arch=noarch" } } }, { "category": "product_version", "name": "katello-configure-0:1.2.3.1-4h.el6_4.noarch", "product": { "name": "katello-configure-0:1.2.3.1-4h.el6_4.noarch", "product_id": "katello-configure-0:1.2.3.1-4h.el6_4.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-configure@1.2.3.1-4h.el6_4?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.src", "product": { "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.src", "product_id": "rubygem-rails_warden-0:0.5.5-2.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rails_warden@0.5.5-2.el6cf?arch=src" } } }, { "category": "product_version", "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.src", "product": { "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.src", "product_id": "rubygem-delayed_job-0:2.1.4-3.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-delayed_job@2.1.4-3.el6cf?arch=src" } } }, { "category": "product_version", "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "product": { "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "product_id": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-nokogiri@1.5.0-0.9.beta4.el6cf?arch=src" } } }, { "category": "product_version", "name": "rubygem-actionpack-1:3.0.10-12.el6cf.src", "product": { "name": "rubygem-actionpack-1:3.0.10-12.el6cf.src", "product_id": "rubygem-actionpack-1:3.0.10-12.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-actionpack@3.0.10-12.el6cf?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "candlepin-0:0.7.24-1.el6_3.src", "product": { "name": "candlepin-0:0.7.24-1.el6_3.src", "product_id": "candlepin-0:0.7.24-1.el6_3.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/candlepin@0.7.24-1.el6_3?arch=src" } } }, { "category": "product_version", "name": "rubygem-rack-1:1.3.0-4.el6cf.src", "product": { "name": "rubygem-rack-1:1.3.0-4.el6cf.src", "product_id": "rubygem-rack-1:1.3.0-4.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rack@1.3.0-4.el6cf?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "rubygem-activemodel-0:3.0.10-3.el6cf.src", "product": { "name": "rubygem-activemodel-0:3.0.10-3.el6cf.src", "product_id": "rubygem-activemodel-0:3.0.10-3.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-activemodel@3.0.10-3.el6cf?arch=src" } } }, { "category": "product_version", "name": "rubygem-rdoc-0:3.8-6.el6cf.src", "product": { "name": "rubygem-rdoc-0:3.8-6.el6cf.src", "product_id": "rubygem-rdoc-0:3.8-6.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rdoc@3.8-6.el6cf?arch=src" } } }, { "category": "product_version", "name": "katello-0:1.2.1.1-1h.el6_4.src", "product": { "name": "katello-0:1.2.1.1-1h.el6_4.src", "product_id": "katello-0:1.2.1.1-1h.el6_4.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello@1.2.1.1-1h.el6_4?arch=src" } } }, { "category": "product_version", "name": "rubygem-json-0:1.7.3-2.el6_3.src", "product": { "name": "rubygem-json-0:1.7.3-2.el6_3.src", "product_id": "rubygem-json-0:1.7.3-2.el6_3.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-json@1.7.3-2.el6_3?arch=src" } } }, { "category": "product_version", "name": "thumbslug-0:0.0.28.1-1.el6_4.src", "product": { "name": "thumbslug-0:0.0.28.1-1.el6_4.src", "product_id": "thumbslug-0:0.0.28.1-1.el6_4.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/thumbslug@0.0.28.1-1.el6_4?arch=src" } } }, { "category": "product_version", "name": "katello-configure-0:1.2.3.1-4h.el6_4.src", "product": { "name": "katello-configure-0:1.2.3.1-4h.el6_4.src", "product_id": "katello-configure-0:1.2.3.1-4h.el6_4.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-configure@1.2.3.1-4h.el6_4?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "product": { "name": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "product_id": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-nokogiri-debuginfo@1.5.0-0.9.beta4.el6cf?arch=x86_64" } } }, { "category": "product_version", "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "product": { "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "product_id": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-nokogiri@1.5.0-0.9.beta4.el6cf?arch=x86_64" } } }, { "category": "product_version", "name": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "product": { "name": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "product_id": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby-nokogiri@1.5.0-0.9.beta4.el6cf?arch=x86_64" } } }, { "category": "product_version", "name": "rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "product": { "name": "rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "product_id": "rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-json-debuginfo@1.7.3-2.el6_3?arch=x86_64" } } }, { "category": "product_version", "name": "rubygem-json-0:1.7.3-2.el6_3.x86_64", "product": { "name": "rubygem-json-0:1.7.3-2.el6_3.x86_64", "product_id": "rubygem-json-0:1.7.3-2.el6_3.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-json@1.7.3-2.el6_3?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "candlepin-0:0.7.24-1.el6_3.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch" }, "product_reference": "candlepin-0:0.7.24-1.el6_3.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-0:0.7.24-1.el6_3.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src" }, "product_reference": "candlepin-0:0.7.24-1.el6_3.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-devel-0:0.7.24-1.el6_3.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch" }, "product_reference": "candlepin-devel-0:0.7.24-1.el6_3.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-selinux-0:0.7.24-1.el6_3.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch" }, "product_reference": "candlepin-selinux-0:0.7.24-1.el6_3.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "candlepin-tomcat6-0:0.7.24-1.el6_3.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch" }, "product_reference": "candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "katello-0:1.2.1.1-1h.el6_4.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src" }, "product_reference": "katello-0:1.2.1.1-1h.el6_4.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "katello-common-0:1.2.1.1-1h.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch" }, "product_reference": "katello-common-0:1.2.1.1-1h.el6_4.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "katello-configure-0:1.2.3.1-4h.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch" }, "product_reference": "katello-configure-0:1.2.3.1-4h.el6_4.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "katello-configure-0:1.2.3.1-4h.el6_4.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src" }, "product_reference": "katello-configure-0:1.2.3.1-4h.el6_4.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch" }, "product_reference": "katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "katello-headpin-0:1.2.1.1-1h.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch" }, "product_reference": "katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch" }, "product_reference": "katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64 as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64" }, "product_reference": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-actionpack-1:3.0.10-12.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch" }, "product_reference": "rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-actionpack-1:3.0.10-12.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src" }, "product_reference": "rubygem-actionpack-1:3.0.10-12.el6cf.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-activemodel-0:3.0.10-3.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch" }, "product_reference": "rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-activemodel-0:3.0.10-3.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src" }, "product_reference": "rubygem-activemodel-0:3.0.10-3.el6cf.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch" }, "product_reference": "rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch" }, "product_reference": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src" }, "product_reference": "rubygem-delayed_job-0:2.1.4-3.el6cf.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch" }, "product_reference": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-json-0:1.7.3-2.el6_3.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src" }, "product_reference": "rubygem-json-0:1.7.3-2.el6_3.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-json-0:1.7.3-2.el6_3.x86_64 as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64" }, "product_reference": "rubygem-json-0:1.7.3-2.el6_3.x86_64", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64 as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64" }, "product_reference": "rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src" }, "product_reference": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64 as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64" }, "product_reference": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64 as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64" }, "product_reference": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch" }, "product_reference": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rack-1:1.3.0-4.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch" }, "product_reference": "rubygem-rack-1:1.3.0-4.el6cf.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rack-1:1.3.0-4.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src" }, "product_reference": "rubygem-rack-1:1.3.0-4.el6cf.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch" }, "product_reference": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src" }, "product_reference": "rubygem-rails_warden-0:0.5.5-2.el6cf.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch" }, "product_reference": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rdoc-0:3.8-6.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch" }, "product_reference": "rubygem-rdoc-0:3.8-6.el6cf.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rdoc-0:3.8-6.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src" }, "product_reference": "rubygem-rdoc-0:3.8-6.el6cf.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch" }, "product_reference": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "thumbslug-0:0.0.28.1-1.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch" }, "product_reference": "thumbslug-0:0.0.28.1-1.el6_4.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "thumbslug-0:0.0.28.1-1.el6_4.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src" }, "product_reference": "thumbslug-0:0.0.28.1-1.el6_4.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" }, { "category": "default_component_of", "full_product_name": { "name": "thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" }, "product_reference": "thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager12" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Dominic Cleal" ] }, { "names": [ "James Laska" ], "organization": "Red Hat", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2012-6116", "discovery_date": "2012-11-16T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "906207" } ], "notes": [ { "category": "description", "text": "modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.", "title": "Vulnerability description" }, { "category": "summary", "text": "Candlepin: bootstrap RPM deploys CA certificate file with mode 666", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-6116" }, { "category": "external", "summary": "RHBZ#906207", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=906207" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-6116", "url": "https://www.cve.org/CVERecord?id=CVE-2012-6116" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6116", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6116" } ], "release_date": "2013-02-21T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-03-26T19:10:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0686" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.6, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Candlepin: bootstrap RPM deploys CA certificate file with mode 666" }, { "cve": "CVE-2012-6119", "discovery_date": "2013-02-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "908613" } ], "notes": [ { "category": "description", "text": "Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests.", "title": "Vulnerability description" }, { "category": "summary", "text": "Candlepin: Re-enable manifest signature checking", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-6119" }, { "category": "external", "summary": "RHBZ#908613", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=908613" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-6119", "url": "https://www.cve.org/CVERecord?id=CVE-2012-6119" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6119", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6119" } ], "release_date": "2012-06-27T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-03-26T19:10:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0686" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "SINGLE", "availabilityImpact": "NONE", "baseScore": 4.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N", "version": "2.0" }, "products": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "Candlepin: Re-enable manifest signature checking" }, { "acknowledgments": [ { "names": [ "Eric Hodel" ], "organization": "RDoc upstream" }, { "names": [ "Evgeny Ermakov" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2013-0256", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2013-02-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "907820" } ], "notes": [ { "category": "description", "text": "darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-0256" }, { "category": "external", "summary": "RHBZ#907820", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=907820" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0256", "url": "https://www.cve.org/CVERecord?id=CVE-2013-0256" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0256", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0256" }, { "category": "external", "summary": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/", "url": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/" } ], "release_date": "2013-02-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-03-26T19:10:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0686" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0" }, "products": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template" }, { "cve": "CVE-2013-0263", "discovery_date": "2013-02-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "909071" } ], "notes": [ { "category": "description", "text": "Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-rack: Timing attack in cookie sessions", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-0263" }, { "category": "external", "summary": "RHBZ#909071", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=909071" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0263", "url": "https://www.cve.org/CVERecord?id=CVE-2013-0263" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0263", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0263" } ], "release_date": "2013-02-08T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-03-26T19:10:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0686" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "PARTIAL", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "version": "2.0" }, "products": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-rack: Timing attack in cookie sessions" }, { "acknowledgments": [ { "names": [ "Ruby on Rails upstream" ] }, { "names": [ "Thomas Hollstegge" ], "organization": "Zweitag", "summary": "Acknowledged by upstream." }, { "names": [ "Ben Murphy" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2013-0269", "cwe": { "id": "CWE-502", "name": "Deserialization of Untrusted Data" }, "discovery_date": "2013-02-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "909029" } ], "notes": [ { "category": "description", "text": "The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka \"Unsafe Object Creation Vulnerability.\"", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-json: Denial of Service and SQL Injection", "title": "Vulnerability summary" }, { "category": "other", "text": "Red Hat Satellite tools ship RubyGem Json 1.4.6 which is earlier than affected 1.5.5 version however, this version of RubyGem is not affected to the flaw. We may update RubyGem in a future release.", "title": "Statement" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-0269" }, { "category": "external", "summary": "RHBZ#909029", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=909029" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0269", "url": "https://www.cve.org/CVERecord?id=CVE-2013-0269" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0269", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0269" }, { "category": "external", "summary": "http://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/", "url": "http://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/" } ], "release_date": "2013-02-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-03-26T19:10:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0686" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-json: Denial of Service and SQL Injection" }, { "cve": "CVE-2013-0276", "discovery_date": "2013-02-08T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "909528" } ], "notes": [ { "category": "description", "text": "ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-activerecord/rubygem-activemodel: circumvention of attr_protected", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-0276" }, { "category": "external", "summary": "RHBZ#909528", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=909528" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0276", "url": "https://www.cve.org/CVERecord?id=CVE-2013-0276" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0276", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0276" } ], "release_date": "2013-02-11T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-03-26T19:10:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0686" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0" }, "products": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-activerecord/rubygem-activemodel: circumvention of attr_protected" }, { "acknowledgments": [ { "names": [ "Sureshkumar Thirugnanasambandan" ], "organization": "Red Hat Quality Engineering Team", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2013-1823", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2013-02-12T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "918784" } ], "notes": [ { "category": "description", "text": "Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field.", "title": "Vulnerability description" }, { "category": "summary", "text": "Katello: Notifications page Username XSS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-1823" }, { "category": "external", "summary": "RHBZ#918784", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=918784" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-1823", "url": "https://www.cve.org/CVERecord?id=CVE-2013-1823" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-1823", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1823" } ], "release_date": "2013-03-26T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-03-26T19:10:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0686" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "products": [ "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src", "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch", "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src", "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch", "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src", "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch", "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src", "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "Katello: Notifications page Username XSS" } ] }
rhsa-2013_0728
Vulnerability from csaf_redhat
Published
2013-04-09 18:08
Modified
2024-11-05 18:05
Summary
Red Hat Security Advisory: rubygem packages security update
Notes
Topic
This update fixes one security issue in multiple rubygem packages for
Red Hat OpenShift Enterprise 1.1.3.
The Red Hat Security Response Team has rated this update as having moderate
security impact. A Common Vulnerability Scoring System (CVSS) base score,
which gives a detailed severity rating, is available from the CVE link in
the References section.
Details
Ruby is an extensible, interpreted, object-oriented, scripting language. It
has features to process text files and to do system management tasks.
It was found that documentation created by RDoc was vulnerable to a
cross-site scripting (XSS) attack. If such documentation was accessible
over a network, and a remote attacker could trick a user into visiting a
specially-crafted URL, it would lead to arbitrary web script execution in
the context of the user's session. As RDoc is used for creating
documentation for Ruby source files (such as classes, modules, and so on),
it is not a common scenario to make such documentation accessible over the
network. (CVE-2013-0256)
This update provides a number of updated rubygem packages that have had
their documentation regenerated with a corrected version of RDoc.
Red Hat would like to thank Eric Hodel of RDoc upstream for reporting this
issue. Upstream acknowledges Evgeny Ermakov as the original reporter.
Users of Red Hat OpenShift Enterprise 1.1.3 are advised to upgrade to these
updated packages, which correct this issue.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "This update fixes one security issue in multiple rubygem packages for\nRed Hat OpenShift Enterprise 1.1.3.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. A Common Vulnerability Scoring System (CVSS) base score,\nwhich gives a detailed severity rating, is available from the CVE link in\nthe References section.", "title": "Topic" }, { "category": "general", "text": "Ruby is an extensible, interpreted, object-oriented, scripting language. It\nhas features to process text files and to do system management tasks.\n\nIt was found that documentation created by RDoc was vulnerable to a\ncross-site scripting (XSS) attack. If such documentation was accessible\nover a network, and a remote attacker could trick a user into visiting a\nspecially-crafted URL, it would lead to arbitrary web script execution in\nthe context of the user\u0027s session. As RDoc is used for creating\ndocumentation for Ruby source files (such as classes, modules, and so on),\nit is not a common scenario to make such documentation accessible over the\nnetwork. (CVE-2013-0256)\n\nThis update provides a number of updated rubygem packages that have had\ntheir documentation regenerated with a corrected version of RDoc.\n\nRed Hat would like to thank Eric Hodel of RDoc upstream for reporting this\nissue. Upstream acknowledges Evgeny Ermakov as the original reporter.\n\nUsers of Red Hat OpenShift Enterprise 1.1.3 are advised to upgrade to these\nupdated packages, which correct this issue.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2013:0728", "url": "https://access.redhat.com/errata/RHSA-2013:0728" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "907820", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=907820" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0728.json" } ], "title": "Red Hat Security Advisory: rubygem packages security update", "tracking": { "current_release_date": "2024-11-05T18:05:00+00:00", "generator": { "date": "2024-11-05T18:05:00+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2013:0728", "initial_release_date": "2013-04-09T18:08:00+00:00", "revision_history": [ { "date": "2013-04-09T18:08:00+00:00", "number": "1", "summary": "Initial version" }, { "date": "2013-04-09T18:11:45+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T18:05:00+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat OpenShift Enterprise Infrastructure", "product": { "name": "Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:1::el6" } } }, { "category": "product_name", "name": "Red Hat OpenShift Enterprise Node", "product": { "name": "Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE", "product_identification_helper": { "cpe": "cpe:/a:redhat:openshift:1::el6" } } } ], "category": "product_family", "name": "Red Hat OpenShift Enterprise" }, { "branches": [ { "category": "product_version", "name": "ruby193-rubygem-activesupport-1:3.2.8-4.el6.noarch", "product": { "name": "ruby193-rubygem-activesupport-1:3.2.8-4.el6.noarch", "product_id": "ruby193-rubygem-activesupport-1:3.2.8-4.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-activesupport@3.2.8-4.el6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "ruby193-rubygem-http_connection-0:1.4.1-7.el6.noarch", "product": { "name": "ruby193-rubygem-http_connection-0:1.4.1-7.el6.noarch", "product_id": "ruby193-rubygem-http_connection-0:1.4.1-7.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-http_connection@1.4.1-7.el6?arch=noarch" } } }, { "category": "product_version", "name": "ruby193-rubygem-rack-test-0:0.6.1-3.el6.noarch", "product": { "name": "ruby193-rubygem-rack-test-0:0.6.1-3.el6.noarch", "product_id": "ruby193-rubygem-rack-test-0:0.6.1-3.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-rack-test@0.6.1-3.el6?arch=noarch" } } }, { "category": "product_version", "name": "ruby193-rubygem-rspec-0:2.11.0-2.el6.noarch", "product": { "name": "ruby193-rubygem-rspec-0:2.11.0-2.el6.noarch", "product_id": "ruby193-rubygem-rspec-0:2.11.0-2.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-rspec@2.11.0-2.el6?arch=noarch" } } }, { "category": "product_version", "name": "ruby193-rubygem-treetop-0:1.4.10-6.el6.noarch", "product": { "name": "ruby193-rubygem-treetop-0:1.4.10-6.el6.noarch", "product_id": "ruby193-rubygem-treetop-0:1.4.10-6.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-treetop@1.4.10-6.el6?arch=noarch" } } }, { "category": "product_version", "name": "ruby193-rubygem-rack-1:1.4.1-5.el6.noarch", "product": { "name": "ruby193-rubygem-rack-1:1.4.1-5.el6.noarch", "product_id": "ruby193-rubygem-rack-1:1.4.1-5.el6.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-rack@1.4.1-5.el6?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "ruby193-rubygem-ci_reporter-0:1.7.2-4.el6op.noarch", "product": { "name": "ruby193-rubygem-ci_reporter-0:1.7.2-4.el6op.noarch", "product_id": "ruby193-rubygem-ci_reporter-0:1.7.2-4.el6op.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-ci_reporter@1.7.2-4.el6op?arch=noarch" } } }, { "category": "product_version", "name": "ruby193-rubygem-haml-0:3.1.7-3.el6op.noarch", "product": { "name": "ruby193-rubygem-haml-0:3.1.7-3.el6op.noarch", "product_id": "ruby193-rubygem-haml-0:3.1.7-3.el6op.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-haml@3.1.7-3.el6op?arch=noarch" } } }, { "category": "product_version", "name": "ruby193-rubygem-compass-0:0.12.2-4.el6op.noarch", "product": { "name": "ruby193-rubygem-compass-0:0.12.2-4.el6op.noarch", "product_id": "ruby193-rubygem-compass-0:0.12.2-4.el6op.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-compass@0.12.2-4.el6op?arch=noarch" } } }, { "category": "product_version", "name": "ruby193-rubygem-chunky_png-0:1.2.6-3.el6op.noarch", "product": { "name": "ruby193-rubygem-chunky_png-0:1.2.6-3.el6op.noarch", "product_id": "ruby193-rubygem-chunky_png-0:1.2.6-3.el6op.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-chunky_png@1.2.6-3.el6op?arch=noarch" } } }, { "category": "product_version", "name": "ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.noarch", "product": { "name": "ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.noarch", "product_id": "ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-xml-simple@1.0.12-10.el6op?arch=noarch" } } }, { "category": "product_version", "name": "ruby193-rubygem-bson-0:1.5.2-6.el6op.noarch", "product": { "name": "ruby193-rubygem-bson-0:1.5.2-6.el6op.noarch", "product_id": "ruby193-rubygem-bson-0:1.5.2-6.el6op.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-bson@1.5.2-6.el6op?arch=noarch" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "ruby193-rubygem-activesupport-1:3.2.8-4.el6.src", "product": { "name": "ruby193-rubygem-activesupport-1:3.2.8-4.el6.src", "product_id": "ruby193-rubygem-activesupport-1:3.2.8-4.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-activesupport@3.2.8-4.el6?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "ruby193-rubygem-http_connection-0:1.4.1-7.el6.src", "product": { "name": "ruby193-rubygem-http_connection-0:1.4.1-7.el6.src", "product_id": "ruby193-rubygem-http_connection-0:1.4.1-7.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-http_connection@1.4.1-7.el6?arch=src" } } }, { "category": "product_version", "name": "ruby193-rubygem-rack-test-0:0.6.1-3.el6.src", "product": { "name": "ruby193-rubygem-rack-test-0:0.6.1-3.el6.src", "product_id": "ruby193-rubygem-rack-test-0:0.6.1-3.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-rack-test@0.6.1-3.el6?arch=src" } } }, { "category": "product_version", "name": "ruby193-rubygem-rspec-0:2.11.0-2.el6.src", "product": { "name": "ruby193-rubygem-rspec-0:2.11.0-2.el6.src", "product_id": "ruby193-rubygem-rspec-0:2.11.0-2.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-rspec@2.11.0-2.el6?arch=src" } } }, { "category": "product_version", "name": "ruby193-rubygem-treetop-0:1.4.10-6.el6.src", "product": { "name": "ruby193-rubygem-treetop-0:1.4.10-6.el6.src", "product_id": "ruby193-rubygem-treetop-0:1.4.10-6.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-treetop@1.4.10-6.el6?arch=src" } } }, { "category": "product_version", "name": "ruby193-rubygem-rack-1:1.4.1-5.el6.src", "product": { "name": "ruby193-rubygem-rack-1:1.4.1-5.el6.src", "product_id": "ruby193-rubygem-rack-1:1.4.1-5.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-rack@1.4.1-5.el6?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "ruby193-rubygem-ci_reporter-0:1.7.2-4.el6op.src", "product": { "name": "ruby193-rubygem-ci_reporter-0:1.7.2-4.el6op.src", "product_id": "ruby193-rubygem-ci_reporter-0:1.7.2-4.el6op.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-ci_reporter@1.7.2-4.el6op?arch=src" } } }, { "category": "product_version", "name": "ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.src", "product": { "name": "ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.src", "product_id": "ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-bcrypt-ruby@3.0.1-7.el6?arch=src" } } }, { "category": "product_version", "name": "ruby193-rubygem-haml-0:3.1.7-3.el6op.src", "product": { "name": "ruby193-rubygem-haml-0:3.1.7-3.el6op.src", "product_id": "ruby193-rubygem-haml-0:3.1.7-3.el6op.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-haml@3.1.7-3.el6op?arch=src" } } }, { "category": "product_version", "name": "ruby193-rubygem-compass-0:0.12.2-4.el6op.src", "product": { "name": "ruby193-rubygem-compass-0:0.12.2-4.el6op.src", "product_id": "ruby193-rubygem-compass-0:0.12.2-4.el6op.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-compass@0.12.2-4.el6op?arch=src" } } }, { "category": "product_version", "name": "ruby193-rubygem-chunky_png-0:1.2.6-3.el6op.src", "product": { "name": "ruby193-rubygem-chunky_png-0:1.2.6-3.el6op.src", "product_id": "ruby193-rubygem-chunky_png-0:1.2.6-3.el6op.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-chunky_png@1.2.6-3.el6op?arch=src" } } }, { "category": "product_version", "name": "ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.src", "product": { "name": "ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.src", "product_id": "ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-xml-simple@1.0.12-10.el6op?arch=src" } } }, { "category": "product_version", "name": "ruby193-rubygem-bson-0:1.5.2-6.el6op.src", "product": { "name": "ruby193-rubygem-bson-0:1.5.2-6.el6op.src", "product_id": "ruby193-rubygem-bson-0:1.5.2-6.el6op.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-bson@1.5.2-6.el6op?arch=src" } } }, { "category": "product_version", "name": "ruby193-rubygem-fastthread-0:1.0.7-7.el6op.src", "product": { "name": "ruby193-rubygem-fastthread-0:1.0.7-7.el6op.src", "product_id": "ruby193-rubygem-fastthread-0:1.0.7-7.el6op.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-fastthread@1.0.7-7.el6op?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.x86_64", "product": { "name": "ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.x86_64", "product_id": "ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-bcrypt-ruby@3.0.1-7.el6?arch=x86_64" } } }, { "category": "product_version", "name": "ruby193-rubygem-bcrypt-ruby-debuginfo-0:3.0.1-7.el6.x86_64", "product": { "name": "ruby193-rubygem-bcrypt-ruby-debuginfo-0:3.0.1-7.el6.x86_64", "product_id": "ruby193-rubygem-bcrypt-ruby-debuginfo-0:3.0.1-7.el6.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-bcrypt-ruby-debuginfo@3.0.1-7.el6?arch=x86_64" } } }, { "category": "product_version", "name": "ruby193-rubygem-fastthread-debuginfo-0:1.0.7-7.el6op.x86_64", "product": { "name": "ruby193-rubygem-fastthread-debuginfo-0:1.0.7-7.el6op.x86_64", "product_id": "ruby193-rubygem-fastthread-debuginfo-0:1.0.7-7.el6op.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-fastthread-debuginfo@1.0.7-7.el6op?arch=x86_64" } } }, { "category": "product_version", "name": "ruby193-rubygem-fastthread-0:1.0.7-7.el6op.x86_64", "product": { "name": "ruby193-rubygem-fastthread-0:1.0.7-7.el6op.x86_64", "product_id": "ruby193-rubygem-fastthread-0:1.0.7-7.el6op.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-fastthread@1.0.7-7.el6op?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-activesupport-1:3.2.8-4.el6.noarch as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-activesupport-1:3.2.8-4.el6.noarch" }, "product_reference": "ruby193-rubygem-activesupport-1:3.2.8-4.el6.noarch", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-activesupport-1:3.2.8-4.el6.src as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-activesupport-1:3.2.8-4.el6.src" }, "product_reference": "ruby193-rubygem-activesupport-1:3.2.8-4.el6.src", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.src as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.src" }, "product_reference": "ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.src", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.x86_64" }, "product_reference": "ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-bcrypt-ruby-debuginfo-0:3.0.1-7.el6.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-bcrypt-ruby-debuginfo-0:3.0.1-7.el6.x86_64" }, "product_reference": "ruby193-rubygem-bcrypt-ruby-debuginfo-0:3.0.1-7.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-bson-0:1.5.2-6.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-bson-0:1.5.2-6.el6op.noarch" }, "product_reference": "ruby193-rubygem-bson-0:1.5.2-6.el6op.noarch", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-bson-0:1.5.2-6.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-bson-0:1.5.2-6.el6op.src" }, "product_reference": "ruby193-rubygem-bson-0:1.5.2-6.el6op.src", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-chunky_png-0:1.2.6-3.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-chunky_png-0:1.2.6-3.el6op.noarch" }, "product_reference": "ruby193-rubygem-chunky_png-0:1.2.6-3.el6op.noarch", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-chunky_png-0:1.2.6-3.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-chunky_png-0:1.2.6-3.el6op.src" }, "product_reference": "ruby193-rubygem-chunky_png-0:1.2.6-3.el6op.src", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-ci_reporter-0:1.7.2-4.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-ci_reporter-0:1.7.2-4.el6op.noarch" }, "product_reference": "ruby193-rubygem-ci_reporter-0:1.7.2-4.el6op.noarch", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-ci_reporter-0:1.7.2-4.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-ci_reporter-0:1.7.2-4.el6op.src" }, "product_reference": "ruby193-rubygem-ci_reporter-0:1.7.2-4.el6op.src", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-compass-0:0.12.2-4.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-compass-0:0.12.2-4.el6op.noarch" }, "product_reference": "ruby193-rubygem-compass-0:0.12.2-4.el6op.noarch", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-compass-0:0.12.2-4.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-compass-0:0.12.2-4.el6op.src" }, "product_reference": "ruby193-rubygem-compass-0:0.12.2-4.el6op.src", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-fastthread-0:1.0.7-7.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-fastthread-0:1.0.7-7.el6op.src" }, "product_reference": "ruby193-rubygem-fastthread-0:1.0.7-7.el6op.src", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-fastthread-0:1.0.7-7.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-fastthread-0:1.0.7-7.el6op.x86_64" }, "product_reference": "ruby193-rubygem-fastthread-0:1.0.7-7.el6op.x86_64", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-fastthread-debuginfo-0:1.0.7-7.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-fastthread-debuginfo-0:1.0.7-7.el6op.x86_64" }, "product_reference": "ruby193-rubygem-fastthread-debuginfo-0:1.0.7-7.el6op.x86_64", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-haml-0:3.1.7-3.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-haml-0:3.1.7-3.el6op.noarch" }, "product_reference": "ruby193-rubygem-haml-0:3.1.7-3.el6op.noarch", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-haml-0:3.1.7-3.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-haml-0:3.1.7-3.el6op.src" }, "product_reference": "ruby193-rubygem-haml-0:3.1.7-3.el6op.src", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-http_connection-0:1.4.1-7.el6.noarch as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-http_connection-0:1.4.1-7.el6.noarch" }, "product_reference": "ruby193-rubygem-http_connection-0:1.4.1-7.el6.noarch", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-http_connection-0:1.4.1-7.el6.src as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-http_connection-0:1.4.1-7.el6.src" }, "product_reference": "ruby193-rubygem-http_connection-0:1.4.1-7.el6.src", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-rack-1:1.4.1-5.el6.noarch as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-rack-1:1.4.1-5.el6.noarch" }, "product_reference": "ruby193-rubygem-rack-1:1.4.1-5.el6.noarch", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-rack-1:1.4.1-5.el6.src as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-rack-1:1.4.1-5.el6.src" }, "product_reference": "ruby193-rubygem-rack-1:1.4.1-5.el6.src", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-rack-test-0:0.6.1-3.el6.noarch as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-rack-test-0:0.6.1-3.el6.noarch" }, "product_reference": "ruby193-rubygem-rack-test-0:0.6.1-3.el6.noarch", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-rack-test-0:0.6.1-3.el6.src as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-rack-test-0:0.6.1-3.el6.src" }, "product_reference": "ruby193-rubygem-rack-test-0:0.6.1-3.el6.src", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-rspec-0:2.11.0-2.el6.noarch as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-rspec-0:2.11.0-2.el6.noarch" }, "product_reference": "ruby193-rubygem-rspec-0:2.11.0-2.el6.noarch", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-rspec-0:2.11.0-2.el6.src as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-rspec-0:2.11.0-2.el6.src" }, "product_reference": "ruby193-rubygem-rspec-0:2.11.0-2.el6.src", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-treetop-0:1.4.10-6.el6.noarch as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-treetop-0:1.4.10-6.el6.noarch" }, "product_reference": "ruby193-rubygem-treetop-0:1.4.10-6.el6.noarch", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-treetop-0:1.4.10-6.el6.src as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-treetop-0:1.4.10-6.el6.src" }, "product_reference": "ruby193-rubygem-treetop-0:1.4.10-6.el6.src", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.noarch" }, "product_reference": "ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.noarch", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure", "product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.src" }, "product_reference": "ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.src", "relates_to_product_reference": "6Server-RHOSE-INFRA" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-activesupport-1:3.2.8-4.el6.noarch as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-activesupport-1:3.2.8-4.el6.noarch" }, "product_reference": "ruby193-rubygem-activesupport-1:3.2.8-4.el6.noarch", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-activesupport-1:3.2.8-4.el6.src as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-activesupport-1:3.2.8-4.el6.src" }, "product_reference": "ruby193-rubygem-activesupport-1:3.2.8-4.el6.src", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.src as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.src" }, "product_reference": "ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.src", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.x86_64" }, "product_reference": "ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-bcrypt-ruby-debuginfo-0:3.0.1-7.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-bcrypt-ruby-debuginfo-0:3.0.1-7.el6.x86_64" }, "product_reference": "ruby193-rubygem-bcrypt-ruby-debuginfo-0:3.0.1-7.el6.x86_64", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-bson-0:1.5.2-6.el6op.noarch as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-bson-0:1.5.2-6.el6op.noarch" }, "product_reference": "ruby193-rubygem-bson-0:1.5.2-6.el6op.noarch", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-bson-0:1.5.2-6.el6op.src as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-bson-0:1.5.2-6.el6op.src" }, "product_reference": "ruby193-rubygem-bson-0:1.5.2-6.el6op.src", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-fastthread-0:1.0.7-7.el6op.src as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-fastthread-0:1.0.7-7.el6op.src" }, "product_reference": "ruby193-rubygem-fastthread-0:1.0.7-7.el6op.src", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-fastthread-0:1.0.7-7.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-fastthread-0:1.0.7-7.el6op.x86_64" }, "product_reference": "ruby193-rubygem-fastthread-0:1.0.7-7.el6op.x86_64", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-fastthread-debuginfo-0:1.0.7-7.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-fastthread-debuginfo-0:1.0.7-7.el6op.x86_64" }, "product_reference": "ruby193-rubygem-fastthread-debuginfo-0:1.0.7-7.el6op.x86_64", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-http_connection-0:1.4.1-7.el6.noarch as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-http_connection-0:1.4.1-7.el6.noarch" }, "product_reference": "ruby193-rubygem-http_connection-0:1.4.1-7.el6.noarch", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-http_connection-0:1.4.1-7.el6.src as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-http_connection-0:1.4.1-7.el6.src" }, "product_reference": "ruby193-rubygem-http_connection-0:1.4.1-7.el6.src", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-rack-1:1.4.1-5.el6.noarch as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-rack-1:1.4.1-5.el6.noarch" }, "product_reference": "ruby193-rubygem-rack-1:1.4.1-5.el6.noarch", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-rack-1:1.4.1-5.el6.src as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-rack-1:1.4.1-5.el6.src" }, "product_reference": "ruby193-rubygem-rack-1:1.4.1-5.el6.src", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-rack-test-0:0.6.1-3.el6.noarch as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-rack-test-0:0.6.1-3.el6.noarch" }, "product_reference": "ruby193-rubygem-rack-test-0:0.6.1-3.el6.noarch", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-rack-test-0:0.6.1-3.el6.src as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-rack-test-0:0.6.1-3.el6.src" }, "product_reference": "ruby193-rubygem-rack-test-0:0.6.1-3.el6.src", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-rspec-0:2.11.0-2.el6.noarch as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-rspec-0:2.11.0-2.el6.noarch" }, "product_reference": "ruby193-rubygem-rspec-0:2.11.0-2.el6.noarch", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-rspec-0:2.11.0-2.el6.src as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-rspec-0:2.11.0-2.el6.src" }, "product_reference": "ruby193-rubygem-rspec-0:2.11.0-2.el6.src", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-treetop-0:1.4.10-6.el6.noarch as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-treetop-0:1.4.10-6.el6.noarch" }, "product_reference": "ruby193-rubygem-treetop-0:1.4.10-6.el6.noarch", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-treetop-0:1.4.10-6.el6.src as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-treetop-0:1.4.10-6.el6.src" }, "product_reference": "ruby193-rubygem-treetop-0:1.4.10-6.el6.src", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.noarch as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.noarch" }, "product_reference": "ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.noarch", "relates_to_product_reference": "6Server-RHOSE-NODE" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.src as a component of Red Hat OpenShift Enterprise Node", "product_id": "6Server-RHOSE-NODE:ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.src" }, "product_reference": "ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.src", "relates_to_product_reference": "6Server-RHOSE-NODE" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Eric Hodel" ], "organization": "RDoc upstream" }, { "names": [ "Evgeny Ermakov" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2013-0256", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2013-02-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "907820" } ], "notes": [ { "category": "description", "text": "darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-RHOSE-INFRA:ruby193-rubygem-activesupport-1:3.2.8-4.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-activesupport-1:3.2.8-4.el6.src", "6Server-RHOSE-INFRA:ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.src", "6Server-RHOSE-INFRA:ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-bcrypt-ruby-debuginfo-0:3.0.1-7.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-bson-0:1.5.2-6.el6op.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-bson-0:1.5.2-6.el6op.src", "6Server-RHOSE-INFRA:ruby193-rubygem-chunky_png-0:1.2.6-3.el6op.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-chunky_png-0:1.2.6-3.el6op.src", "6Server-RHOSE-INFRA:ruby193-rubygem-ci_reporter-0:1.7.2-4.el6op.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-ci_reporter-0:1.7.2-4.el6op.src", "6Server-RHOSE-INFRA:ruby193-rubygem-compass-0:0.12.2-4.el6op.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-compass-0:0.12.2-4.el6op.src", "6Server-RHOSE-INFRA:ruby193-rubygem-fastthread-0:1.0.7-7.el6op.src", "6Server-RHOSE-INFRA:ruby193-rubygem-fastthread-0:1.0.7-7.el6op.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-fastthread-debuginfo-0:1.0.7-7.el6op.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-haml-0:3.1.7-3.el6op.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-haml-0:3.1.7-3.el6op.src", "6Server-RHOSE-INFRA:ruby193-rubygem-http_connection-0:1.4.1-7.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-http_connection-0:1.4.1-7.el6.src", "6Server-RHOSE-INFRA:ruby193-rubygem-rack-1:1.4.1-5.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-rack-1:1.4.1-5.el6.src", "6Server-RHOSE-INFRA:ruby193-rubygem-rack-test-0:0.6.1-3.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-rack-test-0:0.6.1-3.el6.src", "6Server-RHOSE-INFRA:ruby193-rubygem-rspec-0:2.11.0-2.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-rspec-0:2.11.0-2.el6.src", "6Server-RHOSE-INFRA:ruby193-rubygem-treetop-0:1.4.10-6.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-treetop-0:1.4.10-6.el6.src", "6Server-RHOSE-INFRA:ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.src", "6Server-RHOSE-NODE:ruby193-rubygem-activesupport-1:3.2.8-4.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-activesupport-1:3.2.8-4.el6.src", "6Server-RHOSE-NODE:ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.src", "6Server-RHOSE-NODE:ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-bcrypt-ruby-debuginfo-0:3.0.1-7.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-bson-0:1.5.2-6.el6op.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-bson-0:1.5.2-6.el6op.src", "6Server-RHOSE-NODE:ruby193-rubygem-fastthread-0:1.0.7-7.el6op.src", "6Server-RHOSE-NODE:ruby193-rubygem-fastthread-0:1.0.7-7.el6op.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-fastthread-debuginfo-0:1.0.7-7.el6op.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-http_connection-0:1.4.1-7.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-http_connection-0:1.4.1-7.el6.src", "6Server-RHOSE-NODE:ruby193-rubygem-rack-1:1.4.1-5.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-rack-1:1.4.1-5.el6.src", "6Server-RHOSE-NODE:ruby193-rubygem-rack-test-0:0.6.1-3.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-rack-test-0:0.6.1-3.el6.src", "6Server-RHOSE-NODE:ruby193-rubygem-rspec-0:2.11.0-2.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-rspec-0:2.11.0-2.el6.src", "6Server-RHOSE-NODE:ruby193-rubygem-treetop-0:1.4.10-6.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-treetop-0:1.4.10-6.el6.src", "6Server-RHOSE-NODE:ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-0256" }, { "category": "external", "summary": "RHBZ#907820", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=907820" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0256", "url": "https://www.cve.org/CVERecord?id=CVE-2013-0256" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0256", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0256" }, { "category": "external", "summary": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/", "url": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/" } ], "release_date": "2013-02-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-04-09T18:08:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-RHOSE-INFRA:ruby193-rubygem-activesupport-1:3.2.8-4.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-activesupport-1:3.2.8-4.el6.src", "6Server-RHOSE-INFRA:ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.src", "6Server-RHOSE-INFRA:ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-bcrypt-ruby-debuginfo-0:3.0.1-7.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-bson-0:1.5.2-6.el6op.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-bson-0:1.5.2-6.el6op.src", "6Server-RHOSE-INFRA:ruby193-rubygem-chunky_png-0:1.2.6-3.el6op.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-chunky_png-0:1.2.6-3.el6op.src", "6Server-RHOSE-INFRA:ruby193-rubygem-ci_reporter-0:1.7.2-4.el6op.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-ci_reporter-0:1.7.2-4.el6op.src", "6Server-RHOSE-INFRA:ruby193-rubygem-compass-0:0.12.2-4.el6op.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-compass-0:0.12.2-4.el6op.src", "6Server-RHOSE-INFRA:ruby193-rubygem-fastthread-0:1.0.7-7.el6op.src", "6Server-RHOSE-INFRA:ruby193-rubygem-fastthread-0:1.0.7-7.el6op.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-fastthread-debuginfo-0:1.0.7-7.el6op.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-haml-0:3.1.7-3.el6op.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-haml-0:3.1.7-3.el6op.src", "6Server-RHOSE-INFRA:ruby193-rubygem-http_connection-0:1.4.1-7.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-http_connection-0:1.4.1-7.el6.src", "6Server-RHOSE-INFRA:ruby193-rubygem-rack-1:1.4.1-5.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-rack-1:1.4.1-5.el6.src", "6Server-RHOSE-INFRA:ruby193-rubygem-rack-test-0:0.6.1-3.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-rack-test-0:0.6.1-3.el6.src", "6Server-RHOSE-INFRA:ruby193-rubygem-rspec-0:2.11.0-2.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-rspec-0:2.11.0-2.el6.src", "6Server-RHOSE-INFRA:ruby193-rubygem-treetop-0:1.4.10-6.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-treetop-0:1.4.10-6.el6.src", "6Server-RHOSE-INFRA:ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.src", "6Server-RHOSE-NODE:ruby193-rubygem-activesupport-1:3.2.8-4.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-activesupport-1:3.2.8-4.el6.src", "6Server-RHOSE-NODE:ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.src", "6Server-RHOSE-NODE:ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-bcrypt-ruby-debuginfo-0:3.0.1-7.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-bson-0:1.5.2-6.el6op.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-bson-0:1.5.2-6.el6op.src", "6Server-RHOSE-NODE:ruby193-rubygem-fastthread-0:1.0.7-7.el6op.src", "6Server-RHOSE-NODE:ruby193-rubygem-fastthread-0:1.0.7-7.el6op.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-fastthread-debuginfo-0:1.0.7-7.el6op.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-http_connection-0:1.4.1-7.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-http_connection-0:1.4.1-7.el6.src", "6Server-RHOSE-NODE:ruby193-rubygem-rack-1:1.4.1-5.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-rack-1:1.4.1-5.el6.src", "6Server-RHOSE-NODE:ruby193-rubygem-rack-test-0:0.6.1-3.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-rack-test-0:0.6.1-3.el6.src", "6Server-RHOSE-NODE:ruby193-rubygem-rspec-0:2.11.0-2.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-rspec-0:2.11.0-2.el6.src", "6Server-RHOSE-NODE:ruby193-rubygem-treetop-0:1.4.10-6.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-treetop-0:1.4.10-6.el6.src", "6Server-RHOSE-NODE:ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0728" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0" }, "products": [ "6Server-RHOSE-INFRA:ruby193-rubygem-activesupport-1:3.2.8-4.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-activesupport-1:3.2.8-4.el6.src", "6Server-RHOSE-INFRA:ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.src", "6Server-RHOSE-INFRA:ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-bcrypt-ruby-debuginfo-0:3.0.1-7.el6.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-bson-0:1.5.2-6.el6op.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-bson-0:1.5.2-6.el6op.src", "6Server-RHOSE-INFRA:ruby193-rubygem-chunky_png-0:1.2.6-3.el6op.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-chunky_png-0:1.2.6-3.el6op.src", "6Server-RHOSE-INFRA:ruby193-rubygem-ci_reporter-0:1.7.2-4.el6op.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-ci_reporter-0:1.7.2-4.el6op.src", "6Server-RHOSE-INFRA:ruby193-rubygem-compass-0:0.12.2-4.el6op.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-compass-0:0.12.2-4.el6op.src", "6Server-RHOSE-INFRA:ruby193-rubygem-fastthread-0:1.0.7-7.el6op.src", "6Server-RHOSE-INFRA:ruby193-rubygem-fastthread-0:1.0.7-7.el6op.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-fastthread-debuginfo-0:1.0.7-7.el6op.x86_64", "6Server-RHOSE-INFRA:ruby193-rubygem-haml-0:3.1.7-3.el6op.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-haml-0:3.1.7-3.el6op.src", "6Server-RHOSE-INFRA:ruby193-rubygem-http_connection-0:1.4.1-7.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-http_connection-0:1.4.1-7.el6.src", "6Server-RHOSE-INFRA:ruby193-rubygem-rack-1:1.4.1-5.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-rack-1:1.4.1-5.el6.src", "6Server-RHOSE-INFRA:ruby193-rubygem-rack-test-0:0.6.1-3.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-rack-test-0:0.6.1-3.el6.src", "6Server-RHOSE-INFRA:ruby193-rubygem-rspec-0:2.11.0-2.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-rspec-0:2.11.0-2.el6.src", "6Server-RHOSE-INFRA:ruby193-rubygem-treetop-0:1.4.10-6.el6.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-treetop-0:1.4.10-6.el6.src", "6Server-RHOSE-INFRA:ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.noarch", "6Server-RHOSE-INFRA:ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.src", "6Server-RHOSE-NODE:ruby193-rubygem-activesupport-1:3.2.8-4.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-activesupport-1:3.2.8-4.el6.src", "6Server-RHOSE-NODE:ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.src", "6Server-RHOSE-NODE:ruby193-rubygem-bcrypt-ruby-0:3.0.1-7.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-bcrypt-ruby-debuginfo-0:3.0.1-7.el6.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-bson-0:1.5.2-6.el6op.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-bson-0:1.5.2-6.el6op.src", "6Server-RHOSE-NODE:ruby193-rubygem-fastthread-0:1.0.7-7.el6op.src", "6Server-RHOSE-NODE:ruby193-rubygem-fastthread-0:1.0.7-7.el6op.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-fastthread-debuginfo-0:1.0.7-7.el6op.x86_64", "6Server-RHOSE-NODE:ruby193-rubygem-http_connection-0:1.4.1-7.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-http_connection-0:1.4.1-7.el6.src", "6Server-RHOSE-NODE:ruby193-rubygem-rack-1:1.4.1-5.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-rack-1:1.4.1-5.el6.src", "6Server-RHOSE-NODE:ruby193-rubygem-rack-test-0:0.6.1-3.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-rack-test-0:0.6.1-3.el6.src", "6Server-RHOSE-NODE:ruby193-rubygem-rspec-0:2.11.0-2.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-rspec-0:2.11.0-2.el6.src", "6Server-RHOSE-NODE:ruby193-rubygem-treetop-0:1.4.10-6.el6.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-treetop-0:1.4.10-6.el6.src", "6Server-RHOSE-NODE:ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.noarch", "6Server-RHOSE-NODE:ruby193-rubygem-xml-simple-0:1.0.12-10.el6op.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template" } ] }
rhsa-2013_0548
Vulnerability from csaf_redhat
Published
2013-02-21 18:56
Modified
2024-11-05 18:00
Summary
Red Hat Security Advisory: CloudForms Common 1.1.2 update
Notes
Topic
CloudForms Common 1.1.2 is now available.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat CloudForms is an on-premise hybrid cloud
Infrastructure-as-a-Service (IaaS) product that lets you create and manage
private and public clouds. It provides self-service computing resources to
users in a managed, governed, and secure way.
Three flaws were found in rubygem-rack. A remote attacker could use these
flaws to perform a denial of service attack against applications using
rubygem-rack. (CVE-2012-6109, CVE-2013-0183, CVE-2013-0184)
It was found that documentation created by rubygem-rdoc was vulnerable to
a cross-site scripting (XSS) attack. If such documentation was accessible
over a network, and a remote attacker could trick a user into visiting a
specially-crafted URL, it would lead to arbitrary web script execution in
the context of the user's session. As rubygem-rdoc is used for creating
documentation for Ruby source files (such as classes, modules, and so on),
it is not a common scenario to make such documentation accessible over the
network. (CVE-2013-0256)
It was found that ruby_parser from rubygem-ruby_parser created a temporary
file in an insecure way. A local attacker could use this flaw to perform a
symbolic link attack, overwriting arbitrary files accessible to the
application using ruby_parser. (CVE-2013-0162)
Red Hat would like to thank Eric Hodel of RDoc upstream for reporting
CVE-2013-0256. Upstream acknowledges Evgeny Ermakov as the original
reporter of CVE-2013-0256. The CVE-2013-0162 issue was discovered by
Michael Scherer of the Red Hat Regional IT team.
Refer to the CloudForms 1.1.2 Release Notes for further information about
this release. The Release Notes will be available shortly from
https://access.redhat.com/knowledge/docs/
Users of CloudForms Common are advised to upgrade to these updated
packages.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Moderate" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "CloudForms Common 1.1.2 is now available.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat CloudForms is an on-premise hybrid cloud\nInfrastructure-as-a-Service (IaaS) product that lets you create and manage\nprivate and public clouds. It provides self-service computing resources to\nusers in a managed, governed, and secure way.\n\nThree flaws were found in rubygem-rack. A remote attacker could use these\nflaws to perform a denial of service attack against applications using\nrubygem-rack. (CVE-2012-6109, CVE-2013-0183, CVE-2013-0184)\n\nIt was found that documentation created by rubygem-rdoc was vulnerable to\na cross-site scripting (XSS) attack. If such documentation was accessible\nover a network, and a remote attacker could trick a user into visiting a\nspecially-crafted URL, it would lead to arbitrary web script execution in\nthe context of the user\u0027s session. As rubygem-rdoc is used for creating\ndocumentation for Ruby source files (such as classes, modules, and so on),\nit is not a common scenario to make such documentation accessible over the\nnetwork. (CVE-2013-0256)\n\nIt was found that ruby_parser from rubygem-ruby_parser created a temporary\nfile in an insecure way. A local attacker could use this flaw to perform a\nsymbolic link attack, overwriting arbitrary files accessible to the\napplication using ruby_parser. (CVE-2013-0162)\n\nRed Hat would like to thank Eric Hodel of RDoc upstream for reporting\nCVE-2013-0256. Upstream acknowledges Evgeny Ermakov as the original\nreporter of CVE-2013-0256. The CVE-2013-0162 issue was discovered by\nMichael Scherer of the Red Hat Regional IT team.\n\nRefer to the CloudForms 1.1.2 Release Notes for further information about\nthis release. The Release Notes will be available shortly from\nhttps://access.redhat.com/knowledge/docs/\n\nUsers of CloudForms Common are advised to upgrade to these updated\npackages.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2013:0548", "url": "https://access.redhat.com/errata/RHSA-2013:0548" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#moderate", "url": "https://access.redhat.com/security/updates/classification/#moderate" }, { "category": "external", "summary": "https://access.redhat.com/knowledge/docs/", "url": "https://access.redhat.com/knowledge/docs/" }, { "category": "external", "summary": "892806", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=892806" }, { "category": "external", "summary": "895277", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=895277" }, { "category": "external", "summary": "895282", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=895282" }, { "category": "external", "summary": "895384", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=895384" }, { "category": "external", "summary": "907820", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=907820" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0548.json" } ], "title": "Red Hat Security Advisory: CloudForms Common 1.1.2 update", "tracking": { "current_release_date": "2024-11-05T18:00:54+00:00", "generator": { "date": "2024-11-05T18:00:54+00:00", "engine": { "name": "Red Hat SDEngine", "version": "4.1.1" } }, "id": "RHSA-2013:0548", "initial_release_date": "2013-02-21T18:56:00+00:00", "revision_history": [ { "date": "2013-02-21T18:56:00+00:00", "number": "1", "summary": "Initial version" }, { "date": "2013-02-21T19:00:32+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2024-11-05T18:00:54+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "CloudForms Cloud Engine for RHEL 6 Server", "product": { "name": "CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine", "product_identification_helper": { "cpe": "cpe:/a:cloudforms_cloudengine:1::el6" } } }, { "category": "product_name", "name": "CloudForms System Engine for RHEL 6 Server", "product": { "name": "CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine", "product_identification_helper": { "cpe": "cpe:/a:cloudforms_systemengine:1::el6" } } } ], "category": "product_family", "name": "Red Hat CloudForms" }, { "branches": [ { "category": "product_version", "name": "rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "product": { "name": "rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "product_id": "rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-ruby_parser@2.0.4-6.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch", "product": { "name": "rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch", "product_id": "rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-ruby_parser-doc@2.0.4-6.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-rack-1:1.3.0-3.el6cf.noarch", "product": { "name": "rubygem-rack-1:1.3.0-3.el6cf.noarch", "product_id": "rubygem-rack-1:1.3.0-3.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rack@1.3.0-3.el6cf?arch=noarch\u0026epoch=1" } } }, { "category": "product_version", "name": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "product": { "name": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "product_id": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rdoc-doc@3.8-6.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-rdoc-0:3.8-6.el6cf.noarch", "product": { "name": "rubygem-rdoc-0:3.8-6.el6cf.noarch", "product_id": "rubygem-rdoc-0:3.8-6.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rdoc@3.8-6.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-shoulda-doc-0:2.11.3-5.el6cf.noarch", "product": { "name": "rubygem-shoulda-doc-0:2.11.3-5.el6cf.noarch", "product_id": "rubygem-shoulda-doc-0:2.11.3-5.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-shoulda-doc@2.11.3-5.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-shoulda-0:2.11.3-5.el6cf.noarch", "product": { "name": "rubygem-shoulda-0:2.11.3-5.el6cf.noarch", "product_id": "rubygem-shoulda-0:2.11.3-5.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-shoulda@2.11.3-5.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-rspec-rails-0:2.6.1-7.el6cf.noarch", "product": { "name": "rubygem-rspec-rails-0:2.6.1-7.el6cf.noarch", "product_id": "rubygem-rspec-rails-0:2.6.1-7.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rspec-rails@2.6.1-7.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-rspec-rails-doc-0:2.6.1-7.el6cf.noarch", "product": { "name": "rubygem-rspec-rails-doc-0:2.6.1-7.el6cf.noarch", "product_id": "rubygem-rspec-rails-doc-0:2.6.1-7.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rspec-rails-doc@2.6.1-7.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "product": { "name": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "product_id": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rails_warden-doc@0.5.5-2.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "product": { "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "product_id": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rails_warden@0.5.5-2.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "product": { "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "product_id": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-delayed_job@2.1.4-3.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "product": { "name": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "product_id": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-delayed_job-doc@2.1.4-3.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "product": { "name": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "product_id": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-nokogiri-doc@1.5.0-0.9.beta4.el6cf?arch=noarch" } } }, { "category": "product_version", "name": "rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "product": { "name": "rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "product_id": "rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-activesupport@3.0.10-10.el6cf?arch=noarch\u0026epoch=1" } } } ], "category": "architecture", "name": "noarch" }, { "branches": [ { "category": "product_version", "name": "rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "product": { "name": "rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "product_id": "rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-ruby_parser@2.0.4-6.el6cf?arch=src" } } }, { "category": "product_version", "name": "rubygem-rack-1:1.3.0-3.el6cf.src", "product": { "name": "rubygem-rack-1:1.3.0-3.el6cf.src", "product_id": "rubygem-rack-1:1.3.0-3.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rack@1.3.0-3.el6cf?arch=src\u0026epoch=1" } } }, { "category": "product_version", "name": "rubygem-rdoc-0:3.8-6.el6cf.src", "product": { "name": "rubygem-rdoc-0:3.8-6.el6cf.src", "product_id": "rubygem-rdoc-0:3.8-6.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rdoc@3.8-6.el6cf?arch=src" } } }, { "category": "product_version", "name": "rubygem-shoulda-0:2.11.3-5.el6cf.src", "product": { "name": "rubygem-shoulda-0:2.11.3-5.el6cf.src", "product_id": "rubygem-shoulda-0:2.11.3-5.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-shoulda@2.11.3-5.el6cf?arch=src" } } }, { "category": "product_version", "name": "rubygem-rspec-rails-0:2.6.1-7.el6cf.src", "product": { "name": "rubygem-rspec-rails-0:2.6.1-7.el6cf.src", "product_id": "rubygem-rspec-rails-0:2.6.1-7.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rspec-rails@2.6.1-7.el6cf?arch=src" } } }, { "category": "product_version", "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.src", "product": { "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.src", "product_id": "rubygem-rails_warden-0:0.5.5-2.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-rails_warden@0.5.5-2.el6cf?arch=src" } } }, { "category": "product_version", "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.src", "product": { "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.src", "product_id": "rubygem-delayed_job-0:2.1.4-3.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-delayed_job@2.1.4-3.el6cf?arch=src" } } }, { "category": "product_version", "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "product": { "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "product_id": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-nokogiri@1.5.0-0.9.beta4.el6cf?arch=src" } } }, { "category": "product_version", "name": "rubygem-activesupport-1:3.0.10-10.el6cf.src", "product": { "name": "rubygem-activesupport-1:3.0.10-10.el6cf.src", "product_id": "rubygem-activesupport-1:3.0.10-10.el6cf.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-activesupport@3.0.10-10.el6cf?arch=src\u0026epoch=1" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "product": { "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "product_id": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-nokogiri@1.5.0-0.9.beta4.el6cf?arch=x86_64" } } }, { "category": "product_version", "name": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "product": { "name": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "product_id": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby-nokogiri@1.5.0-0.9.beta4.el6cf?arch=x86_64" } } }, { "category": "product_version", "name": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "product": { "name": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "product_id": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "product_identification_helper": { "purl": "pkg:rpm/redhat/rubygem-nokogiri-debuginfo@1.5.0-0.9.beta4.el6cf?arch=x86_64" } } } ], "category": "architecture", "name": "x86_64" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64 as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64" }, "product_reference": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-activesupport-1:3.0.10-10.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch" }, "product_reference": "rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-activesupport-1:3.0.10-10.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src" }, "product_reference": "rubygem-activesupport-1:3.0.10-10.el6cf.src", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch" }, "product_reference": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src" }, "product_reference": "rubygem-delayed_job-0:2.1.4-3.el6cf.src", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch" }, "product_reference": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src" }, "product_reference": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64 as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64" }, "product_reference": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64 as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64" }, "product_reference": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch" }, "product_reference": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rack-1:1.3.0-3.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch" }, "product_reference": "rubygem-rack-1:1.3.0-3.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rack-1:1.3.0-3.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.src" }, "product_reference": "rubygem-rack-1:1.3.0-3.el6cf.src", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch" }, "product_reference": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src" }, "product_reference": "rubygem-rails_warden-0:0.5.5-2.el6cf.src", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch" }, "product_reference": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rdoc-0:3.8-6.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch" }, "product_reference": "rubygem-rdoc-0:3.8-6.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rdoc-0:3.8-6.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.src" }, "product_reference": "rubygem-rdoc-0:3.8-6.el6cf.src", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch" }, "product_reference": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rspec-rails-0:2.6.1-7.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.noarch" }, "product_reference": "rubygem-rspec-rails-0:2.6.1-7.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rspec-rails-0:2.6.1-7.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.src" }, "product_reference": "rubygem-rspec-rails-0:2.6.1-7.el6cf.src", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rspec-rails-doc-0:2.6.1-7.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-rspec-rails-doc-0:2.6.1-7.el6cf.noarch" }, "product_reference": "rubygem-rspec-rails-doc-0:2.6.1-7.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch" }, "product_reference": "rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-ruby_parser-0:2.0.4-6.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src" }, "product_reference": "rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch" }, "product_reference": "rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-shoulda-0:2.11.3-5.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.noarch" }, "product_reference": "rubygem-shoulda-0:2.11.3-5.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-shoulda-0:2.11.3-5.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.src" }, "product_reference": "rubygem-shoulda-0:2.11.3-5.el6cf.src", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-shoulda-doc-0:2.11.3-5.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server", "product_id": "6Server-CloudEngine:rubygem-shoulda-doc-0:2.11.3-5.el6cf.noarch" }, "product_reference": "rubygem-shoulda-doc-0:2.11.3-5.el6cf.noarch", "relates_to_product_reference": "6Server-CloudEngine" }, { "category": "default_component_of", "full_product_name": { "name": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64 as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64" }, "product_reference": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-activesupport-1:3.0.10-10.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch" }, "product_reference": "rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-activesupport-1:3.0.10-10.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src" }, "product_reference": "rubygem-activesupport-1:3.0.10-10.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch" }, "product_reference": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-delayed_job-0:2.1.4-3.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src" }, "product_reference": "rubygem-delayed_job-0:2.1.4-3.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch" }, "product_reference": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src" }, "product_reference": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64 as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64" }, "product_reference": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64 as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64" }, "product_reference": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch" }, "product_reference": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rack-1:1.3.0-3.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch" }, "product_reference": "rubygem-rack-1:1.3.0-3.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rack-1:1.3.0-3.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.src" }, "product_reference": "rubygem-rack-1:1.3.0-3.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch" }, "product_reference": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rails_warden-0:0.5.5-2.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src" }, "product_reference": "rubygem-rails_warden-0:0.5.5-2.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch" }, "product_reference": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rdoc-0:3.8-6.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch" }, "product_reference": "rubygem-rdoc-0:3.8-6.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rdoc-0:3.8-6.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.src" }, "product_reference": "rubygem-rdoc-0:3.8-6.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch" }, "product_reference": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch" }, "product_reference": "rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-ruby_parser-0:2.0.4-6.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src" }, "product_reference": "rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "relates_to_product_reference": "6Server-SystemEngine" }, { "category": "default_component_of", "full_product_name": { "name": "rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server", "product_id": "6Server-SystemEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch" }, "product_reference": "rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch", "relates_to_product_reference": "6Server-SystemEngine" } ] }, "vulnerabilities": [ { "cve": "CVE-2012-6109", "cwe": { "id": "CWE-835", "name": "Loop with Unreachable Exit Condition (\u0027Infinite Loop\u0027)" }, "discovery_date": "2013-01-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "895277" } ], "notes": [ { "category": "description", "text": "lib/rack/multipart.rb in Rack before 1.1.4, 1.2.x before 1.2.6, 1.3.x before 1.3.7, and 1.4.x before 1.4.2 uses an incorrect regular expression, which allows remote attackers to cause a denial of service (infinite loop) via a crafted Content-Disposion header.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-rack: parsing Content-Disposition header DoS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-CloudEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-CloudEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.src", "6Server-CloudEngine:rubygem-rspec-rails-doc-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-CloudEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.src", "6Server-CloudEngine:rubygem-shoulda-doc-0:2.11.3-5.el6cf.noarch", "6Server-SystemEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SystemEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-SystemEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2012-6109" }, { "category": "external", "summary": "RHBZ#895277", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=895277" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2012-6109", "url": "https://www.cve.org/CVERecord?id=CVE-2012-6109" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6109", "url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6109" } ], "release_date": "2012-05-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-02-21T18:56:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-CloudEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-CloudEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.src", "6Server-CloudEngine:rubygem-rspec-rails-doc-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-CloudEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.src", "6Server-CloudEngine:rubygem-shoulda-doc-0:2.11.3-5.el6cf.noarch", "6Server-SystemEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SystemEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-SystemEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0548" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0" }, "products": [ "6Server-CloudEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-CloudEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.src", "6Server-CloudEngine:rubygem-rspec-rails-doc-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-CloudEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.src", "6Server-CloudEngine:rubygem-shoulda-doc-0:2.11.3-5.el6cf.noarch", "6Server-SystemEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SystemEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-SystemEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-rack: parsing Content-Disposition header DoS" }, { "acknowledgments": [ { "names": [ "Michael Scherer" ], "organization": "Red Hat Regional IT team", "summary": "This issue was discovered by Red Hat." } ], "cve": "CVE-2013-0162", "cwe": { "id": "CWE-377", "name": "Insecure Temporary File" }, "discovery_date": "2013-01-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "892806" } ], "notes": [ { "category": "description", "text": "The diff_pp function in lib/gauntlet_rubyparser.rb in the ruby_parser gem 3.1.1 and earlier for Ruby allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-ruby_parser: incorrect temporary file usage", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-CloudEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-CloudEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.src", "6Server-CloudEngine:rubygem-rspec-rails-doc-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-CloudEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.src", "6Server-CloudEngine:rubygem-shoulda-doc-0:2.11.3-5.el6cf.noarch", "6Server-SystemEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SystemEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-SystemEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-0162" }, { "category": "external", "summary": "RHBZ#892806", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=892806" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0162", "url": "https://www.cve.org/CVERecord?id=CVE-2013-0162" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0162", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0162" } ], "release_date": "2013-01-21T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-02-21T18:56:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-CloudEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-CloudEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.src", "6Server-CloudEngine:rubygem-rspec-rails-doc-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-CloudEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.src", "6Server-CloudEngine:rubygem-shoulda-doc-0:2.11.3-5.el6cf.noarch", "6Server-SystemEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SystemEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-SystemEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0548" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "LOCAL", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 2.1, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0" }, "products": [ "6Server-CloudEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-CloudEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.src", "6Server-CloudEngine:rubygem-rspec-rails-doc-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-CloudEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.src", "6Server-CloudEngine:rubygem-shoulda-doc-0:2.11.3-5.el6cf.noarch", "6Server-SystemEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SystemEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-SystemEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch" ] } ], "threats": [ { "category": "impact", "details": "Low" } ], "title": "rubygem-ruby_parser: incorrect temporary file usage" }, { "cve": "CVE-2013-0183", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2013-01-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "895282" } ], "notes": [ { "category": "description", "text": "multipart/parser.rb in Rack 1.3.x before 1.3.8 and 1.4.x before 1.4.3 allows remote attackers to cause a denial of service (memory consumption and out-of-memory error) via a long string in a Multipart HTTP packet.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-rack: receiving excessively long lines triggers out-of-memory error", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-CloudEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-CloudEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.src", "6Server-CloudEngine:rubygem-rspec-rails-doc-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-CloudEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.src", "6Server-CloudEngine:rubygem-shoulda-doc-0:2.11.3-5.el6cf.noarch", "6Server-SystemEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SystemEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-SystemEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-0183" }, { "category": "external", "summary": "RHBZ#895282", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=895282" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0183", "url": "https://www.cve.org/CVERecord?id=CVE-2013-0183" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0183", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0183" } ], "release_date": "2013-01-07T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-02-21T18:56:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-CloudEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-CloudEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.src", "6Server-CloudEngine:rubygem-rspec-rails-doc-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-CloudEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.src", "6Server-CloudEngine:rubygem-shoulda-doc-0:2.11.3-5.el6cf.noarch", "6Server-SystemEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SystemEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-SystemEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0548" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0" }, "products": [ "6Server-CloudEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-CloudEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.src", "6Server-CloudEngine:rubygem-rspec-rails-doc-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-CloudEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.src", "6Server-CloudEngine:rubygem-shoulda-doc-0:2.11.3-5.el6cf.noarch", "6Server-SystemEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SystemEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-SystemEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-rack: receiving excessively long lines triggers out-of-memory error" }, { "cve": "CVE-2013-0184", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2013-01-14T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "895384" } ], "notes": [ { "category": "description", "text": "Unspecified vulnerability in Rack::Auth::AbstractRequest in Rack 1.1.x before 1.1.5, 1.2.x before 1.2.7, 1.3.x before 1.3.9, and 1.4.x before 1.4.4 allows remote attackers to cause a denial of service via unknown vectors related to \"symbolized arbitrary strings.\"", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-rack: Rack::Auth:: AbstractRequest DoS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-CloudEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-CloudEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.src", "6Server-CloudEngine:rubygem-rspec-rails-doc-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-CloudEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.src", "6Server-CloudEngine:rubygem-shoulda-doc-0:2.11.3-5.el6cf.noarch", "6Server-SystemEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SystemEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-SystemEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-0184" }, { "category": "external", "summary": "RHBZ#895384", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=895384" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0184", "url": "https://www.cve.org/CVERecord?id=CVE-2013-0184" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0184", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0184" } ], "release_date": "2012-05-04T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-02-21T18:56:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-CloudEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-CloudEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.src", "6Server-CloudEngine:rubygem-rspec-rails-doc-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-CloudEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.src", "6Server-CloudEngine:rubygem-shoulda-doc-0:2.11.3-5.el6cf.noarch", "6Server-SystemEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SystemEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-SystemEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0548" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0" }, "products": [ "6Server-CloudEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-CloudEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.src", "6Server-CloudEngine:rubygem-rspec-rails-doc-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-CloudEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.src", "6Server-CloudEngine:rubygem-shoulda-doc-0:2.11.3-5.el6cf.noarch", "6Server-SystemEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SystemEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-SystemEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-rack: Rack::Auth:: AbstractRequest DoS" }, { "acknowledgments": [ { "names": [ "Eric Hodel" ], "organization": "RDoc upstream" }, { "names": [ "Evgeny Ermakov" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2013-0256", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)" }, "discovery_date": "2013-02-05T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "907820" } ], "notes": [ { "category": "description", "text": "darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-CloudEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-CloudEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.src", "6Server-CloudEngine:rubygem-rspec-rails-doc-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-CloudEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.src", "6Server-CloudEngine:rubygem-shoulda-doc-0:2.11.3-5.el6cf.noarch", "6Server-SystemEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SystemEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-SystemEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-0256" }, { "category": "external", "summary": "RHBZ#907820", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=907820" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-0256", "url": "https://www.cve.org/CVERecord?id=CVE-2013-0256" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0256", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0256" }, { "category": "external", "summary": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/", "url": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/" } ], "release_date": "2013-02-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2013-02-21T18:56:00+00:00", "details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258", "product_ids": [ "6Server-CloudEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-CloudEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.src", "6Server-CloudEngine:rubygem-rspec-rails-doc-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-CloudEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.src", "6Server-CloudEngine:rubygem-shoulda-doc-0:2.11.3-5.el6cf.noarch", "6Server-SystemEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SystemEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-SystemEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2013:0548" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N", "version": "2.0" }, "products": [ "6Server-CloudEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-CloudEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-CloudEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-CloudEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-CloudEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-CloudEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-CloudEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-rspec-rails-0:2.6.1-7.el6cf.src", "6Server-CloudEngine:rubygem-rspec-rails-doc-0:2.6.1-7.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-CloudEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.noarch", "6Server-CloudEngine:rubygem-shoulda-0:2.11.3-5.el6cf.src", "6Server-CloudEngine:rubygem-shoulda-doc-0:2.11.3-5.el6cf.noarch", "6Server-SystemEngine:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.noarch", "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-10.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-delayed_job-0:2.1.4-3.el6cf.src", "6Server-SystemEngine:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src", "6Server-SystemEngine:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64", "6Server-SystemEngine:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.noarch", "6Server-SystemEngine:rubygem-rack-1:1.3.0-3.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rails_warden-0:0.5.5-2.el6cf.src", "6Server-SystemEngine:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-rdoc-0:3.8-6.el6cf.src", "6Server-SystemEngine:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.noarch", "6Server-SystemEngine:rubygem-ruby_parser-0:2.0.4-6.el6cf.src", "6Server-SystemEngine:rubygem-ruby_parser-doc-0:2.0.4-6.el6cf.noarch" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template" } ] }
ghsa-v2r9-c84j-v7xm
Vulnerability from github
Published
2017-10-24 18:33
Modified
2023-07-05 20:39
Summary
RDoc contains XSS vulnerability
Details
darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.
{ "affected": [ { "package": { "ecosystem": "RubyGems", "name": "rdoc" }, "ranges": [ { "events": [ { "introduced": "2.3.0" }, { "fixed": "3.12.1" } ], "type": "ECOSYSTEM" } ] } ], "aliases": [ "CVE-2013-0256" ], "database_specific": { "cwe_ids": [ "CWE-79" ], "github_reviewed": true, "github_reviewed_at": "2020-06-16T21:56:28Z", "nvd_published_at": "2013-03-01T05:40:00Z", "severity": "MODERATE" }, "details": "darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.", "id": "GHSA-v2r9-c84j-v7xm", "modified": "2023-07-05T20:39:56Z", "published": "2017-10-24T18:33:37Z", "references": [ { "type": "ADVISORY", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0256" }, { "type": "WEB", "url": "https://github.com/rdoc/rdoc/commit/ffa87887ee0517793df7541629a470e331f9fe60" }, { "type": "WEB", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=907820" }, { "type": "ADVISORY", "url": "https://github.com/advisories/GHSA-v2r9-c84j-v7xm" }, { "type": "PACKAGE", "url": "https://github.com/rdoc/rdoc" }, { "type": "WEB", "url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/rdoc/CVE-2013-0256.yml" }, { "type": "WEB", "url": "https://web.archive.org/web/20130402173730/http://blog.segment7.net:80/2013/02/06/rdoc-xss-vulnerability-cve-2013-0256-releases-3-9-5-3-12-1-4-0-0-rc-2" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html" }, { "type": "WEB", "url": "http://lists.opensuse.org/opensuse-updates/2013-02/msg00048.html" }, { "type": "WEB", "url": "http://rhn.redhat.com/errata/RHSA-2013-0686.html" }, { "type": "WEB", "url": "http://rhn.redhat.com/errata/RHSA-2013-0701.html" }, { "type": "WEB", "url": "http://rhn.redhat.com/errata/RHSA-2013-0728.html" }, { "type": "WEB", "url": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256" }, { "type": "WEB", "url": "http://www.ubuntu.com/usn/USN-1733-1" } ], "schema_version": "1.4.0", "severity": [], "summary": "RDoc contains XSS vulnerability" }
Loading...
Loading...
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.