Action not permitted
Modal body text goes here.
Modal Title
Modal Body
cve-2016-6316
Vulnerability from cvelistv5
Published
2016-09-07 19:00
Modified
2024-08-06 01:29
Severity ?
EPSS score ?
Summary
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:29:18.216Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "RHSA-2016:1856",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1856.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://puppet.com/security/cve/cve-2016-6316"
},
{
"name": "92430",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92430"
},
{
"name": "RHSA-2016:1855",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1855.html"
},
{
"name": "[oss-security] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/11/3"
},
{
"name": "RHSA-2016:1858",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1858.html"
},
{
"name": "RHSA-2016:1857",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1857.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/"
},
{
"name": "[ruby-security-ann] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://groups.google.com/forum/#%21topic/ruby-security-ann/8B2iV2tPRSE"
},
{
"name": "DSA-3651",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3651"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-08-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-12-08T10:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2016:1856",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1856.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://puppet.com/security/cve/cve-2016-6316"
},
{
"name": "92430",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92430"
},
{
"name": "RHSA-2016:1855",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1855.html"
},
{
"name": "[oss-security] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/11/3"
},
{
"name": "RHSA-2016:1858",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1858.html"
},
{
"name": "RHSA-2016:1857",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1857.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/"
},
{
"name": "[ruby-security-ann] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://groups.google.com/forum/#%21topic/ruby-security-ann/8B2iV2tPRSE"
},
{
"name": "DSA-3651",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3651"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2016-6316",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "RHSA-2016:1856",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1856.html"
},
{
"name": "https://puppet.com/security/cve/cve-2016-6316",
"refsource": "CONFIRM",
"url": "https://puppet.com/security/cve/cve-2016-6316"
},
{
"name": "92430",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92430"
},
{
"name": "RHSA-2016:1855",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1855.html"
},
{
"name": "[oss-security] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2016/08/11/3"
},
{
"name": "RHSA-2016:1858",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1858.html"
},
{
"name": "RHSA-2016:1857",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1857.html"
},
{
"name": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/",
"refsource": "CONFIRM",
"url": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/"
},
{
"name": "[ruby-security-ann] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View",
"refsource": "MLIST",
"url": "https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE"
},
{
"name": "DSA-3651",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3651"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2016-6316",
"datePublished": "2016-09-07T19:00:00",
"dateReserved": "2016-07-26T00:00:00",
"dateUpdated": "2024-08-06T01:29:18.216Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"fkie_nvd": {
"configurations": "[{\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E3BE7DFE-BA20-434B-A1DE-AD038B255C60\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*\", \"matchCriteriaId\": \"DCEE5B21-C990-4705-8239-0D7B29DAEDA1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*\", \"matchCriteriaId\": \"65EE33B1-B079-4CDE-B9C2-F1613A4610DC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*\", \"matchCriteriaId\": \"5CAAA20B-824F-4448-99DC-9712FE628073\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*\", \"matchCriteriaId\": \"D2BEBDFB-0F30-454A-B74C-F820C9D2708B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*\", \"matchCriteriaId\": \"1D7CD8C1-95D1-477E-AD96-6582EC33BA01\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"B6F00D98-3D0F-40AF-AE4F-090B1E6B660C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9476CE55-69C0-45D3-B723-6F459C90BF05\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"112FC73B-A8BC-4EEA-9F4B-CCE685EF2838\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D26565B1-2BA6-4A3C-9264-7FC9A1820B59\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"644EF85E-6D3E-4F5C-96B0-49AD2A2D90CE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"392E2D58-CB39-4832-B4D9-9C2E23B8E14C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"1F2466EA-7039-46A1-B4A3-8DACD1953A59\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0CAB4E72-0A15-4B26-9B69-074C278568D6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"A085E105-9375-440A-80CB-9B23E6D7EB4A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"25911E48-C5D7-4ED8-B4DB-7523A74CCF49\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FE6EC1E5-3A4A-4751-9F77-28EF5AF681E3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"B29674E3-CC80-446B-9A43-82594AE7A058\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"FF34D8CB-2B6D-4CB8-A206-108293BCFFE7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"8E5187F6-E3AC-4E0D-B1D0-83DE76C20A4B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"272268EE-E3E8-4683-B679-55D748877A7E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"7B69FD33-61FE-4F10-BBE1-215F59035D30\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"08D7CB5D-82EF-4A24-A792-938FAB40863D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"8A044B21-47D5-468D-AF4A-06B3B5CC0824\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2196F3D0-532A-40F9-843A-1DFBC8B63FDC\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"CBEDA932-6CB5-438C-94E4-824732A91BE0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"903E5524-5E45-48CE-A804-EDAEBE3A79AD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"08534AF2-F94E-4FB6-A572-4FB9827276D4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"29E3B4A6-1346-4358-B7BC-84D00ED3ABBE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"B52D7A6B-DD93-45F0-9186-18ABEFF28DF4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"1F07C641-48DF-43BE-9EB5-72B337C54846\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"A1CB1B12-99F5-430F-AE19-9A95C17FA123\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D1A7C449-8F9A-4CE5-9C3D-375996BFAEE3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"05D5D58C-DB79-41EA-81AE-5D95C48211B0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"FE331D6D-99BA-4369-AD8B-B556DEE4955F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"58304E17-ADFD-4686-9CCF-C1CA31843B94\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"05108EF0-81AD-4378-9843-5C23F2AC79A3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"4EE7DA7E-23A5-42AF-9D5C-39240CE2FBDB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.16:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0C448F62-8231-4221-ADA0-C9B848AE03D1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.17:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5FBD11A1-51C7-4AF7-AA0B-3A14C5435E70\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.18:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"60255706-C44A-48CB-B98B-A1F0991CBC74\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.19:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0456E2E8-EF06-414E-8A7D-8005F0EB46B7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.0.20:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D9EE4763-2495-4B6A-B72F-344967E51C27\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DB51F3E9-4899-49A9-9E7B-0DCA92A91DD8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:*\", \"matchCriteriaId\": \"F884F2F4-94F3-46CB-860B-1BCC0EEF408A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"88DFBB48-1C29-4639-9369-F5B413CA2337\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"D37696D7-BEE6-4587-9E33-A7FE24780409\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"E95B5D44-0C8D-47BC-A89D-48A5BDEB84F4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"1DFDAF6A-76AA-436F-A4F3-DA69892DE2B8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:*\", \"matchCriteriaId\": \"D3172982-3FA4-427F-BE3E-2321D804E49D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:*\", \"matchCriteriaId\": \"FD6EC85B-F092-48FF-966A-96B9227C8656\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:*\", \"matchCriteriaId\": \"9000F3C1-57A0-474C-9C82-E58688F29838\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:*\", \"matchCriteriaId\": \"6E55E42E-AB6A-4E47-AC69-DFDAEB0A8735\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A42F4E7A-6F6A-485C-8D30-95F3B0285922\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"30B9C0CB-F6E6-4233-84E4-D6E69104DD73\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"84309CC7-A8B7-4ADB-AEA1-964DA5F7B0E0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"5343241F-274D-45FF-97C7-2BC2E920BAF0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FED122B8-AF4C-4C48-B1E5-54F4A7A31A53\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"157ACCAD-0FB8-4CC9-9DFB-70835DE6506C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"3E50ACF6-7277-4C9A-B42A-E7EFDC317691\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C191DC2B-1EC3-48E0-A586-867E6EE4431C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"3AA51263-6680-42C6-B119-8241D6F76206\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"B4BC41E8-FEDA-4C31-B479-D49A59FC4D63\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"09C20971-53B5-43B0-AC45-5AA0FDF1B054\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"D1AEFA5D-A793-4BAB-8DED-3D3A31260AD8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"496902D6-409A-40D9-849F-C41264BE5B04\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2482AB3F-8303-4F95-BE04-C5F06EEF2015\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"244C6952-377C-4AF0-8BA2-C34516A3EB5A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"98A79CC5-71EC-4E90-9E99-2DF62ABC0122\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6562F3C3-D794-4107-95D4-1C0B0486940B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.1.12:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"11F211A0-AC69-482A-B659-AEE7BE4E4CD6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"2816C02C-E13E-4367-91F3-14756A90EC9E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"E82AF7C7-B725-40EF-8EE3-18F8E7FAEB29\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"1AE674DE-65DB-437E-A034-A2EE5C584B33\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0524F3E3-BAD7-4CD3-A6E7-74CFBE4B46E6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"32EB2C3F-0F24-43DB-988E-BD2973598F71\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"EB32713D-FE64-445E-872E-B4678C243AB1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C55E6B4A-2B9C-46C8-A739-109EA4BA7FD4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"89C618DC-38BC-4484-8C41-BC38B7EB636B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"FE1EF01A-F358-45D3-ADA2-51DD1D8CB6E2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AC2616BD-A4E8-42F3-BB5A-7517DC4EDA3D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"0E376782-98B0-4766-B6FC-67E032A00C62\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"96D08DC1-14E9-4DB9-BC95-3F73B454FBC4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F365C9E5-27DC-46C3-AFE4-4876EC7B352B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6F0016A6-0ED6-443D-B969-CB1226D8E28C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.7:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"42232305-7D62-4692-81CC-B7E9CE642372\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E69470EA-5EBC-4FB9-A722-5B61C70C1140\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.8:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"DD2818D7-5006-4486-AE55-47B63C8F114B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.8:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"83EF40E0-1C62-415A-892B-C071B109D924\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B13A8EBB-4211-4AB1-8872-244EEEE20ABD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.9:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"22D707A0-7CA9-4CED-8DBA-1B50B57EDB2B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.9:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"0C3CADF8-3316-4514-9A70-AD3DF16B19E1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.9:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"D0D4AF31-A47B-4BE3-A99B-9A0EB7C53D20\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C9AB2152-DED8-4CFD-B915-94A9F56FDD05\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.11:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C630AB60-DBAF-421E-B663-492BAE8A180F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.12:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"0F41CCF8-14EB-4327-A675-83BFDBB53196\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.13:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"75842F7D-B1B1-48BA-858F-01148867B3AA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.13:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"FE65D701-AA6E-48E4-B62B-C22DEE863503\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.13:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"17B1E475-C873-4561-9348-027721C08D79\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.15:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C0406FF0-30F5-40E2-B9B8-FE465D923DE4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.15:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"6646610D-279B-4AEC-B445-981E7784EE5B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.16:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"50F51980-EAD9-4E4D-A2E7-1FACFA80AAB0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.17:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CC02A7D1-CB1A-4793-86E3-CF88D0BCDF83\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.18:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A499584B-6E2E-42F3-B0CE-DA7BDD732897\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.21:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AE982FFD-D30F-4872-9C36-74DE50405B18\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:3.2.22.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EA770BE3-DD37-45C9-9E6D-8D3407D1A5D1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.0:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"2E950E33-CD03-45F5-83F9-F106060B4A8B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.0:beta:*:*:*:*:*:*\", \"matchCriteriaId\": \"547C62C8-4B3E-431B-AA73-5C42ED884671\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.0:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"4CDAD329-35F7-4C82-8019-A0CF6D069059\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.0:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"56D3858B-0FEE-4E8D-83C2-68AF0431F478\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.1:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"254884EE-EBA4-45D0-9704-B5CB22569668\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.1:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"35FC7015-267C-403B-A23D-EDA6223D2104\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.1:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"5C913A56-959D-44F1-BD89-D246C66D1F09\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.1:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"5D5BA926-38EE-47BE-9D16-FDCF360A503B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.1:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"18EA25F1-279A-4F1A-883D-C064369F592E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"FD794856-6F30-4ABF-8AE4-720BB75E6F89\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B4199B8B-A6F9-4BFD-8D27-0E663D8C579D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F11E76A3-FA5B-4038-AB52-3D7D5E54D8A2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.4:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"C583ACDE-55D5-4D2F-838F-BEC5BDCDE3B7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"767C481D-6616-4CA9-9A9B-C994D9121796\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D5496953-0C5E-45F8-A7FB-240CEC2CCEB8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.6:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"CA46B621-125E-497F-B2DE-91C989B25936\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.6:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"B3239443-2E19-4540-BA0C-05A27E44CB6C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.6:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"104AC9CF-6611-4469-9852-7FDAF4EC7638\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"DC9E1864-B1E5-42C3-B4AF-9A002916B66D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"31AC91AA-6A9A-43B4-B3E9-A66A34B6E612\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A462C151-982E-4A83-A376-025015F40645\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"660C2AD2-CEC8-4391-84AF-27515A88B29E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.0.10:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"578CC013-776B-4868-B448-B7ACAF3AF832\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.0:-:*:*:*:*:*:*\", \"matchCriteriaId\": \"C310EA3E-399A-48FD-8DE9-6950E328CF23\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.0:beta1:*:*:*:*:*:*\", \"matchCriteriaId\": \"293B2998-5169-4960-BEC4-21DAC837E32B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.0:beta2:*:*:*:*:*:*\", \"matchCriteriaId\": \"FB42A8E7-D273-4CE2-9182-D831D8089BFA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.0:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"DB757DFD-BF47-4483-A2C0-DF37F7D10989\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.0:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"B6C375F2-5027-4B55-9112-C5DD2F787E43\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EAB8D57F-9849-428C-B8E9-D0A1020728BB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"B0359DA8-6B41-46C5-AA95-41B1B366DD4A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.2:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"0965BDB6-9644-465C-AA32-9278B2D53197\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.2:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"7F6B15CF-37C1-4C9B-8457-4A8C9A480188\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.2:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"072EB16D-1325-4869-B156-65E786A834C7\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"847B3C3D-8656-404D-A954-09C159EDC8E2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"65CA2D50-B33C-4088-BDDF-EB964C9A092C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"CADB5989-5260-4F60-ACF2-BEB6D7F97654\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9036E3C7-0AD5-489D-BCEE-31DFE13F5ADA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.6:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"509597D0-22E1-4BE8-95AD-C54FE4D15FA4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.6:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"B86E26CB-2376-4EBC-913C-B354E2D6711B\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"539C550D-FEDD-415E-95AE-40E1AE2BAF1A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.7.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"D5150753-E86D-4859-A046-97B83EAE2C14\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.8:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"59C5B869-74FC-4051-A103-A721332B3CF2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.9:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7C31EBD2-CD2D-4D38-AA51-A5A56487939A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.9:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"F11E9791-7BCE-43E5-A4BA-6449623FE4F9\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.10:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"33FBD4E4-0BCD-49E1-BA84-86621B7C4556\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.10:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"CE521626-2876-455C-9D99-DB74726DC724\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.10:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"2DFDD32E-F49E-47F7-B033-B6C3C0E07FC4\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.10:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"DCBA26F1-FBBA-444D-9C14-F15AB14A4FC5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.10:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"16D3B0EA-49F7-401A-A1D9-437429D33EAD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.12:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"83D1EB17-EE67-48E5-B637-AA9A75D397F6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.12:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"17EBD8B4-C4D3-44A6-9DC1-89D948F126A1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.13:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A2B1711A-5541-412C-A5A0-274CEAB9E387\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.13:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"FCB08CD7-E9B9-454F-BAF7-96162D177677\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.14:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C3AF00C3-93D9-4284-BCB9-40E42CB8386E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.14:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"0D3DA0B4-E374-4ED4-8C3B-F723C968666F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.14:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"B1730A9A-6810-4470-AE6C-A5356D5BFF43\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.14.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"AE4B688E-8638-4539-961D-4FDCBEB4B1C5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.15:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5D0346BB-9180-4FE5-AA35-DC466675ED5D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.15:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"2D6DD9BF-F174-4BE3-9910-BDE3658DC36E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.16:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"40B79E40-75CB-4EBB-8A4B-AF41AED2AE1E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.1.16:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"89B4DCF6-1A21-4B91-ACB4-7DE05487C497\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9A68D41F-36A9-4B77-814D-996F4E48FA79\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.0:beta1:*:*:*:*:*:*\", \"matchCriteriaId\": \"709A19A5-8FD1-4F9C-A38C-F06242A94D68\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.0:beta2:*:*:*:*:*:*\", \"matchCriteriaId\": \"8104482C-E8F5-40A7-8B27-234FEF725FD0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.0:beta3:*:*:*:*:*:*\", \"matchCriteriaId\": \"2CFF8677-EA00-4F7E-BFF9-272482206DB5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.0:beta4:*:*:*:*:*:*\", \"matchCriteriaId\": \"8D7DF5CD-DA28-492D-B5EE-D252ECCC8D96\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.0:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"85435026-9855-4BF4-A436-832628B005FD\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.0:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"56C2308F-A590-47B0-9791-7865D189196F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.0:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"9A266882-DABA-4A4C-88E6-60E993EE0947\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"83F1142C-3BFB-4B72-A033-81E20DB19D02\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.1:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"1FA738A1-227B-4665-B65E-666883FFAE96\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.1:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"6F00718C-A9E8-4E85-8DA6-33BF11F2DCCE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.1:rc3:*:*:*:*:*:*\", \"matchCriteriaId\": \"10789A2D-6401-4119-BFBE-2EE4C16216D3\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.1:rc4:*:*:*:*:*:*\", \"matchCriteriaId\": \"70ABD462-7142-4831-8EB6-801EC1D05573\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"81D717DB-7C80-48AA-A774-E291D2E75D6E\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.3:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"06B357FB-0307-4EFA-9C5B-3C2CDEA48584\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.3:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"E4BD8840-0F1C-49D3-B843-9CFE64948018\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"79D5B492-43F9-470F-BD21-6EFD93E78453\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.4:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"4EC1F602-D48C-458A-A063-4050BE3BB25F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.5:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"F6A1C015-56AD-489C-B301-68CF1DBF1BEF\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.5:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"FD191625-ACE2-46B6-9AAD-12D682C732C2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.5:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"02C7DB56-267B-4057-A9BA-36D1E58C6282\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.5.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EC163D49-691B-4125-A983-6CF6F6D86DEE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.5.2:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"68B537D1-1584-4D15-9C75-08ED4D45DC3A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.6:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"6A19315C-9A9D-45FE-81C8-074744825B98\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.6:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"1E3B4233-E117-4E77-A60D-3DFD5073154D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.7:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"392CF25B-8400-4185-863F-D6353B664FB2\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:4.2.7:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"3037282A-863A-4C92-A40C-4D436D2621C1\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:5.0.0:beta1:*:*:*:*:*:*\", \"matchCriteriaId\": \"AF8F94CF-D504-4165-A69E-3F1198CB162A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:5.0.0:beta1.1:*:*:*:*:*:*\", \"matchCriteriaId\": \"C8C25977-AB6C-45E1-8956-871EB31B36BA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:5.0.0:beta2:*:*:*:*:*:*\", \"matchCriteriaId\": \"5F0AB6B0-3506-4332-A183-309FAC4882CE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:5.0.0:beta3:*:*:*:*:*:*\", \"matchCriteriaId\": \"6D7B4EBC-B634-4AD7-9F7A-54D14821D5AE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:5.0.0:beta4:*:*:*:*:*:*\", \"matchCriteriaId\": \"F844FB25-6E27-412F-8394-A7FB15AC1191\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:5.0.0:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"A4E608ED-F4AB-4F29-B34E-2841A59580A6\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:rails:5.0.0:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"6320DD44-7D7E-4075-A865-BEAFF86FDA9D\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"224BD488-0D7E-4F8B-9012-DE872DEB544C\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"A325F57E-0055-4279-9ED7-A26E75FC38E5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"9A3BA4AE-B4F0-4204-AFA1-1016F0A6F7AB\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"991F368C-CEB5-4DE6-A7EE-C341F358A4CE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.15:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"01DB164E-E08E-4649-84BD-15B4159A3AA0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.15:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"E0F7ECFB-86A1-4F00-AD47-971FA23C6D21\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.19:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"69702127-AB96-4FE0-9AC4-FBE7B8CA77E5\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.20:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"48D71F7B-CF93-41D4-A824-51CB11F08692\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.22:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"60CE659B-DF49-477B-8879-C33823F6527F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.22.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"7EF68196-7C9E-40FE-868D-C42FF82D52EE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.10:rc2:*:*:*:*:*:*\", \"matchCriteriaId\": \"9C8E749B-2908-442A-99F0-91E2772336ED\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.11:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"9E43D2D7-89AE-4805-9732-F1C601D8D8B8\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.11.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"5F3D8911-060D-435D-ACA2-E29271170CAA\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.12:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"EA7A4939-16CF-450D-846A-75B231E32D61\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.13:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C964D4A2-3F39-4CC7-A028-B42C94DDB56F\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.13:rc1:*:*:*:*:*:*\", \"matchCriteriaId\": \"3B54D9FE-0A38-4053-9F3C-8831E2DD2BF0\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:ruby_on_rails:4.1.11:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"23FD6D82-9A14-4BD4-AA00-1875F0962ACE\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:ruby_on_rails:4.1.14.1:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"91AB2B26-A6F1-44D2-92EB-8078DD6FD63A\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:ruby_on_rails:5.0.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"E971CF9D-B807-4A74-81EB-D7CB4E5B8099\"}, {\"vulnerable\": true, \"criteria\": \"cpe:2.3:a:rubyonrails:ruby_on_rails:5.0.0:racecar1:*:*:*:*:*:*\", \"matchCriteriaId\": \"0B31291C-CBB5-4E51-B0AC-4144E8BAD65B\"}]}]}, {\"nodes\": [{\"operator\": \"OR\", \"negate\": false, \"cpeMatch\": [{\"vulnerable\": true, \"criteria\": \"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\", \"matchCriteriaId\": \"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"}]}]}]",
"descriptions": "[{\"lang\": \"en\", \"value\": \"Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \\\"HTML safe\\\" and used as attribute values in tag handlers.\"}, {\"lang\": \"es\", \"value\": \"Vulnerabilidad de XSS en Action View en Ruby en Rails 3.x en versiones anteriores a 3.2.22.3, 4.x en versiones anteriores a 4.2.7.1 y 5.x en versiones anteriores a 5.0.0.1 podr\\u00eda permitir a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\\u00e9s de texto declarado como \\\"HTML safe\\\" y utilizado como valores de atributos en los manejadores de etiquetas.\"}]",
"id": "CVE-2016-6316",
"lastModified": "2024-11-21T02:55:53.280",
"metrics": "{\"cvssMetricV30\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"3.0\", \"vectorString\": \"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\", \"baseScore\": 6.1, \"baseSeverity\": \"MEDIUM\", \"attackVector\": \"NETWORK\", \"attackComplexity\": \"LOW\", \"privilegesRequired\": \"NONE\", \"userInteraction\": \"REQUIRED\", \"scope\": \"CHANGED\", \"confidentialityImpact\": \"LOW\", \"integrityImpact\": \"LOW\", \"availabilityImpact\": \"NONE\"}, \"exploitabilityScore\": 2.8, \"impactScore\": 2.7}], \"cvssMetricV2\": [{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"cvssData\": {\"version\": \"2.0\", \"vectorString\": \"AV:N/AC:M/Au:N/C:N/I:P/A:N\", \"baseScore\": 4.3, \"accessVector\": \"NETWORK\", \"accessComplexity\": \"MEDIUM\", \"authentication\": \"NONE\", \"confidentialityImpact\": \"NONE\", \"integrityImpact\": \"PARTIAL\", \"availabilityImpact\": \"NONE\"}, \"baseSeverity\": \"MEDIUM\", \"exploitabilityScore\": 8.6, \"impactScore\": 2.9, \"acInsufInfo\": false, \"obtainAllPrivilege\": false, \"obtainUserPrivilege\": false, \"obtainOtherPrivilege\": false, \"userInteractionRequired\": true}]}",
"published": "2016-09-07T19:28:10.067",
"references": "[{\"url\": \"http://rhn.redhat.com/errata/RHSA-2016-1855.html\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2016-1856.html\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2016-1857.html\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2016-1858.html\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Release Notes\", \"Vendor Advisory\"]}, {\"url\": \"http://www.debian.org/security/2016/dsa-3651\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2016/08/11/3\", \"source\": \"secalert@redhat.com\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/92430\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://groups.google.com/forum/#%21topic/ruby-security-ann/8B2iV2tPRSE\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"https://puppet.com/security/cve/cve-2016-6316\", \"source\": \"secalert@redhat.com\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2016-1855.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2016-1856.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2016-1857.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://rhn.redhat.com/errata/RHSA-2016-1858.html\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Release Notes\", \"Vendor Advisory\"]}, {\"url\": \"http://www.debian.org/security/2016/dsa-3651\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.openwall.com/lists/oss-security/2016/08/11/3\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\", \"tags\": [\"Third Party Advisory\"]}, {\"url\": \"http://www.securityfocus.com/bid/92430\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://groups.google.com/forum/#%21topic/ruby-security-ann/8B2iV2tPRSE\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}, {\"url\": \"https://puppet.com/security/cve/cve-2016-6316\", \"source\": \"af854a3a-2127-422b-91ae-364da2661108\"}]",
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": "[{\"source\": \"nvd@nist.gov\", \"type\": \"Primary\", \"description\": [{\"lang\": \"en\", \"value\": \"CWE-79\"}]}]"
},
"nvd": "{\"cve\":{\"id\":\"CVE-2016-6316\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2016-09-07T19:28:10.067\",\"lastModified\":\"2024-11-21T02:55:53.280\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \\\"HTML safe\\\" and used as attribute values in tag handlers.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de XSS en Action View en Ruby en Rails 3.x en versiones anteriores a 3.2.22.3, 4.x en versiones anteriores a 4.2.7.1 y 5.x en versiones anteriores a 5.0.0.1 podr\u00eda permitir a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de texto declarado como \\\"HTML safe\\\" y utilizado como valores de atributos en los manejadores de etiquetas.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E3BE7DFE-BA20-434B-A1DE-AD038B255C60\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"DCEE5B21-C990-4705-8239-0D7B29DAEDA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"65EE33B1-B079-4CDE-B9C2-F1613A4610DC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"5CAAA20B-824F-4448-99DC-9712FE628073\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D2BEBDFB-0F30-454A-B74C-F820C9D2708B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D7CD8C1-95D1-477E-AD96-6582EC33BA01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"B6F00D98-3D0F-40AF-AE4F-090B1E6B660C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9476CE55-69C0-45D3-B723-6F459C90BF05\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"112FC73B-A8BC-4EEA-9F4B-CCE685EF2838\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D26565B1-2BA6-4A3C-9264-7FC9A1820B59\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"644EF85E-6D3E-4F5C-96B0-49AD2A2D90CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"392E2D58-CB39-4832-B4D9-9C2E23B8E14C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F2466EA-7039-46A1-B4A3-8DACD1953A59\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CAB4E72-0A15-4B26-9B69-074C278568D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A085E105-9375-440A-80CB-9B23E6D7EB4A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"25911E48-C5D7-4ED8-B4DB-7523A74CCF49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE6EC1E5-3A4A-4751-9F77-28EF5AF681E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B29674E3-CC80-446B-9A43-82594AE7A058\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF34D8CB-2B6D-4CB8-A206-108293BCFFE7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8E5187F6-E3AC-4E0D-B1D0-83DE76C20A4B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"272268EE-E3E8-4683-B679-55D748877A7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"7B69FD33-61FE-4F10-BBE1-215F59035D30\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"08D7CB5D-82EF-4A24-A792-938FAB40863D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A044B21-47D5-468D-AF4A-06B3B5CC0824\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2196F3D0-532A-40F9-843A-1DFBC8B63FDC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"CBEDA932-6CB5-438C-94E4-824732A91BE0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"903E5524-5E45-48CE-A804-EDAEBE3A79AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"08534AF2-F94E-4FB6-A572-4FB9827276D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"29E3B4A6-1346-4358-B7BC-84D00ED3ABBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B52D7A6B-DD93-45F0-9186-18ABEFF28DF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F07C641-48DF-43BE-9EB5-72B337C54846\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A1CB1B12-99F5-430F-AE19-9A95C17FA123\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D1A7C449-8F9A-4CE5-9C3D-375996BFAEE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"05D5D58C-DB79-41EA-81AE-5D95C48211B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE331D6D-99BA-4369-AD8B-B556DEE4955F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"58304E17-ADFD-4686-9CCF-C1CA31843B94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"05108EF0-81AD-4378-9843-5C23F2AC79A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4EE7DA7E-23A5-42AF-9D5C-39240CE2FBDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C448F62-8231-4221-ADA0-C9B848AE03D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5FBD11A1-51C7-4AF7-AA0B-3A14C5435E70\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"60255706-C44A-48CB-B98B-A1F0991CBC74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0456E2E8-EF06-414E-8A7D-8005F0EB46B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9EE4763-2495-4B6A-B72F-344967E51C27\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB51F3E9-4899-49A9-9E7B-0DCA92A91DD8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F884F2F4-94F3-46CB-860B-1BCC0EEF408A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"88DFBB48-1C29-4639-9369-F5B413CA2337\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"D37696D7-BEE6-4587-9E33-A7FE24780409\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E95B5D44-0C8D-47BC-A89D-48A5BDEB84F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"1DFDAF6A-76AA-436F-A4F3-DA69892DE2B8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3172982-3FA4-427F-BE3E-2321D804E49D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD6EC85B-F092-48FF-966A-96B9227C8656\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"9000F3C1-57A0-474C-9C82-E58688F29838\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E55E42E-AB6A-4E47-AC69-DFDAEB0A8735\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A42F4E7A-6F6A-485C-8D30-95F3B0285922\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"30B9C0CB-F6E6-4233-84E4-D6E69104DD73\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"84309CC7-A8B7-4ADB-AEA1-964DA5F7B0E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"5343241F-274D-45FF-97C7-2BC2E920BAF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FED122B8-AF4C-4C48-B1E5-54F4A7A31A53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"157ACCAD-0FB8-4CC9-9DFB-70835DE6506C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"3E50ACF6-7277-4C9A-B42A-E7EFDC317691\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C191DC2B-1EC3-48E0-A586-867E6EE4431C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3AA51263-6680-42C6-B119-8241D6F76206\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B4BC41E8-FEDA-4C31-B479-D49A59FC4D63\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"09C20971-53B5-43B0-AC45-5AA0FDF1B054\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"D1AEFA5D-A793-4BAB-8DED-3D3A31260AD8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"496902D6-409A-40D9-849F-C41264BE5B04\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2482AB3F-8303-4F95-BE04-C5F06EEF2015\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"244C6952-377C-4AF0-8BA2-C34516A3EB5A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"98A79CC5-71EC-4E90-9E99-2DF62ABC0122\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6562F3C3-D794-4107-95D4-1C0B0486940B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"11F211A0-AC69-482A-B659-AEE7BE4E4CD6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2816C02C-E13E-4367-91F3-14756A90EC9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E82AF7C7-B725-40EF-8EE3-18F8E7FAEB29\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"1AE674DE-65DB-437E-A034-A2EE5C584B33\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0524F3E3-BAD7-4CD3-A6E7-74CFBE4B46E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"32EB2C3F-0F24-43DB-988E-BD2973598F71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB32713D-FE64-445E-872E-B4678C243AB1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C55E6B4A-2B9C-46C8-A739-109EA4BA7FD4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"89C618DC-38BC-4484-8C41-BC38B7EB636B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE1EF01A-F358-45D3-ADA2-51DD1D8CB6E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AC2616BD-A4E8-42F3-BB5A-7517DC4EDA3D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0E376782-98B0-4766-B6FC-67E032A00C62\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"96D08DC1-14E9-4DB9-BC95-3F73B454FBC4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F365C9E5-27DC-46C3-AFE4-4876EC7B352B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F0016A6-0ED6-443D-B969-CB1226D8E28C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.7:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"42232305-7D62-4692-81CC-B7E9CE642372\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E69470EA-5EBC-4FB9-A722-5B61C70C1140\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD2818D7-5006-4486-AE55-47B63C8F114B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"83EF40E0-1C62-415A-892B-C071B109D924\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B13A8EBB-4211-4AB1-8872-244EEEE20ABD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22D707A0-7CA9-4CED-8DBA-1B50B57EDB2B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C3CADF8-3316-4514-9A70-AD3DF16B19E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"D0D4AF31-A47B-4BE3-A99B-9A0EB7C53D20\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C9AB2152-DED8-4CFD-B915-94A9F56FDD05\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C630AB60-DBAF-421E-B663-492BAE8A180F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0F41CCF8-14EB-4327-A675-83BFDBB53196\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"75842F7D-B1B1-48BA-858F-01148867B3AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE65D701-AA6E-48E4-B62B-C22DEE863503\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B1E475-C873-4561-9348-027721C08D79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C0406FF0-30F5-40E2-B9B8-FE465D923DE4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"6646610D-279B-4AEC-B445-981E7784EE5B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"50F51980-EAD9-4E4D-A2E7-1FACFA80AAB0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CC02A7D1-CB1A-4793-86E3-CF88D0BCDF83\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A499584B-6E2E-42F3-B0CE-DA7BDD732897\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AE982FFD-D30F-4872-9C36-74DE50405B18\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.22.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EA770BE3-DD37-45C9-9E6D-8D3407D1A5D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E950E33-CD03-45F5-83F9-F106060B4A8B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.0:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"547C62C8-4B3E-431B-AA73-5C42ED884671\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"4CDAD329-35F7-4C82-8019-A0CF6D069059\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"56D3858B-0FEE-4E8D-83C2-68AF0431F478\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.1:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"254884EE-EBA4-45D0-9704-B5CB22569668\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"35FC7015-267C-403B-A23D-EDA6223D2104\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5C913A56-959D-44F1-BD89-D246C66D1F09\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D5BA926-38EE-47BE-9D16-FDCF360A503B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"18EA25F1-279A-4F1A-883D-C064369F592E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD794856-6F30-4ABF-8AE4-720BB75E6F89\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B4199B8B-A6F9-4BFD-8D27-0E663D8C579D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F11E76A3-FA5B-4038-AB52-3D7D5E54D8A2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.4:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"C583ACDE-55D5-4D2F-838F-BEC5BDCDE3B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"767C481D-6616-4CA9-9A9B-C994D9121796\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D5496953-0C5E-45F8-A7FB-240CEC2CCEB8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.6:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA46B621-125E-497F-B2DE-91C989B25936\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.6:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3239443-2E19-4540-BA0C-05A27E44CB6C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.6:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"104AC9CF-6611-4469-9852-7FDAF4EC7638\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC9E1864-B1E5-42C3-B4AF-9A002916B66D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"31AC91AA-6A9A-43B4-B3E9-A66A34B6E612\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A462C151-982E-4A83-A376-025015F40645\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"660C2AD2-CEC8-4391-84AF-27515A88B29E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"578CC013-776B-4868-B448-B7ACAF3AF832\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"C310EA3E-399A-48FD-8DE9-6950E328CF23\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"293B2998-5169-4960-BEC4-21DAC837E32B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.0:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"FB42A8E7-D273-4CE2-9182-D831D8089BFA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB757DFD-BF47-4483-A2C0-DF37F7D10989\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"B6C375F2-5027-4B55-9112-C5DD2F787E43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EAB8D57F-9849-428C-B8E9-D0A1020728BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B0359DA8-6B41-46C5-AA95-41B1B366DD4A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0965BDB6-9644-465C-AA32-9278B2D53197\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.2:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F6B15CF-37C1-4C9B-8457-4A8C9A480188\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.2:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"072EB16D-1325-4869-B156-65E786A834C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"847B3C3D-8656-404D-A954-09C159EDC8E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"65CA2D50-B33C-4088-BDDF-EB964C9A092C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CADB5989-5260-4F60-ACF2-BEB6D7F97654\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9036E3C7-0AD5-489D-BCEE-31DFE13F5ADA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.6:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"509597D0-22E1-4BE8-95AD-C54FE4D15FA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.6:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"B86E26CB-2376-4EBC-913C-B354E2D6711B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"539C550D-FEDD-415E-95AE-40E1AE2BAF1A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.7.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D5150753-E86D-4859-A046-97B83EAE2C14\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"59C5B869-74FC-4051-A103-A721332B3CF2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7C31EBD2-CD2D-4D38-AA51-A5A56487939A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F11E9791-7BCE-43E5-A4BA-6449623FE4F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"33FBD4E4-0BCD-49E1-BA84-86621B7C4556\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"CE521626-2876-455C-9D99-DB74726DC724\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"2DFDD32E-F49E-47F7-B033-B6C3C0E07FC4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.10:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DCBA26F1-FBBA-444D-9C14-F15AB14A4FC5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.10:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"16D3B0EA-49F7-401A-A1D9-437429D33EAD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"83D1EB17-EE67-48E5-B637-AA9A75D397F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17EBD8B4-C4D3-44A6-9DC1-89D948F126A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2B1711A-5541-412C-A5A0-274CEAB9E387\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FCB08CD7-E9B9-454F-BAF7-96162D177677\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C3AF00C3-93D9-4284-BCB9-40E42CB8386E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3DA0B4-E374-4ED4-8C3B-F723C968666F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1730A9A-6810-4470-AE6C-A5356D5BFF43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.14.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AE4B688E-8638-4539-961D-4FDCBEB4B1C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D0346BB-9180-4FE5-AA35-DC466675ED5D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D6DD9BF-F174-4BE3-9910-BDE3658DC36E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"40B79E40-75CB-4EBB-8A4B-AF41AED2AE1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"89B4DCF6-1A21-4B91-ACB4-7DE05487C497\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9A68D41F-36A9-4B77-814D-996F4E48FA79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"709A19A5-8FD1-4F9C-A38C-F06242A94D68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.0:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"8104482C-E8F5-40A7-8B27-234FEF725FD0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.0:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"2CFF8677-EA00-4F7E-BFF9-272482206DB5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.0:beta4:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D7DF5CD-DA28-492D-B5EE-D252ECCC8D96\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"85435026-9855-4BF4-A436-832628B005FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"56C2308F-A590-47B0-9791-7865D189196F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"9A266882-DABA-4A4C-88E6-60E993EE0947\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"83F1142C-3BFB-4B72-A033-81E20DB19D02\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"1FA738A1-227B-4665-B65E-666883FFAE96\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F00718C-A9E8-4E85-8DA6-33BF11F2DCCE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"10789A2D-6401-4119-BFBE-2EE4C16216D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"70ABD462-7142-4831-8EB6-801EC1D05573\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"81D717DB-7C80-48AA-A774-E291D2E75D6E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"06B357FB-0307-4EFA-9C5B-3C2CDEA48584\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.3:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E4BD8840-0F1C-49D3-B843-9CFE64948018\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"79D5B492-43F9-470F-BD21-6EFD93E78453\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.4:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"4EC1F602-D48C-458A-A063-4050BE3BB25F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F6A1C015-56AD-489C-B301-68CF1DBF1BEF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.5:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD191625-ACE2-46B6-9AAD-12D682C732C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.5:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"02C7DB56-267B-4057-A9BA-36D1E58C6282\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC163D49-691B-4125-A983-6CF6F6D86DEE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.5.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"68B537D1-1584-4D15-9C75-08ED4D45DC3A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6A19315C-9A9D-45FE-81C8-074744825B98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.6:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"1E3B4233-E117-4E77-A60D-3DFD5073154D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"392CF25B-8400-4185-863F-D6353B664FB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.7:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"3037282A-863A-4C92-A40C-4D436D2621C1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:5.0.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF8F94CF-D504-4165-A69E-3F1198CB162A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:5.0.0:beta1.1:*:*:*:*:*:*\",\"matchCriteriaId\":\"C8C25977-AB6C-45E1-8956-871EB31B36BA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:5.0.0:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F0AB6B0-3506-4332-A183-309FAC4882CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:5.0.0:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D7B4EBC-B634-4AD7-9F7A-54D14821D5AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:5.0.0:beta4:*:*:*:*:*:*\",\"matchCriteriaId\":\"F844FB25-6E27-412F-8394-A7FB15AC1191\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:5.0.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A4E608ED-F4AB-4F29-B34E-2841A59580A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:5.0.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"6320DD44-7D7E-4075-A865-BEAFF86FDA9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"224BD488-0D7E-4F8B-9012-DE872DEB544C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A325F57E-0055-4279-9ED7-A26E75FC38E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"9A3BA4AE-B4F0-4204-AFA1-1016F0A6F7AB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"991F368C-CEB5-4DE6-A7EE-C341F358A4CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"01DB164E-E08E-4649-84BD-15B4159A3AA0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F7ECFB-86A1-4F00-AD47-971FA23C6D21\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"69702127-AB96-4FE0-9AC4-FBE7B8CA77E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"48D71F7B-CF93-41D4-A824-51CB11F08692\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"60CE659B-DF49-477B-8879-C33823F6527F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.22.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7EF68196-7C9E-40FE-868D-C42FF82D52EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"9C8E749B-2908-442A-99F0-91E2772336ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E43D2D7-89AE-4805-9732-F1C601D8D8B8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.11.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F3D8911-060D-435D-ACA2-E29271170CAA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EA7A4939-16CF-450D-846A-75B231E32D61\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C964D4A2-3F39-4CC7-A028-B42C94DDB56F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"3B54D9FE-0A38-4053-9F3C-8831E2DD2BF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:4.1.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"23FD6D82-9A14-4BD4-AA00-1875F0962ACE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:4.1.14.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"91AB2B26-A6F1-44D2-92EB-8078DD6FD63A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:5.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E971CF9D-B807-4A74-81EB-D7CB4E5B8099\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:5.0.0:racecar1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B31291C-CBB5-4E51-B0AC-4144E8BAD65B\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"}]}]}],\"references\":[{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-1855.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-1856.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-1857.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-1858.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"http://www.debian.org/security/2016/dsa-3651\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2016/08/11/3\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/92430\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://groups.google.com/forum/#%21topic/ruby-security-ann/8B2iV2tPRSE\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://puppet.com/security/cve/cve-2016-6316\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-1855.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-1856.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-1857.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-1858.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"http://www.debian.org/security/2016/dsa-3651\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2016/08/11/3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/92430\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://groups.google.com/forum/#%21topic/ruby-security-ann/8B2iV2tPRSE\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://puppet.com/security/cve/cve-2016-6316\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
rhsa-2016_1855
Vulnerability from csaf_redhat
Published
2016-09-13 11:09
Modified
2024-11-14 20:47
Summary
Red Hat Security Advisory: rh-ror42 security update
Notes
Topic
An update for rh-ror42-rubygem-actionview, rh-ror42-rubygem-activerecord, and rh-ror42-rubygem-actionpack is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component, and Active Record implements the model component.
Security Fix(es) in rubygem-actionview:
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Security Fix(es) in rubygem-activerecord:
* A flaw was found in the way Active Record handled certain special values in dynamic finders and relations. If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application. (CVE-2016-6317)
Red Hat would like to thank the Ruby on Rails project for reporting these issues. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter of CVE-2016-6316; and joernchen (Phenoelit) as the original reporter of CVE-2016-6317.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for rh-ror42-rubygem-actionview, rh-ror42-rubygem-activerecord, and rh-ror42-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component, and Active Record implements the model component.\n\nSecurity Fix(es) in rubygem-actionview:\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nSecurity Fix(es) in rubygem-activerecord:\n\n* A flaw was found in the way Active Record handled certain special values in dynamic finders and relations. If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application. (CVE-2016-6317)\n\nRed Hat would like to thank the Ruby on Rails project for reporting these issues. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter of CVE-2016-6316; and joernchen (Phenoelit) as the original reporter of CVE-2016-6317.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1855",
"url": "https://access.redhat.com/errata/RHSA-2016:1855"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "1365017",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365017"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1855.json"
}
],
"title": "Red Hat Security Advisory: rh-ror42 security update",
"tracking": {
"current_release_date": "2024-11-14T20:47:47+00:00",
"generator": {
"date": "2024-11-14T20:47:47+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:1855",
"initial_release_date": "2016-09-13T11:09:39+00:00",
"revision_history": [
{
"date": "2016-09-13T11:09:39+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:09:39+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T20:47:47+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionview@4.2.6-3.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionview-doc@4.2.6-3.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-activerecord-doc@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-activerecord@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack-doc@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"product": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"product_id": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionview@4.2.6-3.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"product": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"product_id": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-activerecord@4.2.6-3.el7?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"product": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-3.el7?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:09:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1855"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
},
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"joernchen"
],
"organization": "Phenoelit",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6317",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365017"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the way Active Record handled certain special values in dynamic finders and relations. If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-activerecord: unsafe query generation in Active Record",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6317"
},
{
"category": "external",
"summary": "RHBZ#1365017",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365017"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6317",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6317"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6317",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6317"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/rgO20zYW33s/gmamLa-wDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/rgO20zYW33s/gmamLa-wDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:09:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1855"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-activerecord: unsafe query generation in Active Record"
}
]
}
rhsa-2016:1857
Vulnerability from csaf_redhat
Published
2016-09-13 11:07
Modified
2024-11-14 20:48
Summary
Red Hat Security Advisory: ror40-rubygem-actionpack security update
Notes
Topic
An update for ror40-rubygem-actionpack is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.
Security Fix(es):
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for ror40-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nRed Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1857",
"url": "https://access.redhat.com/errata/RHSA-2016:1857"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1857.json"
}
],
"title": "Red Hat Security Advisory: ror40-rubygem-actionpack security update",
"tracking": {
"current_release_date": "2024-11-14T20:48:42+00:00",
"generator": {
"date": "2024-11-14T20:48:42+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:1857",
"initial_release_date": "2016-09-13T11:07:09+00:00",
"revision_history": [
{
"date": "2016-09-13T11:07:09+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:07:09+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T20:48:42+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"product": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"product_id": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack-doc@4.0.2-8.el6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"product": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"product_id": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack-doc@4.0.2-8.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el7?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el6?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el7?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:07:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running applications using ror40-rubygem-actionpack must be restarted for this update to take effect.",
"product_ids": [
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1857"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
}
]
}
rhsa-2016:1855
Vulnerability from csaf_redhat
Published
2016-09-13 11:09
Modified
2024-11-14 20:47
Summary
Red Hat Security Advisory: rh-ror42 security update
Notes
Topic
An update for rh-ror42-rubygem-actionview, rh-ror42-rubygem-activerecord, and rh-ror42-rubygem-actionpack is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component, and Active Record implements the model component.
Security Fix(es) in rubygem-actionview:
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Security Fix(es) in rubygem-activerecord:
* A flaw was found in the way Active Record handled certain special values in dynamic finders and relations. If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application. (CVE-2016-6317)
Red Hat would like to thank the Ruby on Rails project for reporting these issues. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter of CVE-2016-6316; and joernchen (Phenoelit) as the original reporter of CVE-2016-6317.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for rh-ror42-rubygem-actionview, rh-ror42-rubygem-activerecord, and rh-ror42-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component, and Active Record implements the model component.\n\nSecurity Fix(es) in rubygem-actionview:\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nSecurity Fix(es) in rubygem-activerecord:\n\n* A flaw was found in the way Active Record handled certain special values in dynamic finders and relations. If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application. (CVE-2016-6317)\n\nRed Hat would like to thank the Ruby on Rails project for reporting these issues. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter of CVE-2016-6316; and joernchen (Phenoelit) as the original reporter of CVE-2016-6317.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1855",
"url": "https://access.redhat.com/errata/RHSA-2016:1855"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "1365017",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365017"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1855.json"
}
],
"title": "Red Hat Security Advisory: rh-ror42 security update",
"tracking": {
"current_release_date": "2024-11-14T20:47:47+00:00",
"generator": {
"date": "2024-11-14T20:47:47+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:1855",
"initial_release_date": "2016-09-13T11:09:39+00:00",
"revision_history": [
{
"date": "2016-09-13T11:09:39+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:09:39+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T20:47:47+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionview@4.2.6-3.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionview-doc@4.2.6-3.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-activerecord-doc@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-activerecord@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack-doc@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"product": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"product_id": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionview@4.2.6-3.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"product": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"product_id": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-activerecord@4.2.6-3.el7?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"product": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-3.el7?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:09:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1855"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
},
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"joernchen"
],
"organization": "Phenoelit",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6317",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365017"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the way Active Record handled certain special values in dynamic finders and relations. If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-activerecord: unsafe query generation in Active Record",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6317"
},
{
"category": "external",
"summary": "RHBZ#1365017",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365017"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6317",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6317"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6317",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6317"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/rgO20zYW33s/gmamLa-wDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/rgO20zYW33s/gmamLa-wDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:09:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1855"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-activerecord: unsafe query generation in Active Record"
}
]
}
rhsa-2016:1856
Vulnerability from csaf_redhat
Published
2016-09-13 11:08
Modified
2024-11-14 20:48
Summary
Red Hat Security Advisory: rh-ror41-rubygem-actionview security update
Notes
Topic
An update for rh-ror41-rubygem-actionview is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component.
Security Fix(es):
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for rh-ror41-rubygem-actionview is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component.\n\nSecurity Fix(es):\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nRed Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1856",
"url": "https://access.redhat.com/errata/RHSA-2016:1856"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1856.json"
}
],
"title": "Red Hat Security Advisory: rh-ror41-rubygem-actionview security update",
"tracking": {
"current_release_date": "2024-11-14T20:48:37+00:00",
"generator": {
"date": "2024-11-14T20:48:37+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:1856",
"initial_release_date": "2016-09-13T11:08:25+00:00",
"revision_history": [
{
"date": "2016-09-13T11:08:25+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:08:25+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T20:48:37+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"product_id": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview-doc@4.1.5-6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"product_id": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview-doc@4.1.5-6.el6?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:08:25+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running applications using rh-ror41-rubygem-actionviewmust be restarted for this update to take effect.",
"product_ids": [
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1856"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
}
]
}
RHSA-2016:1856
Vulnerability from csaf_redhat
Published
2016-09-13 11:08
Modified
2024-11-14 20:48
Summary
Red Hat Security Advisory: rh-ror41-rubygem-actionview security update
Notes
Topic
An update for rh-ror41-rubygem-actionview is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component.
Security Fix(es):
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for rh-ror41-rubygem-actionview is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component.\n\nSecurity Fix(es):\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nRed Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1856",
"url": "https://access.redhat.com/errata/RHSA-2016:1856"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1856.json"
}
],
"title": "Red Hat Security Advisory: rh-ror41-rubygem-actionview security update",
"tracking": {
"current_release_date": "2024-11-14T20:48:37+00:00",
"generator": {
"date": "2024-11-14T20:48:37+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:1856",
"initial_release_date": "2016-09-13T11:08:25+00:00",
"revision_history": [
{
"date": "2016-09-13T11:08:25+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:08:25+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T20:48:37+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"product_id": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview-doc@4.1.5-6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"product_id": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview-doc@4.1.5-6.el6?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:08:25+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running applications using rh-ror41-rubygem-actionviewmust be restarted for this update to take effect.",
"product_ids": [
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1856"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
}
]
}
RHSA-2016:1858
Vulnerability from csaf_redhat
Published
2016-09-13 11:05
Modified
2024-11-14 20:48
Summary
Red Hat Security Advisory: ruby193-rubygem-actionpack security update
Notes
Topic
An update for ruby193-rubygem-actionpack is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.
Security Fix(es):
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for ruby193-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nRed Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1858",
"url": "https://access.redhat.com/errata/RHSA-2016:1858"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1858.json"
}
],
"title": "Red Hat Security Advisory: ruby193-rubygem-actionpack security update",
"tracking": {
"current_release_date": "2024-11-14T20:48:46+00:00",
"generator": {
"date": "2024-11-14T20:48:46+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:1858",
"initial_release_date": "2016-09-13T11:05:54+00:00",
"revision_history": [
{
"date": "2016-09-13T11:05:54+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:05:54+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T20:48:46+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el7?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el6?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"product_id": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack-doc@3.2.8-20.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"product_id": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack-doc@3.2.8-20.el6?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:05:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running applications using ruby193-rubygem-actionpack must be restarted for this update to take effect.",
"product_ids": [
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1858"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
}
]
}
rhsa-2016_1857
Vulnerability from csaf_redhat
Published
2016-09-13 11:07
Modified
2024-11-14 20:48
Summary
Red Hat Security Advisory: ror40-rubygem-actionpack security update
Notes
Topic
An update for ror40-rubygem-actionpack is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.
Security Fix(es):
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for ror40-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nRed Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1857",
"url": "https://access.redhat.com/errata/RHSA-2016:1857"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1857.json"
}
],
"title": "Red Hat Security Advisory: ror40-rubygem-actionpack security update",
"tracking": {
"current_release_date": "2024-11-14T20:48:42+00:00",
"generator": {
"date": "2024-11-14T20:48:42+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:1857",
"initial_release_date": "2016-09-13T11:07:09+00:00",
"revision_history": [
{
"date": "2016-09-13T11:07:09+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:07:09+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T20:48:42+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"product": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"product_id": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack-doc@4.0.2-8.el6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"product": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"product_id": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack-doc@4.0.2-8.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el7?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el6?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el7?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:07:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running applications using ror40-rubygem-actionpack must be restarted for this update to take effect.",
"product_ids": [
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1857"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
}
]
}
RHSA-2016:1855
Vulnerability from csaf_redhat
Published
2016-09-13 11:09
Modified
2024-11-14 20:47
Summary
Red Hat Security Advisory: rh-ror42 security update
Notes
Topic
An update for rh-ror42-rubygem-actionview, rh-ror42-rubygem-activerecord, and rh-ror42-rubygem-actionpack is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component, and Active Record implements the model component.
Security Fix(es) in rubygem-actionview:
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Security Fix(es) in rubygem-activerecord:
* A flaw was found in the way Active Record handled certain special values in dynamic finders and relations. If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application. (CVE-2016-6317)
Red Hat would like to thank the Ruby on Rails project for reporting these issues. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter of CVE-2016-6316; and joernchen (Phenoelit) as the original reporter of CVE-2016-6317.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for rh-ror42-rubygem-actionview, rh-ror42-rubygem-activerecord, and rh-ror42-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component, and Active Record implements the model component.\n\nSecurity Fix(es) in rubygem-actionview:\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nSecurity Fix(es) in rubygem-activerecord:\n\n* A flaw was found in the way Active Record handled certain special values in dynamic finders and relations. If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application. (CVE-2016-6317)\n\nRed Hat would like to thank the Ruby on Rails project for reporting these issues. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter of CVE-2016-6316; and joernchen (Phenoelit) as the original reporter of CVE-2016-6317.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1855",
"url": "https://access.redhat.com/errata/RHSA-2016:1855"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "1365017",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365017"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1855.json"
}
],
"title": "Red Hat Security Advisory: rh-ror42 security update",
"tracking": {
"current_release_date": "2024-11-14T20:47:47+00:00",
"generator": {
"date": "2024-11-14T20:47:47+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:1855",
"initial_release_date": "2016-09-13T11:09:39+00:00",
"revision_history": [
{
"date": "2016-09-13T11:09:39+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:09:39+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T20:47:47+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionview@4.2.6-3.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionview-doc@4.2.6-3.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-activerecord-doc@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-activerecord@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack-doc@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"product": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"product_id": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionview@4.2.6-3.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"product": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"product_id": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-activerecord@4.2.6-3.el7?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"product": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-3.el7?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:09:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1855"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
},
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"joernchen"
],
"organization": "Phenoelit",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6317",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365017"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the way Active Record handled certain special values in dynamic finders and relations. If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-activerecord: unsafe query generation in Active Record",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6317"
},
{
"category": "external",
"summary": "RHBZ#1365017",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365017"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6317",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6317"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6317",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6317"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/rgO20zYW33s/gmamLa-wDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/rgO20zYW33s/gmamLa-wDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:09:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1855"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-activerecord: unsafe query generation in Active Record"
}
]
}
rhsa-2016_1856
Vulnerability from csaf_redhat
Published
2016-09-13 11:08
Modified
2024-11-14 20:48
Summary
Red Hat Security Advisory: rh-ror41-rubygem-actionview security update
Notes
Topic
An update for rh-ror41-rubygem-actionview is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component.
Security Fix(es):
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for rh-ror41-rubygem-actionview is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component.\n\nSecurity Fix(es):\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nRed Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1856",
"url": "https://access.redhat.com/errata/RHSA-2016:1856"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1856.json"
}
],
"title": "Red Hat Security Advisory: rh-ror41-rubygem-actionview security update",
"tracking": {
"current_release_date": "2024-11-14T20:48:37+00:00",
"generator": {
"date": "2024-11-14T20:48:37+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:1856",
"initial_release_date": "2016-09-13T11:08:25+00:00",
"revision_history": [
{
"date": "2016-09-13T11:08:25+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:08:25+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T20:48:37+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"product_id": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview-doc@4.1.5-6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"product_id": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview-doc@4.1.5-6.el6?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:08:25+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running applications using rh-ror41-rubygem-actionviewmust be restarted for this update to take effect.",
"product_ids": [
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1856"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
}
]
}
RHSA-2016:1857
Vulnerability from csaf_redhat
Published
2016-09-13 11:07
Modified
2024-11-14 20:48
Summary
Red Hat Security Advisory: ror40-rubygem-actionpack security update
Notes
Topic
An update for ror40-rubygem-actionpack is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.
Security Fix(es):
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for ror40-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nRed Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1857",
"url": "https://access.redhat.com/errata/RHSA-2016:1857"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1857.json"
}
],
"title": "Red Hat Security Advisory: ror40-rubygem-actionpack security update",
"tracking": {
"current_release_date": "2024-11-14T20:48:42+00:00",
"generator": {
"date": "2024-11-14T20:48:42+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:1857",
"initial_release_date": "2016-09-13T11:07:09+00:00",
"revision_history": [
{
"date": "2016-09-13T11:07:09+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:07:09+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T20:48:42+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"product": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"product_id": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack-doc@4.0.2-8.el6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"product": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"product_id": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack-doc@4.0.2-8.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el7?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el6?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el7?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:07:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running applications using ror40-rubygem-actionpack must be restarted for this update to take effect.",
"product_ids": [
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1857"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
}
]
}
rhsa-2016_1858
Vulnerability from csaf_redhat
Published
2016-09-13 11:05
Modified
2024-11-14 20:48
Summary
Red Hat Security Advisory: ruby193-rubygem-actionpack security update
Notes
Topic
An update for ruby193-rubygem-actionpack is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.
Security Fix(es):
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for ruby193-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nRed Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1858",
"url": "https://access.redhat.com/errata/RHSA-2016:1858"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1858.json"
}
],
"title": "Red Hat Security Advisory: ruby193-rubygem-actionpack security update",
"tracking": {
"current_release_date": "2024-11-14T20:48:46+00:00",
"generator": {
"date": "2024-11-14T20:48:46+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:1858",
"initial_release_date": "2016-09-13T11:05:54+00:00",
"revision_history": [
{
"date": "2016-09-13T11:05:54+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:05:54+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T20:48:46+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el7?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el6?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"product_id": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack-doc@3.2.8-20.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"product_id": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack-doc@3.2.8-20.el6?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:05:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running applications using ruby193-rubygem-actionpack must be restarted for this update to take effect.",
"product_ids": [
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1858"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
}
]
}
rhsa-2016:1858
Vulnerability from csaf_redhat
Published
2016-09-13 11:05
Modified
2024-11-14 20:48
Summary
Red Hat Security Advisory: ruby193-rubygem-actionpack security update
Notes
Topic
An update for ruby193-rubygem-actionpack is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.
Security Fix(es):
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for ruby193-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nRed Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1858",
"url": "https://access.redhat.com/errata/RHSA-2016:1858"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1858.json"
}
],
"title": "Red Hat Security Advisory: ruby193-rubygem-actionpack security update",
"tracking": {
"current_release_date": "2024-11-14T20:48:46+00:00",
"generator": {
"date": "2024-11-14T20:48:46+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:1858",
"initial_release_date": "2016-09-13T11:05:54+00:00",
"revision_history": [
{
"date": "2016-09-13T11:05:54+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:05:54+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T20:48:46+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el7?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el6?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"product_id": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack-doc@3.2.8-20.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"product_id": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack-doc@3.2.8-20.el6?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:05:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running applications using ruby193-rubygem-actionpack must be restarted for this update to take effect.",
"product_ids": [
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1858"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
}
]
}
cve-2016-6316
Vulnerability from fkie_nvd
Published
2016-09-07 19:28
Modified
2024-11-21 02:55
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E3BE7DFE-BA20-434B-A1DE-AD038B255C60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*",
"matchCriteriaId": "DCEE5B21-C990-4705-8239-0D7B29DAEDA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "65EE33B1-B079-4CDE-B9C2-F1613A4610DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "5CAAA20B-824F-4448-99DC-9712FE628073",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "D2BEBDFB-0F30-454A-B74C-F820C9D2708B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*",
"matchCriteriaId": "1D7CD8C1-95D1-477E-AD96-6582EC33BA01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B6F00D98-3D0F-40AF-AE4F-090B1E6B660C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9476CE55-69C0-45D3-B723-6F459C90BF05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "112FC73B-A8BC-4EEA-9F4B-CCE685EF2838",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D26565B1-2BA6-4A3C-9264-7FC9A1820B59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "644EF85E-6D3E-4F5C-96B0-49AD2A2D90CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "392E2D58-CB39-4832-B4D9-9C2E23B8E14C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "1F2466EA-7039-46A1-B4A3-8DACD1953A59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0CAB4E72-0A15-4B26-9B69-074C278568D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "A085E105-9375-440A-80CB-9B23E6D7EB4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:*",
"matchCriteriaId": "25911E48-C5D7-4ED8-B4DB-7523A74CCF49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "FE6EC1E5-3A4A-4751-9F77-28EF5AF681E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B29674E3-CC80-446B-9A43-82594AE7A058",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:*",
"matchCriteriaId": "FF34D8CB-2B6D-4CB8-A206-108293BCFFE7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "8E5187F6-E3AC-4E0D-B1D0-83DE76C20A4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "272268EE-E3E8-4683-B679-55D748877A7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:*",
"matchCriteriaId": "7B69FD33-61FE-4F10-BBE1-215F59035D30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:*",
"matchCriteriaId": "08D7CB5D-82EF-4A24-A792-938FAB40863D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:*",
"matchCriteriaId": "8A044B21-47D5-468D-AF4A-06B3B5CC0824",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "2196F3D0-532A-40F9-843A-1DFBC8B63FDC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:*",
"matchCriteriaId": "CBEDA932-6CB5-438C-94E4-824732A91BE0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:*",
"matchCriteriaId": "903E5524-5E45-48CE-A804-EDAEBE3A79AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:*",
"matchCriteriaId": "08534AF2-F94E-4FB6-A572-4FB9827276D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:*",
"matchCriteriaId": "29E3B4A6-1346-4358-B7BC-84D00ED3ABBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:*",
"matchCriteriaId": "B52D7A6B-DD93-45F0-9186-18ABEFF28DF4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "1F07C641-48DF-43BE-9EB5-72B337C54846",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:*",
"matchCriteriaId": "A1CB1B12-99F5-430F-AE19-9A95C17FA123",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D1A7C449-8F9A-4CE5-9C3D-375996BFAEE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "05D5D58C-DB79-41EA-81AE-5D95C48211B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:*",
"matchCriteriaId": "FE331D6D-99BA-4369-AD8B-B556DEE4955F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "58304E17-ADFD-4686-9CCF-C1CA31843B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:*",
"matchCriteriaId": "05108EF0-81AD-4378-9843-5C23F2AC79A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "4EE7DA7E-23A5-42AF-9D5C-39240CE2FBDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "0C448F62-8231-4221-ADA0-C9B848AE03D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "5FBD11A1-51C7-4AF7-AA0B-3A14C5435E70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.18:*:*:*:*:*:*:*",
"matchCriteriaId": "60255706-C44A-48CB-B98B-A1F0991CBC74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.19:*:*:*:*:*:*:*",
"matchCriteriaId": "0456E2E8-EF06-414E-8A7D-8005F0EB46B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.20:*:*:*:*:*:*:*",
"matchCriteriaId": "D9EE4763-2495-4B6A-B72F-344967E51C27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DB51F3E9-4899-49A9-9E7B-0DCA92A91DD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "F884F2F4-94F3-46CB-860B-1BCC0EEF408A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "88DFBB48-1C29-4639-9369-F5B413CA2337",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "D37696D7-BEE6-4587-9E33-A7FE24780409",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "E95B5D44-0C8D-47BC-A89D-48A5BDEB84F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "1DFDAF6A-76AA-436F-A4F3-DA69892DE2B8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:*",
"matchCriteriaId": "D3172982-3FA4-427F-BE3E-2321D804E49D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:*",
"matchCriteriaId": "FD6EC85B-F092-48FF-966A-96B9227C8656",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:*",
"matchCriteriaId": "9000F3C1-57A0-474C-9C82-E58688F29838",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:*",
"matchCriteriaId": "6E55E42E-AB6A-4E47-AC69-DFDAEB0A8735",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A42F4E7A-6F6A-485C-8D30-95F3B0285922",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "30B9C0CB-F6E6-4233-84E4-D6E69104DD73",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "84309CC7-A8B7-4ADB-AEA1-964DA5F7B0E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "5343241F-274D-45FF-97C7-2BC2E920BAF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FED122B8-AF4C-4C48-B1E5-54F4A7A31A53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "157ACCAD-0FB8-4CC9-9DFB-70835DE6506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "3E50ACF6-7277-4C9A-B42A-E7EFDC317691",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C191DC2B-1EC3-48E0-A586-867E6EE4431C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3AA51263-6680-42C6-B119-8241D6F76206",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B4BC41E8-FEDA-4C31-B479-D49A59FC4D63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "09C20971-53B5-43B0-AC45-5AA0FDF1B054",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D1AEFA5D-A793-4BAB-8DED-3D3A31260AD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "496902D6-409A-40D9-849F-C41264BE5B04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "2482AB3F-8303-4F95-BE04-C5F06EEF2015",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "244C6952-377C-4AF0-8BA2-C34516A3EB5A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "98A79CC5-71EC-4E90-9E99-2DF62ABC0122",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6562F3C3-D794-4107-95D4-1C0B0486940B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "11F211A0-AC69-482A-B659-AEE7BE4E4CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2816C02C-E13E-4367-91F3-14756A90EC9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "E82AF7C7-B725-40EF-8EE3-18F8E7FAEB29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "1AE674DE-65DB-437E-A034-A2EE5C584B33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0524F3E3-BAD7-4CD3-A6E7-74CFBE4B46E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "32EB2C3F-0F24-43DB-988E-BD2973598F71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EB32713D-FE64-445E-872E-B4678C243AB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C55E6B4A-2B9C-46C8-A739-109EA4BA7FD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "89C618DC-38BC-4484-8C41-BC38B7EB636B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "FE1EF01A-F358-45D3-ADA2-51DD1D8CB6E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "AC2616BD-A4E8-42F3-BB5A-7517DC4EDA3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "0E376782-98B0-4766-B6FC-67E032A00C62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "96D08DC1-14E9-4DB9-BC95-3F73B454FBC4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "F365C9E5-27DC-46C3-AFE4-4876EC7B352B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "6F0016A6-0ED6-443D-B969-CB1226D8E28C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "42232305-7D62-4692-81CC-B7E9CE642372",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "E69470EA-5EBC-4FB9-A722-5B61C70C1140",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2818D7-5006-4486-AE55-47B63C8F114B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.8:rc2:*:*:*:*:*:*",
"matchCriteriaId": "83EF40E0-1C62-415A-892B-C071B109D924",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "B13A8EBB-4211-4AB1-8872-244EEEE20ABD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.9:rc1:*:*:*:*:*:*",
"matchCriteriaId": "22D707A0-7CA9-4CED-8DBA-1B50B57EDB2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.9:rc2:*:*:*:*:*:*",
"matchCriteriaId": "0C3CADF8-3316-4514-9A70-AD3DF16B19E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.9:rc3:*:*:*:*:*:*",
"matchCriteriaId": "D0D4AF31-A47B-4BE3-A99B-9A0EB7C53D20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "C9AB2152-DED8-4CFD-B915-94A9F56FDD05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "C630AB60-DBAF-421E-B663-492BAE8A180F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.12:*:*:*:*:*:*:*",
"matchCriteriaId": "0F41CCF8-14EB-4327-A675-83BFDBB53196",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "75842F7D-B1B1-48BA-858F-01148867B3AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.13:rc1:*:*:*:*:*:*",
"matchCriteriaId": "FE65D701-AA6E-48E4-B62B-C22DEE863503",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.13:rc2:*:*:*:*:*:*",
"matchCriteriaId": "17B1E475-C873-4561-9348-027721C08D79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C0406FF0-30F5-40E2-B9B8-FE465D923DE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.15:rc3:*:*:*:*:*:*",
"matchCriteriaId": "6646610D-279B-4AEC-B445-981E7784EE5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.16:*:*:*:*:*:*:*",
"matchCriteriaId": "50F51980-EAD9-4E4D-A2E7-1FACFA80AAB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.17:*:*:*:*:*:*:*",
"matchCriteriaId": "CC02A7D1-CB1A-4793-86E3-CF88D0BCDF83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "A499584B-6E2E-42F3-B0CE-DA7BDD732897",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.21:*:*:*:*:*:*:*",
"matchCriteriaId": "AE982FFD-D30F-4872-9C36-74DE50405B18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.22.2:*:*:*:*:*:*:*",
"matchCriteriaId": "EA770BE3-DD37-45C9-9E6D-8D3407D1A5D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.0:-:*:*:*:*:*:*",
"matchCriteriaId": "2E950E33-CD03-45F5-83F9-F106060B4A8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.0:beta:*:*:*:*:*:*",
"matchCriteriaId": "547C62C8-4B3E-431B-AA73-5C42ED884671",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "4CDAD329-35F7-4C82-8019-A0CF6D069059",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "56D3858B-0FEE-4E8D-83C2-68AF0431F478",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "254884EE-EBA4-45D0-9704-B5CB22569668",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "35FC7015-267C-403B-A23D-EDA6223D2104",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "5C913A56-959D-44F1-BD89-D246C66D1F09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "5D5BA926-38EE-47BE-9D16-FDCF360A503B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.1:rc4:*:*:*:*:*:*",
"matchCriteriaId": "18EA25F1-279A-4F1A-883D-C064369F592E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FD794856-6F30-4ABF-8AE4-720BB75E6F89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "B4199B8B-A6F9-4BFD-8D27-0E663D8C579D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F11E76A3-FA5B-4038-AB52-3D7D5E54D8A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "C583ACDE-55D5-4D2F-838F-BEC5BDCDE3B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "767C481D-6616-4CA9-9A9B-C994D9121796",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D5496953-0C5E-45F8-A7FB-240CEC2CCEB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "CA46B621-125E-497F-B2DE-91C989B25936",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.6:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B3239443-2E19-4540-BA0C-05A27E44CB6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.6:rc3:*:*:*:*:*:*",
"matchCriteriaId": "104AC9CF-6611-4469-9852-7FDAF4EC7638",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DC9E1864-B1E5-42C3-B4AF-9A002916B66D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "31AC91AA-6A9A-43B4-B3E9-A66A34B6E612",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A462C151-982E-4A83-A376-025015F40645",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "660C2AD2-CEC8-4391-84AF-27515A88B29E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.10:rc1:*:*:*:*:*:*",
"matchCriteriaId": "578CC013-776B-4868-B448-B7ACAF3AF832",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.0:-:*:*:*:*:*:*",
"matchCriteriaId": "C310EA3E-399A-48FD-8DE9-6950E328CF23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "293B2998-5169-4960-BEC4-21DAC837E32B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "FB42A8E7-D273-4CE2-9182-D831D8089BFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DB757DFD-BF47-4483-A2C0-DF37F7D10989",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B6C375F2-5027-4B55-9112-C5DD2F787E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EAB8D57F-9849-428C-B8E9-D0A1020728BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B0359DA8-6B41-46C5-AA95-41B1B366DD4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "0965BDB6-9644-465C-AA32-9278B2D53197",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "7F6B15CF-37C1-4C9B-8457-4A8C9A480188",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.2:rc3:*:*:*:*:*:*",
"matchCriteriaId": "072EB16D-1325-4869-B156-65E786A834C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "847B3C3D-8656-404D-A954-09C159EDC8E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "65CA2D50-B33C-4088-BDDF-EB964C9A092C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "CADB5989-5260-4F60-ACF2-BEB6D7F97654",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9036E3C7-0AD5-489D-BCEE-31DFE13F5ADA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "509597D0-22E1-4BE8-95AD-C54FE4D15FA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.6:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B86E26CB-2376-4EBC-913C-B354E2D6711B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "539C550D-FEDD-415E-95AE-40E1AE2BAF1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D5150753-E86D-4859-A046-97B83EAE2C14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "59C5B869-74FC-4051-A103-A721332B3CF2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "7C31EBD2-CD2D-4D38-AA51-A5A56487939A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.9:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F11E9791-7BCE-43E5-A4BA-6449623FE4F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "33FBD4E4-0BCD-49E1-BA84-86621B7C4556",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.10:rc1:*:*:*:*:*:*",
"matchCriteriaId": "CE521626-2876-455C-9D99-DB74726DC724",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.10:rc2:*:*:*:*:*:*",
"matchCriteriaId": "2DFDD32E-F49E-47F7-B033-B6C3C0E07FC4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.10:rc3:*:*:*:*:*:*",
"matchCriteriaId": "DCBA26F1-FBBA-444D-9C14-F15AB14A4FC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.10:rc4:*:*:*:*:*:*",
"matchCriteriaId": "16D3B0EA-49F7-401A-A1D9-437429D33EAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "83D1EB17-EE67-48E5-B637-AA9A75D397F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.12:rc1:*:*:*:*:*:*",
"matchCriteriaId": "17EBD8B4-C4D3-44A6-9DC1-89D948F126A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "A2B1711A-5541-412C-A5A0-274CEAB9E387",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.13:rc1:*:*:*:*:*:*",
"matchCriteriaId": "FCB08CD7-E9B9-454F-BAF7-96162D177677",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C3AF00C3-93D9-4284-BCB9-40E42CB8386E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.14:rc1:*:*:*:*:*:*",
"matchCriteriaId": "0D3DA0B4-E374-4ED4-8C3B-F723C968666F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.14:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B1730A9A-6810-4470-AE6C-A5356D5BFF43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.14.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AE4B688E-8638-4539-961D-4FDCBEB4B1C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.15:*:*:*:*:*:*:*",
"matchCriteriaId": "5D0346BB-9180-4FE5-AA35-DC466675ED5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.15:rc1:*:*:*:*:*:*",
"matchCriteriaId": "2D6DD9BF-F174-4BE3-9910-BDE3658DC36E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.16:*:*:*:*:*:*:*",
"matchCriteriaId": "40B79E40-75CB-4EBB-8A4B-AF41AED2AE1E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "89B4DCF6-1A21-4B91-ACB4-7DE05487C497",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9A68D41F-36A9-4B77-814D-996F4E48FA79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "709A19A5-8FD1-4F9C-A38C-F06242A94D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "8104482C-E8F5-40A7-8B27-234FEF725FD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "2CFF8677-EA00-4F7E-BFF9-272482206DB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "8D7DF5CD-DA28-492D-B5EE-D252ECCC8D96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "85435026-9855-4BF4-A436-832628B005FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "56C2308F-A590-47B0-9791-7865D189196F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "9A266882-DABA-4A4C-88E6-60E993EE0947",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "83F1142C-3BFB-4B72-A033-81E20DB19D02",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "1FA738A1-227B-4665-B65E-666883FFAE96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "6F00718C-A9E8-4E85-8DA6-33BF11F2DCCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "10789A2D-6401-4119-BFBE-2EE4C16216D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.1:rc4:*:*:*:*:*:*",
"matchCriteriaId": "70ABD462-7142-4831-8EB6-801EC1D05573",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "81D717DB-7C80-48AA-A774-E291D2E75D6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "06B357FB-0307-4EFA-9C5B-3C2CDEA48584",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "E4BD8840-0F1C-49D3-B843-9CFE64948018",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "79D5B492-43F9-470F-BD21-6EFD93E78453",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "4EC1F602-D48C-458A-A063-4050BE3BB25F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "F6A1C015-56AD-489C-B301-68CF1DBF1BEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "FD191625-ACE2-46B6-9AAD-12D682C732C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.5:rc2:*:*:*:*:*:*",
"matchCriteriaId": "02C7DB56-267B-4057-A9BA-36D1E58C6282",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EC163D49-691B-4125-A983-6CF6F6D86DEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "68B537D1-1584-4D15-9C75-08ED4D45DC3A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6A19315C-9A9D-45FE-81C8-074744825B98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "1E3B4233-E117-4E77-A60D-3DFD5073154D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "392CF25B-8400-4185-863F-D6353B664FB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3037282A-863A-4C92-A40C-4D436D2621C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:5.0.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "AF8F94CF-D504-4165-A69E-3F1198CB162A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:5.0.0:beta1.1:*:*:*:*:*:*",
"matchCriteriaId": "C8C25977-AB6C-45E1-8956-871EB31B36BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:5.0.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "5F0AB6B0-3506-4332-A183-309FAC4882CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:5.0.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "6D7B4EBC-B634-4AD7-9F7A-54D14821D5AE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:5.0.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "F844FB25-6E27-412F-8394-A7FB15AC1191",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:5.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "A4E608ED-F4AB-4F29-B34E-2841A59580A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:5.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "6320DD44-7D7E-4075-A865-BEAFF86FDA9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "224BD488-0D7E-4F8B-9012-DE872DEB544C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "A325F57E-0055-4279-9ED7-A26E75FC38E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9A3BA4AE-B4F0-4204-AFA1-1016F0A6F7AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:rc2:*:*:*:*:*:*",
"matchCriteriaId": "991F368C-CEB5-4DE6-A7EE-C341F358A4CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.15:rc1:*:*:*:*:*:*",
"matchCriteriaId": "01DB164E-E08E-4649-84BD-15B4159A3AA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.15:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E0F7ECFB-86A1-4F00-AD47-971FA23C6D21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.19:*:*:*:*:*:*:*",
"matchCriteriaId": "69702127-AB96-4FE0-9AC4-FBE7B8CA77E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.20:*:*:*:*:*:*:*",
"matchCriteriaId": "48D71F7B-CF93-41D4-A824-51CB11F08692",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.22:*:*:*:*:*:*:*",
"matchCriteriaId": "60CE659B-DF49-477B-8879-C33823F6527F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.22.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7EF68196-7C9E-40FE-868D-C42FF82D52EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.10:rc2:*:*:*:*:*:*",
"matchCriteriaId": "9C8E749B-2908-442A-99F0-91E2772336ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "9E43D2D7-89AE-4805-9732-F1C601D8D8B8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5F3D8911-060D-435D-ACA2-E29271170CAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "EA7A4939-16CF-450D-846A-75B231E32D61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "C964D4A2-3F39-4CC7-A028-B42C94DDB56F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.13:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3B54D9FE-0A38-4053-9F3C-8831E2DD2BF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "23FD6D82-9A14-4BD4-AA00-1875F0962ACE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.1.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "91AB2B26-A6F1-44D2-92EB-8078DD6FD63A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E971CF9D-B807-4A74-81EB-D7CB4E5B8099",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:5.0.0:racecar1:*:*:*:*:*:*",
"matchCriteriaId": "0B31291C-CBB5-4E51-B0AC-4144E8BAD65B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en Action View en Ruby en Rails 3.x en versiones anteriores a 3.2.22.3, 4.x en versiones anteriores a 4.2.7.1 y 5.x en versiones anteriores a 5.0.0.1 podr\u00eda permitir a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de texto declarado como \"HTML safe\" y utilizado como valores de atributos en los manejadores de etiquetas."
}
],
"id": "CVE-2016-6316",
"lastModified": "2024-11-21T02:55:53.280",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-09-07T19:28:10.067",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1855.html"
},
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1856.html"
},
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1857.html"
},
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1858.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2016/dsa-3651"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/11/3"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/92430"
},
{
"source": "secalert@redhat.com",
"url": "https://groups.google.com/forum/#%21topic/ruby-security-ann/8B2iV2tPRSE"
},
{
"source": "secalert@redhat.com",
"url": "https://puppet.com/security/cve/cve-2016-6316"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1855.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1856.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1857.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1858.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2016/dsa-3651"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/11/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/92430"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://groups.google.com/forum/#%21topic/ruby-security-ann/8B2iV2tPRSE"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://puppet.com/security/cve/cve-2016-6316"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
ghsa-pc3m-v286-2jwj
Vulnerability from github
Published
2017-10-24 18:33
Modified
2023-01-23 17:59
Severity ?
Summary
actionview Cross-site Scripting vulnerability
Details
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.2.22.2"
},
"package": {
"ecosystem": "RubyGems",
"name": "actionview"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.22.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.2.7"
},
"package": {
"ecosystem": "RubyGems",
"name": "actionview"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.2.7.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "actionview"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.0.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.0.0"
]
}
],
"aliases": [
"CVE-2016-6316"
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:48:48Z",
"nvd_published_at": "2016-09-07T19:28:10Z",
"severity": "MODERATE"
},
"details": "Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers.",
"id": "GHSA-pc3m-v286-2jwj",
"modified": "2023-01-23T17:59:42Z",
"published": "2017-10-24T18:33:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-6316.yml"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200227202008/http://www.securityfocus.com/bid/92430"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200812154343/https://puppet.com/security/cve/cve-2016-6316"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1855.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1856.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1857.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1858.html"
},
{
"type": "WEB",
"url": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3651"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/08/11/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "actionview Cross-site Scripting vulnerability"
}
gsd-2016-6316
Vulnerability from gsd
Modified
2016-08-11 00:00
Details
There is a possible XSS vulnerability in Action View. Text declared as "HTML
safe" will not have quotes escaped when used as attribute values in tag
helpers.
Impact
------
Text declared as "HTML safe" when passed as an attribute value to a tag helper
will not have quotes escaped which can lead to an XSS attack. Impacted code
looks something like this:
```ruby
content_tag(:div, "hi", title: user_input.html_safe)
```
Some helpers like the `sanitize` helper will automatically mark strings as
"HTML safe", so impacted code could also look something like this:
```ruby
content_tag(:div, "hi", title: sanitize(user_input))
```
All users running an affected release should either upgrade or use one of the
workarounds immediately.
Workarounds
-----------
You can work around this issue by either *not* marking arbitrary user input as
safe, or by manually escaping quotes like this:
```ruby
def escape_quotes(value)
value.gsub(/"/, '"'.freeze)
end
content_tag(:div, "hi", title: escape_quotes(sanitize(user_input)))
```
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2016-6316",
"description": "Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers.",
"id": "GSD-2016-6316",
"references": [
"https://www.suse.com/security/cve/CVE-2016-6316.html",
"https://www.debian.org/security/2016/dsa-3651",
"https://access.redhat.com/errata/RHSA-2016:1858",
"https://access.redhat.com/errata/RHSA-2016:1857",
"https://access.redhat.com/errata/RHSA-2016:1856",
"https://access.redhat.com/errata/RHSA-2016:1855"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "actionpack",
"purl": "pkg:gem/actionpack"
}
}
],
"aliases": [
"CVE-2016-6316"
],
"details": "There is a possible XSS vulnerability in Action View. Text declared as \"HTML\nsafe\" will not have quotes escaped when used as attribute values in tag\nhelpers.\n\nImpact\n------\n\nText declared as \"HTML safe\" when passed as an attribute value to a tag helper\nwill not have quotes escaped which can lead to an XSS attack. Impacted code\nlooks something like this:\n\n```ruby\ncontent_tag(:div, \"hi\", title: user_input.html_safe)\n```\n\nSome helpers like the `sanitize` helper will automatically mark strings as\n\"HTML safe\", so impacted code could also look something like this:\n\n```ruby\ncontent_tag(:div, \"hi\", title: sanitize(user_input))\n```\n\nAll users running an affected release should either upgrade or use one of the\nworkarounds immediately.\n\nWorkarounds\n-----------\nYou can work around this issue by either *not* marking arbitrary user input as\nsafe, or by manually escaping quotes like this:\n\n```ruby\ndef escape_quotes(value)\n value.gsub(/\"/, \u0027\u0026quot;\u0027.freeze)\nend\n\ncontent_tag(:div, \"hi\", title: escape_quotes(sanitize(user_input)))\n```\n",
"id": "GSD-2016-6316",
"modified": "2016-08-11T00:00:00.000Z",
"published": "2016-08-11T00:00:00.000Z",
"references": [
{
"type": "WEB",
"url": "https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk"
}
],
"schema_version": "1.4.0",
"summary": "Possible XSS Vulnerability in Action View"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2016-6316",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "RHSA-2016:1856",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1856.html"
},
{
"name": "https://puppet.com/security/cve/cve-2016-6316",
"refsource": "CONFIRM",
"url": "https://puppet.com/security/cve/cve-2016-6316"
},
{
"name": "92430",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92430"
},
{
"name": "RHSA-2016:1855",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1855.html"
},
{
"name": "[oss-security] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2016/08/11/3"
},
{
"name": "RHSA-2016:1858",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1858.html"
},
{
"name": "RHSA-2016:1857",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1857.html"
},
{
"name": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/",
"refsource": "CONFIRM",
"url": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/"
},
{
"name": "[ruby-security-ann] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View",
"refsource": "MLIST",
"url": "https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE"
},
{
"name": "DSA-3651",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3651"
}
]
}
},
"github.com/rubysec/ruby-advisory-db": {
"cve": "2016-6316",
"cvss_v3": 6.1,
"date": "2016-08-11",
"description": "There is a possible XSS vulnerability in Action View. Text declared as \"HTML\nsafe\" will not have quotes escaped when used as attribute values in tag\nhelpers.\n\nImpact\n------\n\nText declared as \"HTML safe\" when passed as an attribute value to a tag helper\nwill not have quotes escaped which can lead to an XSS attack. Impacted code\nlooks something like this:\n\n```ruby\ncontent_tag(:div, \"hi\", title: user_input.html_safe)\n```\n\nSome helpers like the `sanitize` helper will automatically mark strings as\n\"HTML safe\", so impacted code could also look something like this:\n\n```ruby\ncontent_tag(:div, \"hi\", title: sanitize(user_input))\n```\n\nAll users running an affected release should either upgrade or use one of the\nworkarounds immediately.\n\nWorkarounds\n-----------\nYou can work around this issue by either *not* marking arbitrary user input as\nsafe, or by manually escaping quotes like this:\n\n```ruby\ndef escape_quotes(value)\n value.gsub(/\"/, \u0027\u0026quot;\u0027.freeze)\nend\n\ncontent_tag(:div, \"hi\", title: escape_quotes(sanitize(user_input)))\n```\n",
"framework": "rails",
"gem": "actionview",
"ghsa": "pc3m-v286-2jwj",
"notes": "\u0027~\u003e 3.2.22.3\u0027 is found in gems/actionpack/CVE-2016-6316.yml",
"patched_versions": [
"~\u003e 4.2.7.1",
"~\u003e 4.2.8",
"\u003e= 5.0.0.1"
],
"title": "Possible XSS Vulnerability in Action View",
"unaffected_versions": [
"\u003c 3.0.0"
],
"url": "https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk"
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003e=3.0.0.alpha \u003c3.2.22.3",
"affected_versions": "All versions starting from 3.0.0.alpha before 3.2.22.3",
"credit": "Andrew Carpenter of Critical Juncture",
"cvss_v2": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-79",
"CWE-937"
],
"date": "2019-08-08",
"description": "There is a possible XSS vulnerability in Action View. Text declared as `HTML safe` will not have quotes escaped when used as attribute values in tag helpers.",
"fixed_versions": [
"3.2.22.3"
],
"identifier": "CVE-2016-6316",
"identifiers": [
"CVE-2016-6316"
],
"not_impacted": "2.x and earlier",
"package_slug": "gem/actionpack",
"pubdate": "2016-09-07",
"solution": "Upgrade to latest or use workaround; see provided link.",
"title": "Possible XSS Vulnerability in ActionView",
"urls": [
"https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk"
],
"uuid": "bc9b53b3-440c-403a-b95f-258724675236"
},
{
"affected_range": "\u003e=4.0.0.alpha \u003c4.2.7.1||\u003e=5.0.0.alpha \u003c5.0.0.1",
"affected_versions": "All versions starting from 4.0.0.alpha before 4.2.7.1, all versions starting from 5.0.0.alpha before 5.0.0.1",
"credit": "Andrew Carpenter of Critical Juncture",
"cvss_v2": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-79",
"CWE-937"
],
"date": "2019-08-08",
"description": "There is a possible XSS vulnerability in Action View. Text declared as \"HTML safe\" will not have quotes escaped when used as attribute values in tag helpers.",
"fixed_versions": [
"4.2.7.1",
"5.0.0.1"
],
"identifier": "CVE-2016-6316",
"identifiers": [
"CVE-2016-6316"
],
"package_slug": "gem/actionview",
"pubdate": "2016-09-07",
"solution": "Upgrade to latest or use workaround; see provided link.",
"title": "Possible XSS Vulnerability",
"urls": [
"https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk"
],
"uuid": "72a9b095-3b6c-47d0-a8e2-4ae3de117ad0"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:5.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:5.0.0:beta1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:5.0.0:beta1.1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.14.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.1:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.1:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:5.0.0:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:5.0.0:racecar1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:5.0.0:beta4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.0:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.0:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.1:rc4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.10:rc4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.1.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.12:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.0:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.6:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.7:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.0:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.0:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.5:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.8:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.8:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.13:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.15:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.15:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.22:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.10:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.1.14.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.13:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.0:beta1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.7.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.2:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.2:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.15:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.14:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.0:beta2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.0:beta3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.1:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.1:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.6:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.19:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.17:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.7:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.9:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.18:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.19:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:5.0.0:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:5.0.0:beta3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:5.0.0:beta2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.13:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.0:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.6:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.6:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.6:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.10:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.10:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.0:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.2:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.14:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.5.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.5.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.0:beta4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.5:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.1:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.15:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.21:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.22.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.10:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.10:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.0:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.1:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.1:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.4:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.9:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.0:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.0:beta2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.6:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.16:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.0:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.0:beta1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.1:rc4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.4:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.3:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.18:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.9:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.9:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.13:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.17:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.22.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2016-6316"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/",
"refsource": "CONFIRM",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/"
},
{
"name": "DSA-3651",
"refsource": "DEBIAN",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2016/dsa-3651"
},
{
"name": "[oss-security] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View",
"refsource": "MLIST",
"tags": [
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/11/3"
},
{
"name": "92430",
"refsource": "BID",
"tags": [],
"url": "http://www.securityfocus.com/bid/92430"
},
{
"name": "RHSA-2016:1858",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1858.html"
},
{
"name": "RHSA-2016:1857",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1857.html"
},
{
"name": "RHSA-2016:1856",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1856.html"
},
{
"name": "RHSA-2016:1855",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1855.html"
},
{
"name": "https://puppet.com/security/cve/cve-2016-6316",
"refsource": "CONFIRM",
"tags": [],
"url": "https://puppet.com/security/cve/cve-2016-6316"
},
{
"name": "[ruby-security-ann] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View",
"refsource": "MLIST",
"tags": [],
"url": "https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": true
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7
}
},
"lastModifiedDate": "2019-08-08T15:43Z",
"publishedDate": "2016-09-07T19:28Z"
}
}
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.