{
  "GSD": {
    "alias": "CVE-2019-5418",
    "description": "There is a File Content Disclosure vulnerability in Action View \u003c5.2.2.1, \u003c5.1.6.2, \u003c5.0.7.2, \u003c4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system\u0027s filesystem to be exposed.",
    "id": "GSD-2019-5418",
    "references": [
      "https://www.suse.com/security/cve/CVE-2019-5418.html",
      "https://access.redhat.com/errata/RHSA-2019:1289",
      "https://access.redhat.com/errata/RHSA-2019:1149",
      "https://access.redhat.com/errata/RHSA-2019:1147",
      "https://access.redhat.com/errata/RHSA-2019:0796",
      "https://packetstormsecurity.com/files/cve/CVE-2019-5418"
    ]
  },
  "gsd": {
    "metadata": {
      "exploitCode": "unknown",
      "remediation": "unknown",
      "reportConfidence": "confirmed",
      "type": "vulnerability"
    },
    "osvSchema": {
      "affected": [
        {
          "package": {
            "ecosystem": "RubyGems",
            "name": "actionview",
            "purl": "pkg:gem/actionview"
          }
        }
      ],
      "aliases": [
        "CVE-2019-5418",
        "GHSA-86g5-2wh3-gc9j"
      ],
      "details": "There is a possible file content disclosure vulnerability in Action View. This\nvulnerability has been assigned the CVE identifier CVE-2019-5418.\n\nVersions Affected:  All.\nNot affected:       None.\nFixed Versions:     6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1\n\nImpact\n------\nThere is a possible file content disclosure vulnerability in Action View.\nSpecially crafted accept headers in combination with calls to `render file:`\ncan cause arbitrary files on the target server to be rendered, disclosing the\nfile contents.\n\nThe impact is limited to calls to `render` which render file contents without\na specified accept format.  Impacted code in a controller looks something like\nthis:\n\n```\nclass UserController \u003c ApplicationController\n  def index\n    render file: \"#{Rails.root}/some/file\"\n  end\nend\n```\n\nRendering templates as opposed to files is not impacted by this vulnerability.\n\nAll users running an affected release should either upgrade or use one of the\nworkarounds immediately.\n\nReleases\n--------\nThe 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are\navailable at the normal locations.\n\nWorkarounds\n-----------\nThis vulnerability can be mitigated by specifying a format for file rendering,\nlike this:\n\n```\nclass UserController \u003c ApplicationController\n  def index\n    render file: \"#{Rails.root}/some/file\", formats: [:html]\n  end\nend\n```\n\nIn summary, impacted calls to `render` look like this:\n\n```\nrender file: \"#{Rails.root}/some/file\"\n```\n\nThe vulnerability can be mitigated by changing to this:\n\n```\nrender file: \"#{Rails.root}/some/file\", formats: [:html]\n```\n\nOther calls to `render` are not impacted.\n\nAlternatively, the following monkey patch can be applied in an initializer:\n\n```\n$ cat config/initializers/formats_filter.rb\n# frozen_string_literal: true\n\nActionDispatch::Request.prepend(Module.new do\n  def formats\n    super().select do |format|\n      format.symbol || format.ref == \"*/*\"\n    end\n  end\nend)\n```\n\nCredits\n-------\nThanks to John Hawthorn \u003cjohn@hawthorn.email\u003e of GitHub\n",
      "id": "GSD-2019-5418",
      "modified": "2019-03-13T00:00:00.000Z",
      "published": "2019-03-13T00:00:00.000Z",
      "references": [
        {
          "type": "WEB",
          "url": "https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q"
        }
      ],
      "schema_version": "1.4.0",
      "severity": [
        {
          "score": 7.5,
          "type": "CVSS_V3"
        }
      ],
      "summary": "File Content Disclosure in Action View"
    }
  },
  "namespaces": {
    "cve.org": {
      "CVE_data_meta": {
        "ASSIGNER": "support@hackerone.com",
        "ID": "CVE-2019-5418",
        "STATE": "PUBLIC"
      },
      "affects": {
        "vendor": {
          "vendor_data": [
            {
              "product": {
                "product_data": [
                  {
                    "product_name": "https://github.com/rails/rails",
                    "version": {
                      "version_data": [
                        {
                          "version_value": "5.2.2.1"
                        },
                        {
                          "version_value": "5.1.6.2"
                        },
                        {
                          "version_value": "5.0.7.2"
                        },
                        {
                          "version_value": "4.2.11.1"
                        }
                      ]
                    }
                  }
                ]
              },
              "vendor_name": "Rails"
            }
          ]
        }
      },
      "data_format": "MITRE",
      "data_type": "CVE",
      "data_version": "4.0",
      "description": {
        "description_data": [
          {
            "lang": "eng",
            "value": "There is a File Content Disclosure vulnerability in Action View \u003c5.2.2.1, \u003c5.1.6.2, \u003c5.0.7.2, \u003c4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system\u0027s filesystem to be exposed."
          }
        ]
      },
      "problemtype": {
        "problemtype_data": [
          {
            "description": [
              {
                "lang": "eng",
                "value": "Path Traversal (CWE-22)"
              }
            ]
          }
        ]
      },
      "references": {
        "reference_data": [
          {
            "name": "46585",
            "refsource": "EXPLOIT-DB",
            "url": "https://www.exploit-db.com/exploits/46585/"
          },
          {
            "name": "http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html",
            "refsource": "MISC",
            "url": "http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html"
          },
          {
            "name": "[oss-security] 20190322 [CVE-2019-5418] Amendment: Possible Remote Code Execution Exploit in Action View",
            "refsource": "MLIST",
            "url": "http://www.openwall.com/lists/oss-security/2019/03/22/1"
          },
          {
            "name": "https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/",
            "refsource": "CONFIRM",
            "url": "https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/"
          },
          {
            "name": "https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q",
            "refsource": "CONFIRM",
            "url": "https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q"
          },
          {
            "name": "[debian-lts-announce] 20190331 [SECURITY] [DLA 1739-1] rails security update",
            "refsource": "MLIST",
            "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html"
          },
          {
            "name": "RHSA-2019:0796",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2019:0796"
          },
          {
            "name": "openSUSE-SU-2019:1344",
            "refsource": "SUSE",
            "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html"
          },
          {
            "name": "FEDORA-2019-1cfe24db5c",
            "refsource": "FEDORA",
            "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/"
          },
          {
            "name": "RHSA-2019:1149",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2019:1149"
          },
          {
            "name": "RHSA-2019:1147",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2019:1147"
          },
          {
            "name": "RHSA-2019:1289",
            "refsource": "REDHAT",
            "url": "https://access.redhat.com/errata/RHSA-2019:1289"
          }
        ]
      }
    },
    "github.com/rubysec/ruby-advisory-db": {
      "cve": "2019-5418",
      "cvss_v3": 7.5,
      "date": "2019-03-13",
      "description": "There is a possible file content disclosure vulnerability in Action View. This\nvulnerability has been assigned the CVE identifier CVE-2019-5418.\n\nVersions Affected:  All.\nNot affected:       None.\nFixed Versions:     6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, 4.2.11.1\n\nImpact\n------\nThere is a possible file content disclosure vulnerability in Action View.\nSpecially crafted accept headers in combination with calls to `render file:`\ncan cause arbitrary files on the target server to be rendered, disclosing the\nfile contents.\n\nThe impact is limited to calls to `render` which render file contents without\na specified accept format.  Impacted code in a controller looks something like\nthis:\n\n```\nclass UserController \u003c ApplicationController\n  def index\n    render file: \"#{Rails.root}/some/file\"\n  end\nend\n```\n\nRendering templates as opposed to files is not impacted by this vulnerability.\n\nAll users running an affected release should either upgrade or use one of the\nworkarounds immediately.\n\nReleases\n--------\nThe 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are\navailable at the normal locations.\n\nWorkarounds\n-----------\nThis vulnerability can be mitigated by specifying a format for file rendering,\nlike this:\n\n```\nclass UserController \u003c ApplicationController\n  def index\n    render file: \"#{Rails.root}/some/file\", formats: [:html]\n  end\nend\n```\n\nIn summary, impacted calls to `render` look like this:\n\n```\nrender file: \"#{Rails.root}/some/file\"\n```\n\nThe vulnerability can be mitigated by changing to this:\n\n```\nrender file: \"#{Rails.root}/some/file\", formats: [:html]\n```\n\nOther calls to `render` are not impacted.\n\nAlternatively, the following monkey patch can be applied in an initializer:\n\n```\n$ cat config/initializers/formats_filter.rb\n# frozen_string_literal: true\n\nActionDispatch::Request.prepend(Module.new do\n  def formats\n    super().select do |format|\n      format.symbol || format.ref == \"*/*\"\n    end\n  end\nend)\n```\n\nCredits\n-------\nThanks to John Hawthorn \u003cjohn@hawthorn.email\u003e of GitHub\n",
      "framework": "rails",
      "gem": "actionview",
      "ghsa": "86g5-2wh3-gc9j",
      "patched_versions": [
        "~\u003e 4.2.11, \u003e= 4.2.11.1",
        "~\u003e 5.0.7, \u003e= 5.0.7.2",
        "~\u003e 5.1.6, \u003e= 5.1.6.2",
        "~\u003e 5.2.2, \u003e= 5.2.2.1",
        "\u003e= 6.0.0.beta3"
      ],
      "title": "File Content Disclosure in Action View",
      "url": "https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q"
    },
    "gitlab.com": {
      "advisories": [
        {
          "affected_range": "\u003e=3.0.0 \u003c4.2.11.1||\u003e=5.0.0 \u003c5.0.7.2||\u003e=5.1.0 \u003c5.1.6.2||\u003e=5.2.0 \u003c5.2.2.1",
          "affected_versions": "All versions starting from 3.0.0 before 4.2.11.1, all versions starting from 5.0.0 before 5.0.7.2, all versions starting from 5.1.0 before 5.1.6.2, all versions starting from 5.2.0 before 5.2.2.1",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "cvss_v3": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2020-10-16",
          "description": "There is a File Content Disclosure vulnerability in Action View  and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system\u0027s filesystem to be exposed.",
          "fixed_versions": [
            "4.2.11.1",
            "5.0.7.2",
            "5.1.6.2",
            "5.2.2.1"
          ],
          "identifier": "CVE-2019-5418",
          "identifiers": [
            "CVE-2019-5418"
          ],
          "not_impacted": "All versions before 3.0.0, all versions starting from 4.2.11.1 before 5.0.0, all versions starting from 5.0.7.2 before 5.1.0, all versions starting from 5.1.6.2 before 5.2.0",
          "package_slug": "gem/actionview",
          "pubdate": "2019-03-27",
          "solution": "Upgrade to versions 5.0.7.2, 5.1.6.2, 5.2.2.1 or above.",
          "title": "Improper Limitation of a Pathname to a Restricted Directory (\u0027Path Traversal\u0027)",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2019-5418",
            "https://access.redhat.com/errata/RHSA-2019:1289"
          ],
          "uuid": "d6edb767-ac5a-4bc6-8c7f-35dce92903f9"
        },
        {
          "affected_range": "\u003c4.2.11.1||\u003e=5.0.0 \u003c5.0.7.2||\u003e=5.1.0 \u003c5.1.6.2||\u003e=5.2.0 \u003c5.2.2.1",
          "affected_versions": "All versions before 4.2.11.1, all versions starting from 5.0.0 before 5.0.7.2, all versions starting from 5.1.0 before 5.1.6.2, all versions starting from 5.2.0 before 5.2.2.1",
          "cvss_v2": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
          "cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
          "cwe_ids": [
            "CWE-1035",
            "CWE-937"
          ],
          "date": "2019-10-11",
          "description": "There is a File Content Disclosure vulnerability in Action View where specially crafted `Accept` headers can cause contents of arbitrary files on the target system\u0027s filesystem to be exposed.",
          "fixed_versions": [
            "4.2.11.1",
            "5.0.7.2",
            "5.1.6.2",
            "5.2.2.1"
          ],
          "identifier": "CVE-2019-5418",
          "identifiers": [
            "CVE-2019-5418"
          ],
          "not_impacted": "All versions starting from 4.2.11.1 before 5.0.0, all versions starting from 5.0.7.2 before 5.1.0, all versions starting from 5.1.6.2 before 5.2.0, all versions starting from 5.2.2.1",
          "package_slug": "gem/rails",
          "pubdate": "2019-03-27",
          "solution": "Upgrade to versions 4.2.11.1, 5.0.7.2, 5.1.6.2, 5.2.2.1 or above.",
          "title": "Information Exposure",
          "urls": [
            "https://nvd.nist.gov/vuln/detail/CVE-2019-5418",
            "http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html",
            "https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/",
            "https://www.exploit-db.com/exploits/46585/"
          ],
          "uuid": "8d1df401-d117-44ce-8106-c147d960ae4c"
        }
      ]
    },
    "nvd.nist.gov": {
      "configurations": {
        "CVE_data_version": "4.0",
        "nodes": [
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "4.2.11.1",
                "versionStartIncluding": "3.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.0.7.2",
                "versionStartIncluding": "5.0.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.1.6.2",
                "versionStartIncluding": "5.1.0",
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*",
                "cpe_name": [],
                "versionEndExcluding": "5.2.2.1",
                "versionStartIncluding": "5.2.0",
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:redhat:cloudforms:4.7:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:opensuse:leap:15.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:o:fedoraproject:fedora:30:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          },
          {
            "children": [],
            "cpe_match": [
              {
                "cpe23Uri": "cpe:2.3:a:redhat:cloudforms:4.6:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              },
              {
                "cpe23Uri": "cpe:2.3:a:redhat:software_collections:1.0:*:*:*:*:*:*:*",
                "cpe_name": [],
                "vulnerable": true
              }
            ],
            "operator": "OR"
          }
        ]
      },
      "cve": {
        "CVE_data_meta": {
          "ASSIGNER": "cve-assignments@hackerone.com",
          "ID": "CVE-2019-5418"
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "en",
              "value": "There is a File Content Disclosure vulnerability in Action View \u003c5.2.2.1, \u003c5.1.6.2, \u003c5.0.7.2, \u003c4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system\u0027s filesystem to be exposed."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "en",
                  "value": "NVD-CWE-noinfo"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "46585",
              "refsource": "EXPLOIT-DB",
              "tags": [
                "Exploit",
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "https://www.exploit-db.com/exploits/46585/"
            },
            {
              "name": "https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/",
              "refsource": "CONFIRM",
              "tags": [
                "Patch",
                "Vendor Advisory"
              ],
              "url": "https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released/"
            },
            {
              "name": "https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q",
              "refsource": "CONFIRM",
              "tags": [
                "Exploit",
                "Mitigation",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q"
            },
            {
              "name": "[oss-security] 20190322 [CVE-2019-5418] Amendment: Possible Remote Code Execution Exploit in Action View",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Mitigation",
                "Patch",
                "Third Party Advisory"
              ],
              "url": "http://www.openwall.com/lists/oss-security/2019/03/22/1"
            },
            {
              "name": "http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html",
              "refsource": "MISC",
              "tags": [
                "Exploit",
                "Third Party Advisory",
                "VDB Entry"
              ],
              "url": "http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html"
            },
            {
              "name": "[debian-lts-announce] 20190331 [SECURITY] [DLA 1739-1] rails security update",
              "refsource": "MLIST",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html"
            },
            {
              "name": "RHSA-2019:0796",
              "refsource": "REDHAT",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2019:0796"
            },
            {
              "name": "openSUSE-SU-2019:1344",
              "refsource": "SUSE",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html"
            },
            {
              "name": "FEDORA-2019-1cfe24db5c",
              "refsource": "FEDORA",
              "tags": [
                "Mailing List",
                "Third Party Advisory"
              ],
              "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA/"
            },
            {
              "name": "RHSA-2019:1149",
              "refsource": "REDHAT",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2019:1149"
            },
            {
              "name": "RHSA-2019:1147",
              "refsource": "REDHAT",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2019:1147"
            },
            {
              "name": "RHSA-2019:1289",
              "refsource": "REDHAT",
              "tags": [
                "Third Party Advisory"
              ],
              "url": "https://access.redhat.com/errata/RHSA-2019:1289"
            }
          ]
        }
      },
      "impact": {
        "baseMetricV2": {
          "acInsufInfo": false,
          "cvssV2": {
            "accessComplexity": "LOW",
            "accessVector": "NETWORK",
            "authentication": "NONE",
            "availabilityImpact": "NONE",
            "baseScore": 5.0,
            "confidentialityImpact": "PARTIAL",
            "integrityImpact": "NONE",
            "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
            "version": "2.0"
          },
          "exploitabilityScore": 10.0,
          "impactScore": 2.9,
          "obtainAllPrivilege": false,
          "obtainOtherPrivilege": false,
          "obtainUserPrivilege": false,
          "severity": "MEDIUM",
          "userInteractionRequired": false
        },
        "baseMetricV3": {
          "cvssV3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
            "version": "3.1"
          },
          "exploitabilityScore": 3.9,
          "impactScore": 3.6
        }
      },
      "lastModifiedDate": "2020-10-16T19:02Z",
      "publishedDate": "2019-03-27T14:29Z"
    }
  }
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for rh-ror50-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* rubygem-actionpack: render file directory traversal in Action View (CVE-2019-5418)\n\n* rubygem-actionpack: denial of service vulnerability in Action View (CVE-2019-5419)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2019:1147",
        "url": "https://access.redhat.com/errata/RHSA-2019:1147"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1689159",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
      },
      {
        "category": "external",
        "summary": "1689160",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1147.json"
      }
    ],
    "title": "Red Hat Security Advisory: rh-ror50-rubygem-actionpack security update",
    "tracking": {
      "current_release_date": "2024-11-15T05:13:15+00:00",
      "generator": {
        "date": "2024-11-15T05:13:15+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2019:1147",
      "initial_release_date": "2019-05-13T08:53:16+00:00",
      "revision_history": [
        {
          "date": "2019-05-13T08:53:16+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-05-13T08:53:16+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-15T05:13:15+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
                  "product_id": "6Server-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
                  "product_id": "6Workstation-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
                  "product_id": "7Server-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
                  "product_id": "7Workstation-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
                  "product_id": "7Server-RHSCL-3.2-7.4.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
                  "product_id": "7Server-RHSCL-3.2-7.5.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
                  "product_id": "7Server-RHSCL-3.2-7.6.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Software Collections"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
                "product": {
                  "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
                  "product_id": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror50-rubygem-actionpack@5.0.1-2.el6?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
                "product": {
                  "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
                  "product_id": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror50-rubygem-actionpack@5.0.1-2.el7?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
                "product": {
                  "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
                  "product_id": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror50-rubygem-actionpack@5.0.1-2.el6?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
                "product": {
                  "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
                  "product_id": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror50-rubygem-actionpack-doc@5.0.1-2.el6?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
                "product": {
                  "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
                  "product_id": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror50-rubygem-actionpack@5.0.1-2.el7?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
                "product": {
                  "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
                  "product_id": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror50-rubygem-actionpack-doc@5.0.1-2.el7?arch=noarch\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
        "relates_to_product_reference": "6Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
        "relates_to_product_reference": "6Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
        "relates_to_product_reference": "6Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
        "relates_to_product_reference": "6Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
        "relates_to_product_reference": "6Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
        "relates_to_product_reference": "6Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
          "product_id": "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
          "product_id": "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
          "product_id": "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
          "product_id": "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.5.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
          "product_id": "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.5.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
          "product_id": "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.5.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.6.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.6.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.6.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
        "relates_to_product_reference": "7Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Workstation-RHSCL-3.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-5418",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689159"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A content disclosure flaw was found in rubygem-actionview. Specially crafted accept headers, in combination with calls to \u0027render file:\u0027, can cause arbitrary files on the target server to be rendered, disclosing the file contents. Code execution cannot be ruled out if the attacker is able to gain access to the proper files. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: render file directory traversal in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionpack and rh-ror50-rubygem-actionpack as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
          "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
          "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
          "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689159",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5418",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://github.com/mpgn/CVE-2019-5418",
          "url": "https://github.com/mpgn/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-05-13T08:53:16+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1147"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "rubygem-actionpack: render file directory traversal in Action View"
    },
    {
      "cve": "CVE-2019-5419",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689160"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "There is a possible denial of service vulnerability in Action View (Rails) \u003c5.2.2.1, \u003c5.1.6.2, \u003c5.0.7.2, \u003c4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: denial of service vulnerability in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionview and rh-ror50-rubygem-actionview as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
          "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
          "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
          "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689160",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5419",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-05-13T08:53:16+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1147"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rubygem-actionpack: denial of service vulnerability in Action View"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for CloudForms Management Engine 5.9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* rubygem-actionpack: render file directory traversal in Action View (CVE-2019-5418)\n\n* rubygem-actionpack: denial of service vulnerability in Action View (CVE-2019-5419)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nThis update fixes various bugs and adds enhancements. Documentation for these changes is available from the Release Notes document linked to in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2019:1289",
        "url": "https://access.redhat.com/errata/RHSA-2019:1289"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_cloudforms/4.6/html/release_notes",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_cloudforms/4.6/html/release_notes"
      },
      {
        "category": "external",
        "summary": "1688871",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688871"
      },
      {
        "category": "external",
        "summary": "1689159",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
      },
      {
        "category": "external",
        "summary": "1689160",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
      },
      {
        "category": "external",
        "summary": "1695655",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695655"
      },
      {
        "category": "external",
        "summary": "1696363",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696363"
      },
      {
        "category": "external",
        "summary": "1704340",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1704340"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1289.json"
      }
    ],
    "title": "Red Hat Security Advisory: CloudForms 4.6.9 security, bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2024-11-05T21:09:08+00:00",
      "generator": {
        "date": "2024-11-05T21:09:08+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2019:1289",
      "initial_release_date": "2019-05-29T12:41:51+00:00",
      "revision_history": [
        {
          "date": "2019-05-29T12:41:51+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-05-29T12:41:51+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T21:09:08+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "CloudForms Management Engine 5.9",
                "product": {
                  "name": "CloudForms Management Engine 5.9",
                  "product_id": "7Server-RH7-CFME-5.9",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:cloudforms_managementengine:5.9::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat CloudForms"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-debuginfo@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance-common@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance-tools@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance-debuginfo@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-gemset-debuginfo@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-gemset@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-amazon-smartstate@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cfme-0:5.9.9.3-1.el7cf.src",
                "product": {
                  "name": "cfme-0:5.9.9.3-1.el7cf.src",
                  "product_id": "cfme-0:5.9.9.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme@5.9.9.3-1.el7cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-0:5.9.9.3-1.el7cf.src",
                "product": {
                  "name": "cfme-appliance-0:5.9.9.3-1.el7cf.src",
                  "product_id": "cfme-appliance-0:5.9.9.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance@5.9.9.3-1.el7cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-gemset-0:5.9.9.3-1.el7cf.src",
                "product": {
                  "name": "cfme-gemset-0:5.9.9.3-1.el7cf.src",
                  "product_id": "cfme-gemset-0:5.9.9.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-gemset@5.9.9.3-1.el7cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
                "product": {
                  "name": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
                  "product_id": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-amazon-smartstate@5.9.9.3-1.el7cf?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-0:5.9.9.3-1.el7cf.src as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.src"
        },
        "product_reference": "cfme-0:5.9.9.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src"
        },
        "product_reference": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-0:5.9.9.3-1.el7cf.src as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.src"
        },
        "product_reference": "cfme-appliance-0:5.9.9.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-gemset-0:5.9.9.3-1.el7cf.src as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.src"
        },
        "product_reference": "cfme-gemset-0:5.9.9.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-gemset-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-5418",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689159"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A content disclosure flaw was found in rubygem-actionview. Specially crafted accept headers, in combination with calls to \u0027render file:\u0027, can cause arbitrary files on the target server to be rendered, disclosing the file contents. Code execution cannot be ruled out if the attacker is able to gain access to the proper files. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: render file directory traversal in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionpack and rh-ror50-rubygem-actionpack as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689159",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5418",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://github.com/mpgn/CVE-2019-5418",
          "url": "https://github.com/mpgn/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-05-29T12:41:51+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1289"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "rubygem-actionpack: render file directory traversal in Action View"
    },
    {
      "cve": "CVE-2019-5419",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689160"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "There is a possible denial of service vulnerability in Action View (Rails) \u003c5.2.2.1, \u003c5.1.6.2, \u003c5.0.7.2, \u003c4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: denial of service vulnerability in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionview and rh-ror50-rubygem-actionview as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689160",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5419",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-05-29T12:41:51+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1289"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rubygem-actionpack: denial of service vulnerability in Action View"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for CloudForms Management Engine 5.9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* rubygem-actionpack: render file directory traversal in Action View (CVE-2019-5418)\n\n* rubygem-actionpack: denial of service vulnerability in Action View (CVE-2019-5419)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nThis update fixes various bugs and adds enhancements. Documentation for these changes is available from the Release Notes document linked to in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2019:1289",
        "url": "https://access.redhat.com/errata/RHSA-2019:1289"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_cloudforms/4.6/html/release_notes",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_cloudforms/4.6/html/release_notes"
      },
      {
        "category": "external",
        "summary": "1688871",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688871"
      },
      {
        "category": "external",
        "summary": "1689159",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
      },
      {
        "category": "external",
        "summary": "1689160",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
      },
      {
        "category": "external",
        "summary": "1695655",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695655"
      },
      {
        "category": "external",
        "summary": "1696363",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696363"
      },
      {
        "category": "external",
        "summary": "1704340",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1704340"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1289.json"
      }
    ],
    "title": "Red Hat Security Advisory: CloudForms 4.6.9 security, bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2024-11-05T21:09:08+00:00",
      "generator": {
        "date": "2024-11-05T21:09:08+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2019:1289",
      "initial_release_date": "2019-05-29T12:41:51+00:00",
      "revision_history": [
        {
          "date": "2019-05-29T12:41:51+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-05-29T12:41:51+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T21:09:08+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "CloudForms Management Engine 5.9",
                "product": {
                  "name": "CloudForms Management Engine 5.9",
                  "product_id": "7Server-RH7-CFME-5.9",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:cloudforms_managementengine:5.9::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat CloudForms"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-debuginfo@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance-common@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance-tools@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance-debuginfo@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-gemset-debuginfo@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-gemset@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-amazon-smartstate@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cfme-0:5.9.9.3-1.el7cf.src",
                "product": {
                  "name": "cfme-0:5.9.9.3-1.el7cf.src",
                  "product_id": "cfme-0:5.9.9.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme@5.9.9.3-1.el7cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-0:5.9.9.3-1.el7cf.src",
                "product": {
                  "name": "cfme-appliance-0:5.9.9.3-1.el7cf.src",
                  "product_id": "cfme-appliance-0:5.9.9.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance@5.9.9.3-1.el7cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-gemset-0:5.9.9.3-1.el7cf.src",
                "product": {
                  "name": "cfme-gemset-0:5.9.9.3-1.el7cf.src",
                  "product_id": "cfme-gemset-0:5.9.9.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-gemset@5.9.9.3-1.el7cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
                "product": {
                  "name": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
                  "product_id": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-amazon-smartstate@5.9.9.3-1.el7cf?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-0:5.9.9.3-1.el7cf.src as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.src"
        },
        "product_reference": "cfme-0:5.9.9.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src"
        },
        "product_reference": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-0:5.9.9.3-1.el7cf.src as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.src"
        },
        "product_reference": "cfme-appliance-0:5.9.9.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-gemset-0:5.9.9.3-1.el7cf.src as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.src"
        },
        "product_reference": "cfme-gemset-0:5.9.9.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-gemset-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-5418",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689159"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A content disclosure flaw was found in rubygem-actionview. Specially crafted accept headers, in combination with calls to \u0027render file:\u0027, can cause arbitrary files on the target server to be rendered, disclosing the file contents. Code execution cannot be ruled out if the attacker is able to gain access to the proper files. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: render file directory traversal in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionpack and rh-ror50-rubygem-actionpack as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689159",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5418",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://github.com/mpgn/CVE-2019-5418",
          "url": "https://github.com/mpgn/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-05-29T12:41:51+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1289"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "rubygem-actionpack: render file directory traversal in Action View"
    },
    {
      "cve": "CVE-2019-5419",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689160"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "There is a possible denial of service vulnerability in Action View (Rails) \u003c5.2.2.1, \u003c5.1.6.2, \u003c5.0.7.2, \u003c4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: denial of service vulnerability in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionview and rh-ror50-rubygem-actionview as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689160",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5419",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-05-29T12:41:51+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1289"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rubygem-actionpack: denial of service vulnerability in Action View"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for CloudForms Management Engine 5.10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* rubygem-actionpack: render file directory traversal in Action View (CVE-2019-5418)\n\n* rubygem-actionpack: denial of service vulnerability in Action View (CVE-2019-5419)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nThis update fixes various bugs and adds enhancements. Documentation for these changes is available from the Release Notes document linked to in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2019:0796",
        "url": "https://access.redhat.com/errata/RHSA-2019:0796"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_cloudforms/4.7/html/release_notes",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_cloudforms/4.7/html/release_notes"
      },
      {
        "category": "external",
        "summary": "1678385",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1678385"
      },
      {
        "category": "external",
        "summary": "1680959",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1680959"
      },
      {
        "category": "external",
        "summary": "1686045",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686045"
      },
      {
        "category": "external",
        "summary": "1686902",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686902"
      },
      {
        "category": "external",
        "summary": "1688937",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688937"
      },
      {
        "category": "external",
        "summary": "1689159",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
      },
      {
        "category": "external",
        "summary": "1689160",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
      },
      {
        "category": "external",
        "summary": "1693714",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693714"
      },
      {
        "category": "external",
        "summary": "1693718",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693718"
      },
      {
        "category": "external",
        "summary": "1693719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693719"
      },
      {
        "category": "external",
        "summary": "1693720",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693720"
      },
      {
        "category": "external",
        "summary": "1693721",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693721"
      },
      {
        "category": "external",
        "summary": "1693722",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693722"
      },
      {
        "category": "external",
        "summary": "1693727",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693727"
      },
      {
        "category": "external",
        "summary": "1693728",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693728"
      },
      {
        "category": "external",
        "summary": "1693729",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693729"
      },
      {
        "category": "external",
        "summary": "1693730",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693730"
      },
      {
        "category": "external",
        "summary": "1693731",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693731"
      },
      {
        "category": "external",
        "summary": "1693740",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693740"
      },
      {
        "category": "external",
        "summary": "1693741",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693741"
      },
      {
        "category": "external",
        "summary": "1693743",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693743"
      },
      {
        "category": "external",
        "summary": "1693745",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693745"
      },
      {
        "category": "external",
        "summary": "1693746",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693746"
      },
      {
        "category": "external",
        "summary": "1693747",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693747"
      },
      {
        "category": "external",
        "summary": "1693748",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693748"
      },
      {
        "category": "external",
        "summary": "1693749",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693749"
      },
      {
        "category": "external",
        "summary": "1693757",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693757"
      },
      {
        "category": "external",
        "summary": "1693817",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693817"
      },
      {
        "category": "external",
        "summary": "1694190",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1694190"
      },
      {
        "category": "external",
        "summary": "1694798",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1694798"
      },
      {
        "category": "external",
        "summary": "1695626",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695626"
      },
      {
        "category": "external",
        "summary": "1695627",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695627"
      },
      {
        "category": "external",
        "summary": "1695628",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695628"
      },
      {
        "category": "external",
        "summary": "1695629",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695629"
      },
      {
        "category": "external",
        "summary": "1695631",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695631"
      },
      {
        "category": "external",
        "summary": "1695897",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695897"
      },
      {
        "category": "external",
        "summary": "1696362",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696362"
      },
      {
        "category": "external",
        "summary": "1696419",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696419"
      },
      {
        "category": "external",
        "summary": "1696421",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696421"
      },
      {
        "category": "external",
        "summary": "1696422",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696422"
      },
      {
        "category": "external",
        "summary": "1696456",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696456"
      },
      {
        "category": "external",
        "summary": "1696841",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696841"
      },
      {
        "category": "external",
        "summary": "1698586",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1698586"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0796.json"
      }
    ],
    "title": "Red Hat Security Advisory: CloudForms 4.7.3 security, bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2024-11-15T05:12:56+00:00",
      "generator": {
        "date": "2024-11-15T05:12:56+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2019:0796",
      "initial_release_date": "2019-04-23T07:46:49+00:00",
      "revision_history": [
        {
          "date": "2019-04-23T07:46:49+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-04-23T07:46:49+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-15T05:12:56+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "CloudForms Management Engine 5.10",
                "product": {
                  "name": "CloudForms Management Engine 5.10",
                  "product_id": "7Server-RH7-CFME-5.10",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:cloudforms_managementengine:5.10::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat CloudForms"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
                "product": {
                  "name": "ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
                  "product_id": "ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-tower-venv-ansible@3.4.3-1.el7at?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
                "product": {
                  "name": "ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
                  "product_id": "ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-tower-setup@3.4.3-1.el7at?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
                "product": {
                  "name": "ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
                  "product_id": "ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-tower-ui@3.4.3-1.el7at?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-tower-server-0:3.4.3-1.el7at.x86_64",
                "product": {
                  "name": "ansible-tower-server-0:3.4.3-1.el7at.x86_64",
                  "product_id": "ansible-tower-server-0:3.4.3-1.el7at.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-tower-server@3.4.3-1.el7at?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-tower-0:3.4.3-1.el7at.x86_64",
                "product": {
                  "name": "ansible-tower-0:3.4.3-1.el7at.x86_64",
                  "product_id": "ansible-tower-0:3.4.3-1.el7at.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-tower@3.4.3-1.el7at?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
                "product": {
                  "name": "ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
                  "product_id": "ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-tower-venv-tower@3.4.3-1.el7at?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-debuginfo@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance-debuginfo@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance-tools@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance-common@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-gemset@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-gemset-debuginfo@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-amazon-smartstate@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ansible-tower-0:3.4.3-1.el7at.src",
                "product": {
                  "name": "ansible-tower-0:3.4.3-1.el7at.src",
                  "product_id": "ansible-tower-0:3.4.3-1.el7at.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-tower@3.4.3-1.el7at?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-0:5.10.3.3-1.el7cf.src",
                "product": {
                  "name": "cfme-0:5.10.3.3-1.el7cf.src",
                  "product_id": "cfme-0:5.10.3.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme@5.10.3.3-1.el7cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-0:5.10.3.3-1.el7cf.src",
                "product": {
                  "name": "cfme-appliance-0:5.10.3.3-1.el7cf.src",
                  "product_id": "cfme-appliance-0:5.10.3.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance@5.10.3.3-1.el7cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-gemset-0:5.10.3.3-1.el7cf.src",
                "product": {
                  "name": "cfme-gemset-0:5.10.3.3-1.el7cf.src",
                  "product_id": "cfme-gemset-0:5.10.3.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-gemset@5.10.3.3-1.el7cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
                "product": {
                  "name": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
                  "product_id": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-amazon-smartstate@5.10.3.3-1.el7cf?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-0:3.4.3-1.el7at.src as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src"
        },
        "product_reference": "ansible-tower-0:3.4.3-1.el7at.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64"
        },
        "product_reference": "ansible-tower-0:3.4.3-1.el7at.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-server-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64"
        },
        "product_reference": "ansible-tower-server-0:3.4.3-1.el7at.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-setup-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64"
        },
        "product_reference": "ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-ui-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64"
        },
        "product_reference": "ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64"
        },
        "product_reference": "ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64"
        },
        "product_reference": "ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-0:5.10.3.3-1.el7cf.src as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src"
        },
        "product_reference": "cfme-0:5.10.3.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src"
        },
        "product_reference": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-0:5.10.3.3-1.el7cf.src as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src"
        },
        "product_reference": "cfme-appliance-0:5.10.3.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-gemset-0:5.10.3.3-1.el7cf.src as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src"
        },
        "product_reference": "cfme-gemset-0:5.10.3.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-gemset-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Chris Bertsch"
          ],
          "organization": "FactSet Research Systems Inc"
        }
      ],
      "cve": "CVE-2019-3869",
      "cwe": {
        "id": "CWE-214",
        "name": "Invocation of Process Using Visible Sensitive Information"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1688508"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "When running Tower on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Tower: credentials leaked through environment variables",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
          "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-3869"
        },
        {
          "category": "external",
          "summary": "RHBZ#1688508",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688508"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-3869",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-3869"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-3869",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3869"
        },
        {
          "category": "external",
          "summary": "https://github.com/ansible/awx/pull/3505",
          "url": "https://github.com/ansible/awx/pull/3505"
        }
      ],
      "release_date": "2019-03-26T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-04-23T07:46:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:0796"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Tower: credentials leaked through environment variables"
    },
    {
      "cve": "CVE-2019-5418",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689159"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A content disclosure flaw was found in rubygem-actionview. Specially crafted accept headers, in combination with calls to \u0027render file:\u0027, can cause arbitrary files on the target server to be rendered, disclosing the file contents. Code execution cannot be ruled out if the attacker is able to gain access to the proper files. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: render file directory traversal in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionpack and rh-ror50-rubygem-actionpack as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
          "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689159",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5418",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://github.com/mpgn/CVE-2019-5418",
          "url": "https://github.com/mpgn/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-04-23T07:46:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:0796"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "rubygem-actionpack: render file directory traversal in Action View"
    },
    {
      "cve": "CVE-2019-5419",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689160"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "There is a possible denial of service vulnerability in Action View (Rails) \u003c5.2.2.1, \u003c5.1.6.2, \u003c5.0.7.2, \u003c4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: denial of service vulnerability in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionview and rh-ror50-rubygem-actionview as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
          "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689160",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5419",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-04-23T07:46:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:0796"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rubygem-actionpack: denial of service vulnerability in Action View"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for CloudForms Management Engine 5.9.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* rubygem-actionpack: render file directory traversal in Action View (CVE-2019-5418)\n\n* rubygem-actionpack: denial of service vulnerability in Action View (CVE-2019-5419)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nThis update fixes various bugs and adds enhancements. Documentation for these changes is available from the Release Notes document linked to in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2019:1289",
        "url": "https://access.redhat.com/errata/RHSA-2019:1289"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_cloudforms/4.6/html/release_notes",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_cloudforms/4.6/html/release_notes"
      },
      {
        "category": "external",
        "summary": "1688871",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688871"
      },
      {
        "category": "external",
        "summary": "1689159",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
      },
      {
        "category": "external",
        "summary": "1689160",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
      },
      {
        "category": "external",
        "summary": "1695655",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695655"
      },
      {
        "category": "external",
        "summary": "1696363",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696363"
      },
      {
        "category": "external",
        "summary": "1704340",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1704340"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1289.json"
      }
    ],
    "title": "Red Hat Security Advisory: CloudForms 4.6.9 security, bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2024-11-05T21:09:08+00:00",
      "generator": {
        "date": "2024-11-05T21:09:08+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.1.1"
        }
      },
      "id": "RHSA-2019:1289",
      "initial_release_date": "2019-05-29T12:41:51+00:00",
      "revision_history": [
        {
          "date": "2019-05-29T12:41:51+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-05-29T12:41:51+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-05T21:09:08+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "CloudForms Management Engine 5.9",
                "product": {
                  "name": "CloudForms Management Engine 5.9",
                  "product_id": "7Server-RH7-CFME-5.9",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:cloudforms_managementengine:5.9::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat CloudForms"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-debuginfo@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance-common@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance-tools@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance-debuginfo@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-gemset-debuginfo@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-gemset@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
                  "product_id": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-amazon-smartstate@5.9.9.3-1.el7cf?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "cfme-0:5.9.9.3-1.el7cf.src",
                "product": {
                  "name": "cfme-0:5.9.9.3-1.el7cf.src",
                  "product_id": "cfme-0:5.9.9.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme@5.9.9.3-1.el7cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-0:5.9.9.3-1.el7cf.src",
                "product": {
                  "name": "cfme-appliance-0:5.9.9.3-1.el7cf.src",
                  "product_id": "cfme-appliance-0:5.9.9.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance@5.9.9.3-1.el7cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-gemset-0:5.9.9.3-1.el7cf.src",
                "product": {
                  "name": "cfme-gemset-0:5.9.9.3-1.el7cf.src",
                  "product_id": "cfme-gemset-0:5.9.9.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-gemset@5.9.9.3-1.el7cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
                "product": {
                  "name": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
                  "product_id": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-amazon-smartstate@5.9.9.3-1.el7cf?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-0:5.9.9.3-1.el7cf.src as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.src"
        },
        "product_reference": "cfme-0:5.9.9.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src"
        },
        "product_reference": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-0:5.9.9.3-1.el7cf.src as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.src"
        },
        "product_reference": "cfme-appliance-0:5.9.9.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-gemset-0:5.9.9.3-1.el7cf.src as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.src"
        },
        "product_reference": "cfme-gemset-0:5.9.9.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-gemset-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.9",
          "product_id": "7Server-RH7-CFME-5.9:cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.9"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-5418",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689159"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A content disclosure flaw was found in rubygem-actionview. Specially crafted accept headers, in combination with calls to \u0027render file:\u0027, can cause arbitrary files on the target server to be rendered, disclosing the file contents. Code execution cannot be ruled out if the attacker is able to gain access to the proper files. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: render file directory traversal in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionpack and rh-ror50-rubygem-actionpack as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689159",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5418",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://github.com/mpgn/CVE-2019-5418",
          "url": "https://github.com/mpgn/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-05-29T12:41:51+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1289"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "rubygem-actionpack: render file directory traversal in Action View"
    },
    {
      "cve": "CVE-2019-5419",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689160"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "There is a possible denial of service vulnerability in Action View (Rails) \u003c5.2.2.1, \u003c5.1.6.2, \u003c5.0.7.2, \u003c4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: denial of service vulnerability in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionview and rh-ror50-rubygem-actionview as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.src",
          "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.9:cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689160",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5419",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-05-29T12:41:51+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1289"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-amazon-smartstate-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-appliance-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-common-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-appliance-tools-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-debuginfo-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.src",
            "7Server-RH7-CFME-5.9:cfme-gemset-0:5.9.9.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.9:cfme-gemset-debuginfo-0:5.9.9.3-1.el7cf.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rubygem-actionpack: denial of service vulnerability in Action View"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for CloudForms Management Engine 5.10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* rubygem-actionpack: render file directory traversal in Action View (CVE-2019-5418)\n\n* rubygem-actionpack: denial of service vulnerability in Action View (CVE-2019-5419)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nThis update fixes various bugs and adds enhancements. Documentation for these changes is available from the Release Notes document linked to in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2019:0796",
        "url": "https://access.redhat.com/errata/RHSA-2019:0796"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_cloudforms/4.7/html/release_notes",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_cloudforms/4.7/html/release_notes"
      },
      {
        "category": "external",
        "summary": "1678385",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1678385"
      },
      {
        "category": "external",
        "summary": "1680959",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1680959"
      },
      {
        "category": "external",
        "summary": "1686045",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686045"
      },
      {
        "category": "external",
        "summary": "1686902",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686902"
      },
      {
        "category": "external",
        "summary": "1688937",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688937"
      },
      {
        "category": "external",
        "summary": "1689159",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
      },
      {
        "category": "external",
        "summary": "1689160",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
      },
      {
        "category": "external",
        "summary": "1693714",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693714"
      },
      {
        "category": "external",
        "summary": "1693718",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693718"
      },
      {
        "category": "external",
        "summary": "1693719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693719"
      },
      {
        "category": "external",
        "summary": "1693720",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693720"
      },
      {
        "category": "external",
        "summary": "1693721",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693721"
      },
      {
        "category": "external",
        "summary": "1693722",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693722"
      },
      {
        "category": "external",
        "summary": "1693727",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693727"
      },
      {
        "category": "external",
        "summary": "1693728",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693728"
      },
      {
        "category": "external",
        "summary": "1693729",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693729"
      },
      {
        "category": "external",
        "summary": "1693730",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693730"
      },
      {
        "category": "external",
        "summary": "1693731",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693731"
      },
      {
        "category": "external",
        "summary": "1693740",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693740"
      },
      {
        "category": "external",
        "summary": "1693741",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693741"
      },
      {
        "category": "external",
        "summary": "1693743",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693743"
      },
      {
        "category": "external",
        "summary": "1693745",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693745"
      },
      {
        "category": "external",
        "summary": "1693746",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693746"
      },
      {
        "category": "external",
        "summary": "1693747",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693747"
      },
      {
        "category": "external",
        "summary": "1693748",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693748"
      },
      {
        "category": "external",
        "summary": "1693749",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693749"
      },
      {
        "category": "external",
        "summary": "1693757",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693757"
      },
      {
        "category": "external",
        "summary": "1693817",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693817"
      },
      {
        "category": "external",
        "summary": "1694190",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1694190"
      },
      {
        "category": "external",
        "summary": "1694798",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1694798"
      },
      {
        "category": "external",
        "summary": "1695626",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695626"
      },
      {
        "category": "external",
        "summary": "1695627",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695627"
      },
      {
        "category": "external",
        "summary": "1695628",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695628"
      },
      {
        "category": "external",
        "summary": "1695629",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695629"
      },
      {
        "category": "external",
        "summary": "1695631",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695631"
      },
      {
        "category": "external",
        "summary": "1695897",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695897"
      },
      {
        "category": "external",
        "summary": "1696362",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696362"
      },
      {
        "category": "external",
        "summary": "1696419",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696419"
      },
      {
        "category": "external",
        "summary": "1696421",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696421"
      },
      {
        "category": "external",
        "summary": "1696422",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696422"
      },
      {
        "category": "external",
        "summary": "1696456",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696456"
      },
      {
        "category": "external",
        "summary": "1696841",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696841"
      },
      {
        "category": "external",
        "summary": "1698586",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1698586"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0796.json"
      }
    ],
    "title": "Red Hat Security Advisory: CloudForms 4.7.3 security, bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2024-11-15T05:12:56+00:00",
      "generator": {
        "date": "2024-11-15T05:12:56+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2019:0796",
      "initial_release_date": "2019-04-23T07:46:49+00:00",
      "revision_history": [
        {
          "date": "2019-04-23T07:46:49+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-04-23T07:46:49+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-15T05:12:56+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "CloudForms Management Engine 5.10",
                "product": {
                  "name": "CloudForms Management Engine 5.10",
                  "product_id": "7Server-RH7-CFME-5.10",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:cloudforms_managementengine:5.10::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat CloudForms"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
                "product": {
                  "name": "ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
                  "product_id": "ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-tower-venv-ansible@3.4.3-1.el7at?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
                "product": {
                  "name": "ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
                  "product_id": "ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-tower-setup@3.4.3-1.el7at?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
                "product": {
                  "name": "ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
                  "product_id": "ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-tower-ui@3.4.3-1.el7at?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-tower-server-0:3.4.3-1.el7at.x86_64",
                "product": {
                  "name": "ansible-tower-server-0:3.4.3-1.el7at.x86_64",
                  "product_id": "ansible-tower-server-0:3.4.3-1.el7at.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-tower-server@3.4.3-1.el7at?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-tower-0:3.4.3-1.el7at.x86_64",
                "product": {
                  "name": "ansible-tower-0:3.4.3-1.el7at.x86_64",
                  "product_id": "ansible-tower-0:3.4.3-1.el7at.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-tower@3.4.3-1.el7at?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
                "product": {
                  "name": "ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
                  "product_id": "ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-tower-venv-tower@3.4.3-1.el7at?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-debuginfo@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance-debuginfo@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance-tools@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance-common@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-gemset@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-gemset-debuginfo@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-amazon-smartstate@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ansible-tower-0:3.4.3-1.el7at.src",
                "product": {
                  "name": "ansible-tower-0:3.4.3-1.el7at.src",
                  "product_id": "ansible-tower-0:3.4.3-1.el7at.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-tower@3.4.3-1.el7at?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-0:5.10.3.3-1.el7cf.src",
                "product": {
                  "name": "cfme-0:5.10.3.3-1.el7cf.src",
                  "product_id": "cfme-0:5.10.3.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme@5.10.3.3-1.el7cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-0:5.10.3.3-1.el7cf.src",
                "product": {
                  "name": "cfme-appliance-0:5.10.3.3-1.el7cf.src",
                  "product_id": "cfme-appliance-0:5.10.3.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance@5.10.3.3-1.el7cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-gemset-0:5.10.3.3-1.el7cf.src",
                "product": {
                  "name": "cfme-gemset-0:5.10.3.3-1.el7cf.src",
                  "product_id": "cfme-gemset-0:5.10.3.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-gemset@5.10.3.3-1.el7cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
                "product": {
                  "name": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
                  "product_id": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-amazon-smartstate@5.10.3.3-1.el7cf?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-0:3.4.3-1.el7at.src as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src"
        },
        "product_reference": "ansible-tower-0:3.4.3-1.el7at.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64"
        },
        "product_reference": "ansible-tower-0:3.4.3-1.el7at.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-server-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64"
        },
        "product_reference": "ansible-tower-server-0:3.4.3-1.el7at.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-setup-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64"
        },
        "product_reference": "ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-ui-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64"
        },
        "product_reference": "ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64"
        },
        "product_reference": "ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64"
        },
        "product_reference": "ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-0:5.10.3.3-1.el7cf.src as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src"
        },
        "product_reference": "cfme-0:5.10.3.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src"
        },
        "product_reference": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-0:5.10.3.3-1.el7cf.src as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src"
        },
        "product_reference": "cfme-appliance-0:5.10.3.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-gemset-0:5.10.3.3-1.el7cf.src as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src"
        },
        "product_reference": "cfme-gemset-0:5.10.3.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-gemset-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Chris Bertsch"
          ],
          "organization": "FactSet Research Systems Inc"
        }
      ],
      "cve": "CVE-2019-3869",
      "cwe": {
        "id": "CWE-214",
        "name": "Invocation of Process Using Visible Sensitive Information"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1688508"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "When running Tower on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Tower: credentials leaked through environment variables",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
          "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-3869"
        },
        {
          "category": "external",
          "summary": "RHBZ#1688508",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688508"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-3869",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-3869"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-3869",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3869"
        },
        {
          "category": "external",
          "summary": "https://github.com/ansible/awx/pull/3505",
          "url": "https://github.com/ansible/awx/pull/3505"
        }
      ],
      "release_date": "2019-03-26T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-04-23T07:46:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:0796"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Tower: credentials leaked through environment variables"
    },
    {
      "cve": "CVE-2019-5418",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689159"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A content disclosure flaw was found in rubygem-actionview. Specially crafted accept headers, in combination with calls to \u0027render file:\u0027, can cause arbitrary files on the target server to be rendered, disclosing the file contents. Code execution cannot be ruled out if the attacker is able to gain access to the proper files. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: render file directory traversal in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionpack and rh-ror50-rubygem-actionpack as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
          "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689159",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5418",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://github.com/mpgn/CVE-2019-5418",
          "url": "https://github.com/mpgn/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-04-23T07:46:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:0796"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "rubygem-actionpack: render file directory traversal in Action View"
    },
    {
      "cve": "CVE-2019-5419",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689160"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "There is a possible denial of service vulnerability in Action View (Rails) \u003c5.2.2.1, \u003c5.1.6.2, \u003c5.0.7.2, \u003c4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: denial of service vulnerability in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionview and rh-ror50-rubygem-actionview as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
          "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689160",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5419",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-04-23T07:46:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:0796"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rubygem-actionpack: denial of service vulnerability in Action View"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for rh-ror50-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* rubygem-actionpack: render file directory traversal in Action View (CVE-2019-5418)\n\n* rubygem-actionpack: denial of service vulnerability in Action View (CVE-2019-5419)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2019:1147",
        "url": "https://access.redhat.com/errata/RHSA-2019:1147"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1689159",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
      },
      {
        "category": "external",
        "summary": "1689160",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1147.json"
      }
    ],
    "title": "Red Hat Security Advisory: rh-ror50-rubygem-actionpack security update",
    "tracking": {
      "current_release_date": "2024-11-15T05:13:15+00:00",
      "generator": {
        "date": "2024-11-15T05:13:15+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2019:1147",
      "initial_release_date": "2019-05-13T08:53:16+00:00",
      "revision_history": [
        {
          "date": "2019-05-13T08:53:16+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-05-13T08:53:16+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-15T05:13:15+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
                  "product_id": "6Server-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
                  "product_id": "6Workstation-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
                  "product_id": "7Server-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
                  "product_id": "7Workstation-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
                  "product_id": "7Server-RHSCL-3.2-7.4.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
                  "product_id": "7Server-RHSCL-3.2-7.5.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
                  "product_id": "7Server-RHSCL-3.2-7.6.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Software Collections"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
                "product": {
                  "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
                  "product_id": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror50-rubygem-actionpack@5.0.1-2.el6?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
                "product": {
                  "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
                  "product_id": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror50-rubygem-actionpack@5.0.1-2.el7?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
                "product": {
                  "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
                  "product_id": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror50-rubygem-actionpack@5.0.1-2.el6?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
                "product": {
                  "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
                  "product_id": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror50-rubygem-actionpack-doc@5.0.1-2.el6?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
                "product": {
                  "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
                  "product_id": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror50-rubygem-actionpack@5.0.1-2.el7?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
                "product": {
                  "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
                  "product_id": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror50-rubygem-actionpack-doc@5.0.1-2.el7?arch=noarch\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
        "relates_to_product_reference": "6Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
        "relates_to_product_reference": "6Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
        "relates_to_product_reference": "6Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
        "relates_to_product_reference": "6Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
        "relates_to_product_reference": "6Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
        "relates_to_product_reference": "6Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
          "product_id": "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
          "product_id": "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
          "product_id": "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
          "product_id": "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.5.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
          "product_id": "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.5.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
          "product_id": "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.5.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.6.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.6.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.6.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
        "relates_to_product_reference": "7Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Workstation-RHSCL-3.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-5418",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689159"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A content disclosure flaw was found in rubygem-actionview. Specially crafted accept headers, in combination with calls to \u0027render file:\u0027, can cause arbitrary files on the target server to be rendered, disclosing the file contents. Code execution cannot be ruled out if the attacker is able to gain access to the proper files. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: render file directory traversal in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionpack and rh-ror50-rubygem-actionpack as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
          "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
          "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
          "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689159",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5418",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://github.com/mpgn/CVE-2019-5418",
          "url": "https://github.com/mpgn/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-05-13T08:53:16+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1147"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "rubygem-actionpack: render file directory traversal in Action View"
    },
    {
      "cve": "CVE-2019-5419",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689160"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "There is a possible denial of service vulnerability in Action View (Rails) \u003c5.2.2.1, \u003c5.1.6.2, \u003c5.0.7.2, \u003c4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: denial of service vulnerability in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionview and rh-ror50-rubygem-actionview as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
          "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
          "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
          "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689160",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5419",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-05-13T08:53:16+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1147"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rubygem-actionpack: denial of service vulnerability in Action View"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for rh-ror50-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* rubygem-actionpack: render file directory traversal in Action View (CVE-2019-5418)\n\n* rubygem-actionpack: denial of service vulnerability in Action View (CVE-2019-5419)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2019:1147",
        "url": "https://access.redhat.com/errata/RHSA-2019:1147"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1689159",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
      },
      {
        "category": "external",
        "summary": "1689160",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1147.json"
      }
    ],
    "title": "Red Hat Security Advisory: rh-ror50-rubygem-actionpack security update",
    "tracking": {
      "current_release_date": "2024-11-15T05:13:15+00:00",
      "generator": {
        "date": "2024-11-15T05:13:15+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2019:1147",
      "initial_release_date": "2019-05-13T08:53:16+00:00",
      "revision_history": [
        {
          "date": "2019-05-13T08:53:16+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-05-13T08:53:16+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-15T05:13:15+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
                  "product_id": "6Server-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
                  "product_id": "6Workstation-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
                  "product_id": "7Server-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
                  "product_id": "7Workstation-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
                  "product_id": "7Server-RHSCL-3.2-7.4.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
                  "product_id": "7Server-RHSCL-3.2-7.5.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
                  "product_id": "7Server-RHSCL-3.2-7.6.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Software Collections"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
                "product": {
                  "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
                  "product_id": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror50-rubygem-actionpack@5.0.1-2.el6?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
                "product": {
                  "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
                  "product_id": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror50-rubygem-actionpack@5.0.1-2.el7?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
                "product": {
                  "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
                  "product_id": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror50-rubygem-actionpack@5.0.1-2.el6?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
                "product": {
                  "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
                  "product_id": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror50-rubygem-actionpack-doc@5.0.1-2.el6?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
                "product": {
                  "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
                  "product_id": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror50-rubygem-actionpack@5.0.1-2.el7?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
                "product": {
                  "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
                  "product_id": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror50-rubygem-actionpack-doc@5.0.1-2.el7?arch=noarch\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
        "relates_to_product_reference": "6Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
        "relates_to_product_reference": "6Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
        "relates_to_product_reference": "6Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
        "relates_to_product_reference": "6Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
        "relates_to_product_reference": "6Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
        "relates_to_product_reference": "6Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
          "product_id": "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
          "product_id": "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
          "product_id": "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
          "product_id": "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.5.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
          "product_id": "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.5.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
          "product_id": "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.5.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.6.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.6.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.6.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
        "relates_to_product_reference": "7Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
        },
        "product_reference": "rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
        "relates_to_product_reference": "7Workstation-RHSCL-3.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-5418",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689159"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A content disclosure flaw was found in rubygem-actionview. Specially crafted accept headers, in combination with calls to \u0027render file:\u0027, can cause arbitrary files on the target server to be rendered, disclosing the file contents. Code execution cannot be ruled out if the attacker is able to gain access to the proper files. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: render file directory traversal in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionpack and rh-ror50-rubygem-actionpack as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
          "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
          "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
          "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689159",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5418",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://github.com/mpgn/CVE-2019-5418",
          "url": "https://github.com/mpgn/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-05-13T08:53:16+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1147"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "rubygem-actionpack: render file directory traversal in Action View"
    },
    {
      "cve": "CVE-2019-5419",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689160"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "There is a possible denial of service vulnerability in Action View (Rails) \u003c5.2.2.1, \u003c5.1.6.2, \u003c5.0.7.2, \u003c4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: denial of service vulnerability in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionview and rh-ror50-rubygem-actionview as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
          "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
          "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
          "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
          "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689160",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5419",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-05-13T08:53:16+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1147"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Server-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-1:5.0.1-2.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror50-rubygem-actionpack-doc-1:5.0.1-2.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rubygem-actionpack: denial of service vulnerability in Action View"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for rh-ror42-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* rubygem-actionpack: render file directory traversal in Action View (CVE-2019-5418)\n\n* rubygem-actionpack: denial of service vulnerability in Action View (CVE-2019-5419)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2019:1149",
        "url": "https://access.redhat.com/errata/RHSA-2019:1149"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1689159",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
      },
      {
        "category": "external",
        "summary": "1689160",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1149.json"
      }
    ],
    "title": "Red Hat Security Advisory: rh-ror42-rubygem-actionpack security update",
    "tracking": {
      "current_release_date": "2024-11-15T05:13:09+00:00",
      "generator": {
        "date": "2024-11-15T05:13:09+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2019:1149",
      "initial_release_date": "2019-05-13T09:12:33+00:00",
      "revision_history": [
        {
          "date": "2019-05-13T09:12:33+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-05-13T09:12:33+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-15T05:13:09+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
                  "product_id": "6Server-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
                  "product_id": "6Workstation-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
                  "product_id": "7Server-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
                  "product_id": "7Workstation-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
                  "product_id": "7Server-RHSCL-3.2-7.4.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
                  "product_id": "7Server-RHSCL-3.2-7.5.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
                  "product_id": "7Server-RHSCL-3.2-7.6.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Software Collections"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
                "product": {
                  "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
                  "product_id": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack-doc@4.2.6-5.el6?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
                "product": {
                  "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
                  "product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-5.el6?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
                "product": {
                  "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
                  "product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-5.el7?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
                "product": {
                  "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
                  "product_id": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack-doc@4.2.6-5.el7?arch=noarch\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
                "product": {
                  "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
                  "product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-5.el6?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
                "product": {
                  "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
                  "product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-5.el7?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
        "relates_to_product_reference": "6Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
        "relates_to_product_reference": "6Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
        "relates_to_product_reference": "6Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
        "relates_to_product_reference": "6Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
        "relates_to_product_reference": "6Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
        "relates_to_product_reference": "6Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
          "product_id": "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
          "product_id": "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
          "product_id": "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
          "product_id": "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.5.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
          "product_id": "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.5.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
          "product_id": "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.5.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.6.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.6.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.6.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
        "relates_to_product_reference": "7Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Workstation-RHSCL-3.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-5418",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689159"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A content disclosure flaw was found in rubygem-actionview. Specially crafted accept headers, in combination with calls to \u0027render file:\u0027, can cause arbitrary files on the target server to be rendered, disclosing the file contents. Code execution cannot be ruled out if the attacker is able to gain access to the proper files. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: render file directory traversal in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionpack and rh-ror50-rubygem-actionpack as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
          "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
          "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
          "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689159",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5418",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://github.com/mpgn/CVE-2019-5418",
          "url": "https://github.com/mpgn/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-05-13T09:12:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1149"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "rubygem-actionpack: render file directory traversal in Action View"
    },
    {
      "cve": "CVE-2019-5419",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689160"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "There is a possible denial of service vulnerability in Action View (Rails) \u003c5.2.2.1, \u003c5.1.6.2, \u003c5.0.7.2, \u003c4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: denial of service vulnerability in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionview and rh-ror50-rubygem-actionview as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
          "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
          "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
          "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689160",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5419",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-05-13T09:12:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1149"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rubygem-actionpack: denial of service vulnerability in Action View"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for rh-ror42-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* rubygem-actionpack: render file directory traversal in Action View (CVE-2019-5418)\n\n* rubygem-actionpack: denial of service vulnerability in Action View (CVE-2019-5419)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2019:1149",
        "url": "https://access.redhat.com/errata/RHSA-2019:1149"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1689159",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
      },
      {
        "category": "external",
        "summary": "1689160",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1149.json"
      }
    ],
    "title": "Red Hat Security Advisory: rh-ror42-rubygem-actionpack security update",
    "tracking": {
      "current_release_date": "2024-11-15T05:13:09+00:00",
      "generator": {
        "date": "2024-11-15T05:13:09+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2019:1149",
      "initial_release_date": "2019-05-13T09:12:33+00:00",
      "revision_history": [
        {
          "date": "2019-05-13T09:12:33+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-05-13T09:12:33+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-15T05:13:09+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
                  "product_id": "6Server-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
                  "product_id": "6Workstation-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
                  "product_id": "7Server-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
                  "product_id": "7Workstation-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
                  "product_id": "7Server-RHSCL-3.2-7.4.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
                  "product_id": "7Server-RHSCL-3.2-7.5.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
                  "product_id": "7Server-RHSCL-3.2-7.6.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Software Collections"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
                "product": {
                  "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
                  "product_id": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack-doc@4.2.6-5.el6?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
                "product": {
                  "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
                  "product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-5.el6?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
                "product": {
                  "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
                  "product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-5.el7?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
                "product": {
                  "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
                  "product_id": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack-doc@4.2.6-5.el7?arch=noarch\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
                "product": {
                  "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
                  "product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-5.el6?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
                "product": {
                  "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
                  "product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-5.el7?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
        "relates_to_product_reference": "6Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
        "relates_to_product_reference": "6Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
        "relates_to_product_reference": "6Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
        "relates_to_product_reference": "6Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
        "relates_to_product_reference": "6Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
        "relates_to_product_reference": "6Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
          "product_id": "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
          "product_id": "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
          "product_id": "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
          "product_id": "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.5.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
          "product_id": "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.5.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
          "product_id": "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.5.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.6.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.6.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.6.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
        "relates_to_product_reference": "7Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Workstation-RHSCL-3.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-5418",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689159"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A content disclosure flaw was found in rubygem-actionview. Specially crafted accept headers, in combination with calls to \u0027render file:\u0027, can cause arbitrary files on the target server to be rendered, disclosing the file contents. Code execution cannot be ruled out if the attacker is able to gain access to the proper files. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: render file directory traversal in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionpack and rh-ror50-rubygem-actionpack as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
          "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
          "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
          "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689159",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5418",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://github.com/mpgn/CVE-2019-5418",
          "url": "https://github.com/mpgn/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-05-13T09:12:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1149"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "rubygem-actionpack: render file directory traversal in Action View"
    },
    {
      "cve": "CVE-2019-5419",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689160"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "There is a possible denial of service vulnerability in Action View (Rails) \u003c5.2.2.1, \u003c5.1.6.2, \u003c5.0.7.2, \u003c4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: denial of service vulnerability in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionview and rh-ror50-rubygem-actionview as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
          "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
          "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
          "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689160",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5419",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-05-13T09:12:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1149"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rubygem-actionpack: denial of service vulnerability in Action View"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update is now available for CloudForms Management Engine 5.10.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* rubygem-actionpack: render file directory traversal in Action View (CVE-2019-5418)\n\n* rubygem-actionpack: denial of service vulnerability in Action View (CVE-2019-5419)\n\nFor more details about the security issue(s), including the impact, a CVSS score, and other related information, refer to the CVE page(s) listed in the References section.\n\nAdditional Changes:\n\nThis update fixes various bugs and adds enhancements. Documentation for these changes is available from the Release Notes document linked to in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2019:0796",
        "url": "https://access.redhat.com/errata/RHSA-2019:0796"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/documentation/en-us/red_hat_cloudforms/4.7/html/release_notes",
        "url": "https://access.redhat.com/documentation/en-us/red_hat_cloudforms/4.7/html/release_notes"
      },
      {
        "category": "external",
        "summary": "1678385",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1678385"
      },
      {
        "category": "external",
        "summary": "1680959",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1680959"
      },
      {
        "category": "external",
        "summary": "1686045",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686045"
      },
      {
        "category": "external",
        "summary": "1686902",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1686902"
      },
      {
        "category": "external",
        "summary": "1688937",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688937"
      },
      {
        "category": "external",
        "summary": "1689159",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
      },
      {
        "category": "external",
        "summary": "1689160",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
      },
      {
        "category": "external",
        "summary": "1693714",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693714"
      },
      {
        "category": "external",
        "summary": "1693718",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693718"
      },
      {
        "category": "external",
        "summary": "1693719",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693719"
      },
      {
        "category": "external",
        "summary": "1693720",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693720"
      },
      {
        "category": "external",
        "summary": "1693721",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693721"
      },
      {
        "category": "external",
        "summary": "1693722",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693722"
      },
      {
        "category": "external",
        "summary": "1693727",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693727"
      },
      {
        "category": "external",
        "summary": "1693728",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693728"
      },
      {
        "category": "external",
        "summary": "1693729",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693729"
      },
      {
        "category": "external",
        "summary": "1693730",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693730"
      },
      {
        "category": "external",
        "summary": "1693731",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693731"
      },
      {
        "category": "external",
        "summary": "1693740",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693740"
      },
      {
        "category": "external",
        "summary": "1693741",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693741"
      },
      {
        "category": "external",
        "summary": "1693743",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693743"
      },
      {
        "category": "external",
        "summary": "1693745",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693745"
      },
      {
        "category": "external",
        "summary": "1693746",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693746"
      },
      {
        "category": "external",
        "summary": "1693747",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693747"
      },
      {
        "category": "external",
        "summary": "1693748",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693748"
      },
      {
        "category": "external",
        "summary": "1693749",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693749"
      },
      {
        "category": "external",
        "summary": "1693757",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693757"
      },
      {
        "category": "external",
        "summary": "1693817",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1693817"
      },
      {
        "category": "external",
        "summary": "1694190",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1694190"
      },
      {
        "category": "external",
        "summary": "1694798",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1694798"
      },
      {
        "category": "external",
        "summary": "1695626",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695626"
      },
      {
        "category": "external",
        "summary": "1695627",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695627"
      },
      {
        "category": "external",
        "summary": "1695628",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695628"
      },
      {
        "category": "external",
        "summary": "1695629",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695629"
      },
      {
        "category": "external",
        "summary": "1695631",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695631"
      },
      {
        "category": "external",
        "summary": "1695897",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1695897"
      },
      {
        "category": "external",
        "summary": "1696362",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696362"
      },
      {
        "category": "external",
        "summary": "1696419",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696419"
      },
      {
        "category": "external",
        "summary": "1696421",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696421"
      },
      {
        "category": "external",
        "summary": "1696422",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696422"
      },
      {
        "category": "external",
        "summary": "1696456",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696456"
      },
      {
        "category": "external",
        "summary": "1696841",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1696841"
      },
      {
        "category": "external",
        "summary": "1698586",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1698586"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_0796.json"
      }
    ],
    "title": "Red Hat Security Advisory: CloudForms 4.7.3 security, bug fix and enhancement update",
    "tracking": {
      "current_release_date": "2024-11-15T05:12:56+00:00",
      "generator": {
        "date": "2024-11-15T05:12:56+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2019:0796",
      "initial_release_date": "2019-04-23T07:46:49+00:00",
      "revision_history": [
        {
          "date": "2019-04-23T07:46:49+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-04-23T07:46:49+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-15T05:12:56+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "CloudForms Management Engine 5.10",
                "product": {
                  "name": "CloudForms Management Engine 5.10",
                  "product_id": "7Server-RH7-CFME-5.10",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:cloudforms_managementengine:5.10::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat CloudForms"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
                "product": {
                  "name": "ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
                  "product_id": "ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-tower-venv-ansible@3.4.3-1.el7at?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
                "product": {
                  "name": "ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
                  "product_id": "ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-tower-setup@3.4.3-1.el7at?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
                "product": {
                  "name": "ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
                  "product_id": "ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-tower-ui@3.4.3-1.el7at?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-tower-server-0:3.4.3-1.el7at.x86_64",
                "product": {
                  "name": "ansible-tower-server-0:3.4.3-1.el7at.x86_64",
                  "product_id": "ansible-tower-server-0:3.4.3-1.el7at.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-tower-server@3.4.3-1.el7at?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-tower-0:3.4.3-1.el7at.x86_64",
                "product": {
                  "name": "ansible-tower-0:3.4.3-1.el7at.x86_64",
                  "product_id": "ansible-tower-0:3.4.3-1.el7at.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-tower@3.4.3-1.el7at?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
                "product": {
                  "name": "ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
                  "product_id": "ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-tower-venv-tower@3.4.3-1.el7at?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-debuginfo@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance-debuginfo@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance-tools@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance-common@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-gemset@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-gemset-debuginfo@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
                "product": {
                  "name": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
                  "product_id": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-amazon-smartstate@5.10.3.3-1.el7cf?arch=x86_64"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "x86_64"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "ansible-tower-0:3.4.3-1.el7at.src",
                "product": {
                  "name": "ansible-tower-0:3.4.3-1.el7at.src",
                  "product_id": "ansible-tower-0:3.4.3-1.el7at.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/ansible-tower@3.4.3-1.el7at?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-0:5.10.3.3-1.el7cf.src",
                "product": {
                  "name": "cfme-0:5.10.3.3-1.el7cf.src",
                  "product_id": "cfme-0:5.10.3.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme@5.10.3.3-1.el7cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-appliance-0:5.10.3.3-1.el7cf.src",
                "product": {
                  "name": "cfme-appliance-0:5.10.3.3-1.el7cf.src",
                  "product_id": "cfme-appliance-0:5.10.3.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-appliance@5.10.3.3-1.el7cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-gemset-0:5.10.3.3-1.el7cf.src",
                "product": {
                  "name": "cfme-gemset-0:5.10.3.3-1.el7cf.src",
                  "product_id": "cfme-gemset-0:5.10.3.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-gemset@5.10.3.3-1.el7cf?arch=src"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
                "product": {
                  "name": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
                  "product_id": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/cfme-amazon-smartstate@5.10.3.3-1.el7cf?arch=src"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-0:3.4.3-1.el7at.src as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src"
        },
        "product_reference": "ansible-tower-0:3.4.3-1.el7at.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64"
        },
        "product_reference": "ansible-tower-0:3.4.3-1.el7at.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-server-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64"
        },
        "product_reference": "ansible-tower-server-0:3.4.3-1.el7at.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-setup-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64"
        },
        "product_reference": "ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-ui-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64"
        },
        "product_reference": "ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64"
        },
        "product_reference": "ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64"
        },
        "product_reference": "ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-0:5.10.3.3-1.el7cf.src as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src"
        },
        "product_reference": "cfme-0:5.10.3.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src"
        },
        "product_reference": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-0:5.10.3.3-1.el7cf.src as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src"
        },
        "product_reference": "cfme-appliance-0:5.10.3.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-gemset-0:5.10.3.3-1.el7cf.src as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src"
        },
        "product_reference": "cfme-gemset-0:5.10.3.3-1.el7cf.src",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-gemset-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64 as a component of CloudForms Management Engine 5.10",
          "product_id": "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
        },
        "product_reference": "cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
        "relates_to_product_reference": "7Server-RH7-CFME-5.10"
      }
    ]
  },
  "vulnerabilities": [
    {
      "acknowledgments": [
        {
          "names": [
            "Chris Bertsch"
          ],
          "organization": "FactSet Research Systems Inc"
        }
      ],
      "cve": "CVE-2019-3869",
      "cwe": {
        "id": "CWE-214",
        "name": "Invocation of Process Using Visible Sensitive Information"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1688508"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "When running Tower on OpenShift or Kubernetes, application credentials are exposed to playbook job runs via environment variables. A malicious user with the ability to write playbooks could use this to gain administrative privileges.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "Tower: credentials leaked through environment variables",
          "title": "Vulnerability summary"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
          "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-3869"
        },
        {
          "category": "external",
          "summary": "RHBZ#1688508",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1688508"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-3869",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-3869"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-3869",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-3869"
        },
        {
          "category": "external",
          "summary": "https://github.com/ansible/awx/pull/3505",
          "url": "https://github.com/ansible/awx/pull/3505"
        }
      ],
      "release_date": "2019-03-26T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-04-23T07:46:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:0796"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "HIGH",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "Tower: credentials leaked through environment variables"
    },
    {
      "cve": "CVE-2019-5418",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689159"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A content disclosure flaw was found in rubygem-actionview. Specially crafted accept headers, in combination with calls to \u0027render file:\u0027, can cause arbitrary files on the target server to be rendered, disclosing the file contents. Code execution cannot be ruled out if the attacker is able to gain access to the proper files. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: render file directory traversal in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionpack and rh-ror50-rubygem-actionpack as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
          "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689159",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5418",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://github.com/mpgn/CVE-2019-5418",
          "url": "https://github.com/mpgn/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-04-23T07:46:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:0796"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "rubygem-actionpack: render file directory traversal in Action View"
    },
    {
      "cve": "CVE-2019-5419",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689160"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "There is a possible denial of service vulnerability in Action View (Rails) \u003c5.2.2.1, \u003c5.1.6.2, \u003c5.0.7.2, \u003c4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: denial of service vulnerability in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionview and rh-ror50-rubygem-actionview as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
          "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
          "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
          "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
          "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689160",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5419",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-04-23T07:46:49+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nIf the postgresql service is running, it will be automatically restarted after installing this update. After installing the updated packages, the httpd daemon will be restarted automatically.",
          "product_ids": [
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:0796"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.src",
            "7Server-RH7-CFME-5.10:ansible-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-server-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-setup-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-ui-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-ansible-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:ansible-tower-venv-tower-0:3.4.3-1.el7at.x86_64",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-amazon-smartstate-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-appliance-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-common-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-appliance-tools-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-debuginfo-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.src",
            "7Server-RH7-CFME-5.10:cfme-gemset-0:5.10.3.3-1.el7cf.x86_64",
            "7Server-RH7-CFME-5.10:cfme-gemset-debuginfo-0:5.10.3.3-1.el7cf.x86_64"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rubygem-actionpack: denial of service vulnerability in Action View"
    }
  ]
}

{
  "document": {
    "aggregate_severity": {
      "namespace": "https://access.redhat.com/security/updates/classification/",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en",
    "notes": [
      {
        "category": "summary",
        "text": "An update for rh-ror42-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Important. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
        "title": "Topic"
      },
      {
        "category": "general",
        "text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* rubygem-actionpack: render file directory traversal in Action View (CVE-2019-5418)\n\n* rubygem-actionpack: denial of service vulnerability in Action View (CVE-2019-5419)\n\nFor more details about the security issue(s), including the impact, a CVSS score, acknowledgments, and other related information, refer to the CVE page(s) listed in the References section.",
        "title": "Details"
      },
      {
        "category": "legal_disclaimer",
        "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
        "title": "Terms of Use"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "https://access.redhat.com/security/team/contact/",
      "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
      "name": "Red Hat Product Security",
      "namespace": "https://www.redhat.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "https://access.redhat.com/errata/RHSA-2019:1149",
        "url": "https://access.redhat.com/errata/RHSA-2019:1149"
      },
      {
        "category": "external",
        "summary": "https://access.redhat.com/security/updates/classification/#important",
        "url": "https://access.redhat.com/security/updates/classification/#important"
      },
      {
        "category": "external",
        "summary": "1689159",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
      },
      {
        "category": "external",
        "summary": "1689160",
        "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
      },
      {
        "category": "self",
        "summary": "Canonical URL",
        "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2019/rhsa-2019_1149.json"
      }
    ],
    "title": "Red Hat Security Advisory: rh-ror42-rubygem-actionpack security update",
    "tracking": {
      "current_release_date": "2024-11-15T05:13:09+00:00",
      "generator": {
        "date": "2024-11-15T05:13:09+00:00",
        "engine": {
          "name": "Red Hat SDEngine",
          "version": "4.2.1"
        }
      },
      "id": "RHSA-2019:1149",
      "initial_release_date": "2019-05-13T09:12:33+00:00",
      "revision_history": [
        {
          "date": "2019-05-13T09:12:33+00:00",
          "number": "1",
          "summary": "Initial version"
        },
        {
          "date": "2019-05-13T09:12:33+00:00",
          "number": "2",
          "summary": "Last updated version"
        },
        {
          "date": "2024-11-15T05:13:09+00:00",
          "number": "3",
          "summary": "Last generated version"
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
                  "product_id": "6Server-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
                  "product_id": "6Workstation-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el6"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
                  "product_id": "7Server-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
                  "product_id": "7Workstation-RHSCL-3.2",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
                  "product_id": "7Server-RHSCL-3.2-7.4.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
                  "product_id": "7Server-RHSCL-3.2-7.5.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
                "product": {
                  "name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
                  "product_id": "7Server-RHSCL-3.2-7.6.Z",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:redhat:rhel_software_collections:3::el7"
                  }
                }
              }
            ],
            "category": "product_family",
            "name": "Red Hat Software Collections"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
                "product": {
                  "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
                  "product_id": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack-doc@4.2.6-5.el6?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
                "product": {
                  "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
                  "product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-5.el6?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
                "product": {
                  "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
                  "product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-5.el7?arch=noarch\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
                "product": {
                  "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
                  "product_id": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack-doc@4.2.6-5.el7?arch=noarch\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "noarch"
          },
          {
            "branches": [
              {
                "category": "product_version",
                "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
                "product": {
                  "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
                  "product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-5.el6?arch=src\u0026epoch=1"
                  }
                }
              },
              {
                "category": "product_version",
                "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
                "product": {
                  "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
                  "product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
                  "product_identification_helper": {
                    "purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-5.el7?arch=src\u0026epoch=1"
                  }
                }
              }
            ],
            "category": "architecture",
            "name": "src"
          }
        ],
        "category": "vendor",
        "name": "Red Hat"
      }
    ],
    "relationships": [
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
        "relates_to_product_reference": "6Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
        "relates_to_product_reference": "6Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
          "product_id": "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
        "relates_to_product_reference": "6Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
        "relates_to_product_reference": "6Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
        "relates_to_product_reference": "6Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
          "product_id": "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
        "relates_to_product_reference": "6Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
          "product_id": "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
          "product_id": "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.4)",
          "product_id": "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.4.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
          "product_id": "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.5.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
          "product_id": "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.5.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.5)",
          "product_id": "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.5.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.6.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.6.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.6)",
          "product_id": "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2-7.6.Z"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
        "relates_to_product_reference": "7Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
          "product_id": "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Server-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
        "relates_to_product_reference": "7Workstation-RHSCL-3.2"
      },
      {
        "category": "default_component_of",
        "full_product_name": {
          "name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
          "product_id": "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
        },
        "product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
        "relates_to_product_reference": "7Workstation-RHSCL-3.2"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2019-5418",
      "cwe": {
        "id": "CWE-200",
        "name": "Exposure of Sensitive Information to an Unauthorized Actor"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689159"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "A content disclosure flaw was found in rubygem-actionview. Specially crafted accept headers, in combination with calls to \u0027render file:\u0027, can cause arbitrary files on the target server to be rendered, disclosing the file contents. Code execution cannot be ruled out if the attacker is able to gain access to the proper files. The highest threat from this vulnerability is to data confidentiality and integrity as well as system availability.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: render file directory traversal in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionpack and rh-ror50-rubygem-actionpack as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
          "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
          "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
          "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689159",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689159"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5418",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://github.com/mpgn/CVE-2019-5418",
          "url": "https://github.com/mpgn/CVE-2019-5418"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/pFRKI96Sm8Q/IhpRq9D2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-05-13T09:12:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1149"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.1,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H",
            "version": "3.0"
          },
          "products": [
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Important"
        }
      ],
      "title": "rubygem-actionpack: render file directory traversal in Action View"
    },
    {
      "cve": "CVE-2019-5419",
      "cwe": {
        "id": "CWE-20",
        "name": "Improper Input Validation"
      },
      "discovery_date": "2019-03-13T00:00:00+00:00",
      "ids": [
        {
          "system_name": "Red Hat Bugzilla ID",
          "text": "1689160"
        }
      ],
      "notes": [
        {
          "category": "description",
          "text": "There is a possible denial of service vulnerability in Action View (Rails) \u003c5.2.2.1, \u003c5.1.6.2, \u003c5.0.7.2, \u003c4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.",
          "title": "Vulnerability description"
        },
        {
          "category": "summary",
          "text": "rubygem-actionpack: denial of service vulnerability in Action View",
          "title": "Vulnerability summary"
        },
        {
          "category": "other",
          "text": "This issue did affect the versions of rh-ror42-rubygem-actionview and rh-ror50-rubygem-actionview as shipped with Red Hat Software Collections.",
          "title": "Statement"
        },
        {
          "category": "general",
          "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
          "title": "CVSS score applicability"
        }
      ],
      "product_status": {
        "fixed": [
          "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
          "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
          "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
          "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
          "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
          "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
          "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "Canonical URL",
          "url": "https://access.redhat.com/security/cve/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "RHBZ#1689160",
          "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1689160"
        },
        {
          "category": "external",
          "summary": "https://www.cve.org/CVERecord?id=CVE-2019-5419",
          "url": "https://www.cve.org/CVERecord?id=CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419",
          "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5419"
        },
        {
          "category": "external",
          "summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ",
          "url": "https://groups.google.com/forum/#!msg/rubyonrails-security/GN7w9fFAQeI/0iQIiLP2CgAJ"
        }
      ],
      "release_date": "2019-03-13T00:00:00+00:00",
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2019-05-13T09:12:33+00:00",
          "details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
          "product_ids": [
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
          ],
          "restart_required": {
            "category": "none"
          },
          "url": "https://access.redhat.com/errata/RHSA-2019:1149"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 5.9,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "NONE",
            "integrityImpact": "NONE",
            "privilegesRequired": "NONE",
            "scope": "UNCHANGED",
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:N/A:H",
            "version": "3.0"
          },
          "products": [
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.noarch",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el6.src",
            "6Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el6.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.4.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.5.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2-7.6.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Server-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.noarch",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-1:4.2.6-5.el7.src",
            "7Workstation-RHSCL-3.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-5.el7.noarch"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Moderate"
        }
      ],
      "title": "rubygem-actionpack: denial of service vulnerability in Action View"
    }
  ]
}

{
  "affected": [
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.2.2.0"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "actionview"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.2.0"
            },
            {
              "fixed": "5.2.2.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 4.2.11.0"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "actionview"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "4.0.0"
            },
            {
              "fixed": "4.2.11.1"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.1.6.1"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "actionview"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.1.0"
            },
            {
              "fixed": "5.1.6.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    },
    {
      "database_specific": {
        "last_known_affected_version_range": "\u003c= 5.0.7.1"
      },
      "package": {
        "ecosystem": "RubyGems",
        "name": "actionview"
      },
      "ranges": [
        {
          "events": [
            {
              "introduced": "5.0.0"
            },
            {
              "fixed": "5.0.7.2"
            }
          ],
          "type": "ECOSYSTEM"
        }
      ]
    }
  ],
  "aliases": [
    "CVE-2019-5418"
  ],
  "database_specific": {
    "cwe_ids": [
      "CWE-22"
    ],
    "github_reviewed": true,
    "github_reviewed_at": "2020-06-16T21:24:34Z",
    "nvd_published_at": null,
    "severity": "HIGH"
  },
  "details": "# File Content Disclosure in Action View\n\nImpact \n------ \nThere is a possible file content disclosure vulnerability in Action View.  Specially crafted accept headers in combination with calls to `render file:`  can cause arbitrary files on the target server to be rendered, disclosing the  file contents. \n\nThe impact is limited to calls to `render` which render file contents without  a specified accept format.  Impacted code in a controller looks something like this: \n\n``` ruby\nclass UserController \u003c ApplicationController \n  def index \n    render file: \"#{Rails.root}/some/file\" \n  end \nend \n``` \n\nRendering templates as opposed to files is not impacted by this vulnerability. \n\nAll users running an affected release should either upgrade or use one of the workarounds immediately. \n\nReleases \n-------- \nThe 6.0.0.beta3, 5.2.2.1, 5.1.6.2, 5.0.7.2, and 4.2.11.1 releases are available at the normal locations. \n\nWorkarounds \n----------- \nThis vulnerability can be mitigated by specifying a format for file rendering, like this: \n\n``` ruby\nclass UserController \u003c ApplicationController \n  def index \n    render file: \"#{Rails.root}/some/file\", formats: [:html] \n  end \nend \n``` \n\nIn summary, impacted calls to `render` look like this: \n\n``` \nrender file: \"#{Rails.root}/some/file\" \n``` \n\nThe vulnerability can be mitigated by changing to this: \n\n``` \nrender file: \"#{Rails.root}/some/file\", formats: [:html] \n``` \n\nOther calls to `render` are not impacted. \n\nAlternatively, the following monkey patch can be applied in an initializer: \n\n``` ruby\n$ cat config/initializers/formats_filter.rb \n# frozen_string_literal: true \n\nActionDispatch::Request.prepend(Module.new do \n  def formats \n    super().select do |format| \n      format.symbol || format.ref == \"*/*\" \n    end \n  end \nend) \n``` \n\nCredits \n------- \nThanks to John Hawthorn \u003cjohn@hawthorn.email\u003e of GitHub ",
  "id": "GHSA-86g5-2wh3-gc9j",
  "modified": "2023-08-08T16:43:56Z",
  "published": "2019-03-13T17:26:59Z",
  "references": [
    {
      "type": "ADVISORY",
      "url": "https://nvd.nist.gov/vuln/detail/CVE-2019-5418"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2019:0796"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2019:1147"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2019:1149"
    },
    {
      "type": "WEB",
      "url": "https://access.redhat.com/errata/RHSA-2019:1289"
    },
    {
      "type": "ADVISORY",
      "url": "https://github.com/advisories/GHSA-86g5-2wh3-gc9j"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q"
    },
    {
      "type": "WEB",
      "url": "https://groups.google.com/forum/#!topic/rubyonrails-security/zRNVOUhKHrg"
    },
    {
      "type": "WEB",
      "url": "https://lists.debian.org/debian-lts-announce/2019/03/msg00042.html"
    },
    {
      "type": "WEB",
      "url": "https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA"
    },
    {
      "type": "WEB",
      "url": "https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released"
    },
    {
      "type": "WEB",
      "url": "https://www.exploit-db.com/exploits/46585"
    },
    {
      "type": "WEB",
      "url": "http://lists.opensuse.org/opensuse-security-announce/2019-05/msg00011.html"
    },
    {
      "type": "WEB",
      "url": "http://packetstormsecurity.com/files/152178/Rails-5.2.1-Arbitrary-File-Content-Disclosure.html"
    },
    {
      "type": "WEB",
      "url": "http://www.openwall.com/lists/oss-security/2019/03/22/1"
    }
  ],
  "schema_version": "1.4.0",
  "severity": [
    {
      "score": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N",
      "type": "CVSS_V3"
    }
  ],
  "summary": "Path Traversal in Action View"
}