Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2016-6316 (GCVE-0-2016-6316)
Vulnerability from cvelistv5
Published
2016-09-07 19:00
Modified
2024-08-06 01:29
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T01:29:18.216Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "RHSA-2016:1856",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1856.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://puppet.com/security/cve/cve-2016-6316"
},
{
"name": "92430",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/92430"
},
{
"name": "RHSA-2016:1855",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1855.html"
},
{
"name": "[oss-security] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/11/3"
},
{
"name": "RHSA-2016:1858",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1858.html"
},
{
"name": "RHSA-2016:1857",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1857.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/"
},
{
"name": "[ruby-security-ann] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://groups.google.com/forum/#%21topic/ruby-security-ann/8B2iV2tPRSE"
},
{
"name": "DSA-3651",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN",
"x_transferred"
],
"url": "http://www.debian.org/security/2016/dsa-3651"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2016-08-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-12-08T10:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2016:1856",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1856.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://puppet.com/security/cve/cve-2016-6316"
},
{
"name": "92430",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/92430"
},
{
"name": "RHSA-2016:1855",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1855.html"
},
{
"name": "[oss-security] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/11/3"
},
{
"name": "RHSA-2016:1858",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1858.html"
},
{
"name": "RHSA-2016:1857",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1857.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/"
},
{
"name": "[ruby-security-ann] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://groups.google.com/forum/#%21topic/ruby-security-ann/8B2iV2tPRSE"
},
{
"name": "DSA-3651",
"tags": [
"vendor-advisory",
"x_refsource_DEBIAN"
],
"url": "http://www.debian.org/security/2016/dsa-3651"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2016-6316",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "RHSA-2016:1856",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1856.html"
},
{
"name": "https://puppet.com/security/cve/cve-2016-6316",
"refsource": "CONFIRM",
"url": "https://puppet.com/security/cve/cve-2016-6316"
},
{
"name": "92430",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92430"
},
{
"name": "RHSA-2016:1855",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1855.html"
},
{
"name": "[oss-security] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2016/08/11/3"
},
{
"name": "RHSA-2016:1858",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1858.html"
},
{
"name": "RHSA-2016:1857",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1857.html"
},
{
"name": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/",
"refsource": "CONFIRM",
"url": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/"
},
{
"name": "[ruby-security-ann] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View",
"refsource": "MLIST",
"url": "https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE"
},
{
"name": "DSA-3651",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3651"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2016-6316",
"datePublished": "2016-09-07T19:00:00",
"dateReserved": "2016-07-26T00:00:00",
"dateUpdated": "2024-08-06T01:29:18.216Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2016-6316\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2016-09-07T19:28:10.067\",\"lastModified\":\"2025-04-12T10:46:40.837\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \\\"HTML safe\\\" and used as attribute values in tag handlers.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de XSS en Action View en Ruby en Rails 3.x en versiones anteriores a 3.2.22.3, 4.x en versiones anteriores a 4.2.7.1 y 5.x en versiones anteriores a 5.0.0.1 podr\u00eda permitir a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de texto declarado como \\\"HTML safe\\\" y utilizado como valores de atributos en los manejadores de etiquetas.\"}],\"metrics\":{\"cvssMetricV30\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.0\",\"vectorString\":\"CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N\",\"baseScore\":6.1,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"CHANGED\",\"confidentialityImpact\":\"LOW\",\"integrityImpact\":\"LOW\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":2.8,\"impactScore\":2.7}],\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:M/Au:N/C:N/I:P/A:N\",\"baseScore\":4.3,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"MEDIUM\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"NONE\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"NONE\"},\"baseSeverity\":\"MEDIUM\",\"exploitabilityScore\":8.6,\"impactScore\":2.9,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":true}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E3BE7DFE-BA20-434B-A1DE-AD038B255C60\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"DCEE5B21-C990-4705-8239-0D7B29DAEDA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"65EE33B1-B079-4CDE-B9C2-F1613A4610DC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"5CAAA20B-824F-4448-99DC-9712FE628073\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D2BEBDFB-0F30-454A-B74C-F820C9D2708B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D7CD8C1-95D1-477E-AD96-6582EC33BA01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"B6F00D98-3D0F-40AF-AE4F-090B1E6B660C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9476CE55-69C0-45D3-B723-6F459C90BF05\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"112FC73B-A8BC-4EEA-9F4B-CCE685EF2838\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D26565B1-2BA6-4A3C-9264-7FC9A1820B59\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"644EF85E-6D3E-4F5C-96B0-49AD2A2D90CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"392E2D58-CB39-4832-B4D9-9C2E23B8E14C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F2466EA-7039-46A1-B4A3-8DACD1953A59\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CAB4E72-0A15-4B26-9B69-074C278568D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A085E105-9375-440A-80CB-9B23E6D7EB4A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"25911E48-C5D7-4ED8-B4DB-7523A74CCF49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE6EC1E5-3A4A-4751-9F77-28EF5AF681E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B29674E3-CC80-446B-9A43-82594AE7A058\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF34D8CB-2B6D-4CB8-A206-108293BCFFE7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8E5187F6-E3AC-4E0D-B1D0-83DE76C20A4B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"272268EE-E3E8-4683-B679-55D748877A7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"7B69FD33-61FE-4F10-BBE1-215F59035D30\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"08D7CB5D-82EF-4A24-A792-938FAB40863D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A044B21-47D5-468D-AF4A-06B3B5CC0824\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2196F3D0-532A-40F9-843A-1DFBC8B63FDC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"CBEDA932-6CB5-438C-94E4-824732A91BE0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"903E5524-5E45-48CE-A804-EDAEBE3A79AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"08534AF2-F94E-4FB6-A572-4FB9827276D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"29E3B4A6-1346-4358-B7BC-84D00ED3ABBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B52D7A6B-DD93-45F0-9186-18ABEFF28DF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F07C641-48DF-43BE-9EB5-72B337C54846\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A1CB1B12-99F5-430F-AE19-9A95C17FA123\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D1A7C449-8F9A-4CE5-9C3D-375996BFAEE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"05D5D58C-DB79-41EA-81AE-5D95C48211B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE331D6D-99BA-4369-AD8B-B556DEE4955F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"58304E17-ADFD-4686-9CCF-C1CA31843B94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"05108EF0-81AD-4378-9843-5C23F2AC79A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4EE7DA7E-23A5-42AF-9D5C-39240CE2FBDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C448F62-8231-4221-ADA0-C9B848AE03D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5FBD11A1-51C7-4AF7-AA0B-3A14C5435E70\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"60255706-C44A-48CB-B98B-A1F0991CBC74\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0456E2E8-EF06-414E-8A7D-8005F0EB46B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D9EE4763-2495-4B6A-B72F-344967E51C27\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB51F3E9-4899-49A9-9E7B-0DCA92A91DD8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F884F2F4-94F3-46CB-860B-1BCC0EEF408A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"88DFBB48-1C29-4639-9369-F5B413CA2337\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"D37696D7-BEE6-4587-9E33-A7FE24780409\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E95B5D44-0C8D-47BC-A89D-48A5BDEB84F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"1DFDAF6A-76AA-436F-A4F3-DA69892DE2B8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3172982-3FA4-427F-BE3E-2321D804E49D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD6EC85B-F092-48FF-966A-96B9227C8656\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"9000F3C1-57A0-474C-9C82-E58688F29838\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E55E42E-AB6A-4E47-AC69-DFDAEB0A8735\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A42F4E7A-6F6A-485C-8D30-95F3B0285922\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"30B9C0CB-F6E6-4233-84E4-D6E69104DD73\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"84309CC7-A8B7-4ADB-AEA1-964DA5F7B0E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"5343241F-274D-45FF-97C7-2BC2E920BAF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FED122B8-AF4C-4C48-B1E5-54F4A7A31A53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"157ACCAD-0FB8-4CC9-9DFB-70835DE6506C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"3E50ACF6-7277-4C9A-B42A-E7EFDC317691\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C191DC2B-1EC3-48E0-A586-867E6EE4431C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3AA51263-6680-42C6-B119-8241D6F76206\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B4BC41E8-FEDA-4C31-B479-D49A59FC4D63\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"09C20971-53B5-43B0-AC45-5AA0FDF1B054\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"D1AEFA5D-A793-4BAB-8DED-3D3A31260AD8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"496902D6-409A-40D9-849F-C41264BE5B04\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2482AB3F-8303-4F95-BE04-C5F06EEF2015\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"244C6952-377C-4AF0-8BA2-C34516A3EB5A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"98A79CC5-71EC-4E90-9E99-2DF62ABC0122\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6562F3C3-D794-4107-95D4-1C0B0486940B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"11F211A0-AC69-482A-B659-AEE7BE4E4CD6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2816C02C-E13E-4367-91F3-14756A90EC9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E82AF7C7-B725-40EF-8EE3-18F8E7FAEB29\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"1AE674DE-65DB-437E-A034-A2EE5C584B33\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0524F3E3-BAD7-4CD3-A6E7-74CFBE4B46E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"32EB2C3F-0F24-43DB-988E-BD2973598F71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB32713D-FE64-445E-872E-B4678C243AB1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C55E6B4A-2B9C-46C8-A739-109EA4BA7FD4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"89C618DC-38BC-4484-8C41-BC38B7EB636B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE1EF01A-F358-45D3-ADA2-51DD1D8CB6E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AC2616BD-A4E8-42F3-BB5A-7517DC4EDA3D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0E376782-98B0-4766-B6FC-67E032A00C62\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"96D08DC1-14E9-4DB9-BC95-3F73B454FBC4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F365C9E5-27DC-46C3-AFE4-4876EC7B352B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F0016A6-0ED6-443D-B969-CB1226D8E28C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.7:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"42232305-7D62-4692-81CC-B7E9CE642372\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E69470EA-5EBC-4FB9-A722-5B61C70C1140\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"DD2818D7-5006-4486-AE55-47B63C8F114B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"83EF40E0-1C62-415A-892B-C071B109D924\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B13A8EBB-4211-4AB1-8872-244EEEE20ABD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"22D707A0-7CA9-4CED-8DBA-1B50B57EDB2B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C3CADF8-3316-4514-9A70-AD3DF16B19E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"D0D4AF31-A47B-4BE3-A99B-9A0EB7C53D20\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C9AB2152-DED8-4CFD-B915-94A9F56FDD05\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C630AB60-DBAF-421E-B663-492BAE8A180F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0F41CCF8-14EB-4327-A675-83BFDBB53196\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"75842F7D-B1B1-48BA-858F-01148867B3AA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE65D701-AA6E-48E4-B62B-C22DEE863503\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.13:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"17B1E475-C873-4561-9348-027721C08D79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C0406FF0-30F5-40E2-B9B8-FE465D923DE4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.15:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"6646610D-279B-4AEC-B445-981E7784EE5B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"50F51980-EAD9-4E4D-A2E7-1FACFA80AAB0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.17:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CC02A7D1-CB1A-4793-86E3-CF88D0BCDF83\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.18:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A499584B-6E2E-42F3-B0CE-DA7BDD732897\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.21:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AE982FFD-D30F-4872-9C36-74DE50405B18\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.22.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EA770BE3-DD37-45C9-9E6D-8D3407D1A5D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"2E950E33-CD03-45F5-83F9-F106060B4A8B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.0:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"547C62C8-4B3E-431B-AA73-5C42ED884671\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"4CDAD329-35F7-4C82-8019-A0CF6D069059\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"56D3858B-0FEE-4E8D-83C2-68AF0431F478\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.1:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"254884EE-EBA4-45D0-9704-B5CB22569668\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"35FC7015-267C-403B-A23D-EDA6223D2104\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5C913A56-959D-44F1-BD89-D246C66D1F09\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D5BA926-38EE-47BE-9D16-FDCF360A503B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"18EA25F1-279A-4F1A-883D-C064369F592E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD794856-6F30-4ABF-8AE4-720BB75E6F89\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B4199B8B-A6F9-4BFD-8D27-0E663D8C579D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F11E76A3-FA5B-4038-AB52-3D7D5E54D8A2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.4:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"C583ACDE-55D5-4D2F-838F-BEC5BDCDE3B7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"767C481D-6616-4CA9-9A9B-C994D9121796\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D5496953-0C5E-45F8-A7FB-240CEC2CCEB8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.6:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"CA46B621-125E-497F-B2DE-91C989B25936\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.6:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"B3239443-2E19-4540-BA0C-05A27E44CB6C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.6:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"104AC9CF-6611-4469-9852-7FDAF4EC7638\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC9E1864-B1E5-42C3-B4AF-9A002916B66D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"31AC91AA-6A9A-43B4-B3E9-A66A34B6E612\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A462C151-982E-4A83-A376-025015F40645\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"660C2AD2-CEC8-4391-84AF-27515A88B29E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.0.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"578CC013-776B-4868-B448-B7ACAF3AF832\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.0:-:*:*:*:*:*:*\",\"matchCriteriaId\":\"C310EA3E-399A-48FD-8DE9-6950E328CF23\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"293B2998-5169-4960-BEC4-21DAC837E32B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.0:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"FB42A8E7-D273-4CE2-9182-D831D8089BFA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB757DFD-BF47-4483-A2C0-DF37F7D10989\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"B6C375F2-5027-4B55-9112-C5DD2F787E43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EAB8D57F-9849-428C-B8E9-D0A1020728BB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B0359DA8-6B41-46C5-AA95-41B1B366DD4A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0965BDB6-9644-465C-AA32-9278B2D53197\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.2:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"7F6B15CF-37C1-4C9B-8457-4A8C9A480188\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.2:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"072EB16D-1325-4869-B156-65E786A834C7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"847B3C3D-8656-404D-A954-09C159EDC8E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"65CA2D50-B33C-4088-BDDF-EB964C9A092C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"CADB5989-5260-4F60-ACF2-BEB6D7F97654\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9036E3C7-0AD5-489D-BCEE-31DFE13F5ADA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.6:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"509597D0-22E1-4BE8-95AD-C54FE4D15FA4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.6:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"B86E26CB-2376-4EBC-913C-B354E2D6711B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"539C550D-FEDD-415E-95AE-40E1AE2BAF1A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.7.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D5150753-E86D-4859-A046-97B83EAE2C14\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"59C5B869-74FC-4051-A103-A721332B3CF2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7C31EBD2-CD2D-4D38-AA51-A5A56487939A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F11E9791-7BCE-43E5-A4BA-6449623FE4F9\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"33FBD4E4-0BCD-49E1-BA84-86621B7C4556\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"CE521626-2876-455C-9D99-DB74726DC724\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"2DFDD32E-F49E-47F7-B033-B6C3C0E07FC4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.10:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"DCBA26F1-FBBA-444D-9C14-F15AB14A4FC5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.10:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"16D3B0EA-49F7-401A-A1D9-437429D33EAD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"83D1EB17-EE67-48E5-B637-AA9A75D397F6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"17EBD8B4-C4D3-44A6-9DC1-89D948F126A1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A2B1711A-5541-412C-A5A0-274CEAB9E387\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FCB08CD7-E9B9-454F-BAF7-96162D177677\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C3AF00C3-93D9-4284-BCB9-40E42CB8386E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0D3DA0B4-E374-4ED4-8C3B-F723C968666F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"B1730A9A-6810-4470-AE6C-A5356D5BFF43\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.14.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AE4B688E-8638-4539-961D-4FDCBEB4B1C5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.15:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5D0346BB-9180-4FE5-AA35-DC466675ED5D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"2D6DD9BF-F174-4BE3-9910-BDE3658DC36E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"40B79E40-75CB-4EBB-8A4B-AF41AED2AE1E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.1.16:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"89B4DCF6-1A21-4B91-ACB4-7DE05487C497\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9A68D41F-36A9-4B77-814D-996F4E48FA79\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"709A19A5-8FD1-4F9C-A38C-F06242A94D68\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.0:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"8104482C-E8F5-40A7-8B27-234FEF725FD0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.0:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"2CFF8677-EA00-4F7E-BFF9-272482206DB5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.0:beta4:*:*:*:*:*:*\",\"matchCriteriaId\":\"8D7DF5CD-DA28-492D-B5EE-D252ECCC8D96\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"85435026-9855-4BF4-A436-832628B005FD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"56C2308F-A590-47B0-9791-7865D189196F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"9A266882-DABA-4A4C-88E6-60E993EE0947\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"83F1142C-3BFB-4B72-A033-81E20DB19D02\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"1FA738A1-227B-4665-B65E-666883FFAE96\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F00718C-A9E8-4E85-8DA6-33BF11F2DCCE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"10789A2D-6401-4119-BFBE-2EE4C16216D3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.1:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"70ABD462-7142-4831-8EB6-801EC1D05573\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"81D717DB-7C80-48AA-A774-E291D2E75D6E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"06B357FB-0307-4EFA-9C5B-3C2CDEA48584\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.3:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E4BD8840-0F1C-49D3-B843-9CFE64948018\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"79D5B492-43F9-470F-BD21-6EFD93E78453\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.4:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"4EC1F602-D48C-458A-A063-4050BE3BB25F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F6A1C015-56AD-489C-B301-68CF1DBF1BEF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.5:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD191625-ACE2-46B6-9AAD-12D682C732C2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.5:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"02C7DB56-267B-4057-A9BA-36D1E58C6282\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EC163D49-691B-4125-A983-6CF6F6D86DEE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.5.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"68B537D1-1584-4D15-9C75-08ED4D45DC3A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6A19315C-9A9D-45FE-81C8-074744825B98\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.6:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"1E3B4233-E117-4E77-A60D-3DFD5073154D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"392CF25B-8400-4185-863F-D6353B664FB2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:4.2.7:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"3037282A-863A-4C92-A40C-4D436D2621C1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:5.0.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"AF8F94CF-D504-4165-A69E-3F1198CB162A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:5.0.0:beta1.1:*:*:*:*:*:*\",\"matchCriteriaId\":\"C8C25977-AB6C-45E1-8956-871EB31B36BA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:5.0.0:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F0AB6B0-3506-4332-A183-309FAC4882CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:5.0.0:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D7B4EBC-B634-4AD7-9F7A-54D14821D5AE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:5.0.0:beta4:*:*:*:*:*:*\",\"matchCriteriaId\":\"F844FB25-6E27-412F-8394-A7FB15AC1191\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:5.0.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A4E608ED-F4AB-4F29-B34E-2841A59580A6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:5.0.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"6320DD44-7D7E-4075-A865-BEAFF86FDA9D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"224BD488-0D7E-4F8B-9012-DE872DEB544C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A325F57E-0055-4279-9ED7-A26E75FC38E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"9A3BA4AE-B4F0-4204-AFA1-1016F0A6F7AB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"991F368C-CEB5-4DE6-A7EE-C341F358A4CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.15:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"01DB164E-E08E-4649-84BD-15B4159A3AA0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.15:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"E0F7ECFB-86A1-4F00-AD47-971FA23C6D21\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.19:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"69702127-AB96-4FE0-9AC4-FBE7B8CA77E5\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.20:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"48D71F7B-CF93-41D4-A824-51CB11F08692\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.22:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"60CE659B-DF49-477B-8879-C33823F6527F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.22.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7EF68196-7C9E-40FE-868D-C42FF82D52EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.10:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"9C8E749B-2908-442A-99F0-91E2772336ED\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9E43D2D7-89AE-4805-9732-F1C601D8D8B8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.11.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"5F3D8911-060D-435D-ACA2-E29271170CAA\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"EA7A4939-16CF-450D-846A-75B231E32D61\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C964D4A2-3F39-4CC7-A028-B42C94DDB56F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"3B54D9FE-0A38-4053-9F3C-8831E2DD2BF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:4.1.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"23FD6D82-9A14-4BD4-AA00-1875F0962ACE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:4.1.14.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"91AB2B26-A6F1-44D2-92EB-8078DD6FD63A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:5.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E971CF9D-B807-4A74-81EB-D7CB4E5B8099\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:5.0.0:racecar1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B31291C-CBB5-4E51-B0AC-4144E8BAD65B\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43\"}]}]}],\"references\":[{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-1855.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-1856.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-1857.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-1858.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"http://www.debian.org/security/2016/dsa-3651\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2016/08/11/3\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/92430\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://groups.google.com/forum/#%21topic/ruby-security-ann/8B2iV2tPRSE\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://puppet.com/security/cve/cve-2016-6316\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-1855.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-1856.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-1857.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2016-1858.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Release Notes\",\"Vendor Advisory\"]},{\"url\":\"http://www.debian.org/security/2016/dsa-3651\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2016/08/11/3\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Third Party Advisory\"]},{\"url\":\"http://www.securityfocus.com/bid/92430\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://groups.google.com/forum/#%21topic/ruby-security-ann/8B2iV2tPRSE\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://puppet.com/security/cve/cve-2016-6316\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
gsd-2016-6316
Vulnerability from gsd
Modified
2016-08-11 00:00
Details
There is a possible XSS vulnerability in Action View. Text declared as "HTML
safe" will not have quotes escaped when used as attribute values in tag
helpers.
Impact
------
Text declared as "HTML safe" when passed as an attribute value to a tag helper
will not have quotes escaped which can lead to an XSS attack. Impacted code
looks something like this:
```ruby
content_tag(:div, "hi", title: user_input.html_safe)
```
Some helpers like the `sanitize` helper will automatically mark strings as
"HTML safe", so impacted code could also look something like this:
```ruby
content_tag(:div, "hi", title: sanitize(user_input))
```
All users running an affected release should either upgrade or use one of the
workarounds immediately.
Workarounds
-----------
You can work around this issue by either *not* marking arbitrary user input as
safe, or by manually escaping quotes like this:
```ruby
def escape_quotes(value)
value.gsub(/"/, '"'.freeze)
end
content_tag(:div, "hi", title: escape_quotes(sanitize(user_input)))
```
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2016-6316",
"description": "Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers.",
"id": "GSD-2016-6316",
"references": [
"https://www.suse.com/security/cve/CVE-2016-6316.html",
"https://www.debian.org/security/2016/dsa-3651",
"https://access.redhat.com/errata/RHSA-2016:1858",
"https://access.redhat.com/errata/RHSA-2016:1857",
"https://access.redhat.com/errata/RHSA-2016:1856",
"https://access.redhat.com/errata/RHSA-2016:1855"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "actionpack",
"purl": "pkg:gem/actionpack"
}
}
],
"aliases": [
"CVE-2016-6316"
],
"details": "There is a possible XSS vulnerability in Action View. Text declared as \"HTML\nsafe\" will not have quotes escaped when used as attribute values in tag\nhelpers.\n\nImpact\n------\n\nText declared as \"HTML safe\" when passed as an attribute value to a tag helper\nwill not have quotes escaped which can lead to an XSS attack. Impacted code\nlooks something like this:\n\n```ruby\ncontent_tag(:div, \"hi\", title: user_input.html_safe)\n```\n\nSome helpers like the `sanitize` helper will automatically mark strings as\n\"HTML safe\", so impacted code could also look something like this:\n\n```ruby\ncontent_tag(:div, \"hi\", title: sanitize(user_input))\n```\n\nAll users running an affected release should either upgrade or use one of the\nworkarounds immediately.\n\nWorkarounds\n-----------\nYou can work around this issue by either *not* marking arbitrary user input as\nsafe, or by manually escaping quotes like this:\n\n```ruby\ndef escape_quotes(value)\n value.gsub(/\"/, \u0027\u0026quot;\u0027.freeze)\nend\n\ncontent_tag(:div, \"hi\", title: escape_quotes(sanitize(user_input)))\n```\n",
"id": "GSD-2016-6316",
"modified": "2016-08-11T00:00:00.000Z",
"published": "2016-08-11T00:00:00.000Z",
"references": [
{
"type": "WEB",
"url": "https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk"
}
],
"schema_version": "1.4.0",
"summary": "Possible XSS Vulnerability in Action View"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2016-6316",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "RHSA-2016:1856",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1856.html"
},
{
"name": "https://puppet.com/security/cve/cve-2016-6316",
"refsource": "CONFIRM",
"url": "https://puppet.com/security/cve/cve-2016-6316"
},
{
"name": "92430",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/92430"
},
{
"name": "RHSA-2016:1855",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1855.html"
},
{
"name": "[oss-security] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View",
"refsource": "MLIST",
"url": "http://www.openwall.com/lists/oss-security/2016/08/11/3"
},
{
"name": "RHSA-2016:1858",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1858.html"
},
{
"name": "RHSA-2016:1857",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1857.html"
},
{
"name": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/",
"refsource": "CONFIRM",
"url": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/"
},
{
"name": "[ruby-security-ann] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View",
"refsource": "MLIST",
"url": "https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE"
},
{
"name": "DSA-3651",
"refsource": "DEBIAN",
"url": "http://www.debian.org/security/2016/dsa-3651"
}
]
}
},
"github.com/rubysec/ruby-advisory-db": {
"cve": "2016-6316",
"cvss_v3": 6.1,
"date": "2016-08-11",
"description": "There is a possible XSS vulnerability in Action View. Text declared as \"HTML\nsafe\" will not have quotes escaped when used as attribute values in tag\nhelpers.\n\nImpact\n------\n\nText declared as \"HTML safe\" when passed as an attribute value to a tag helper\nwill not have quotes escaped which can lead to an XSS attack. Impacted code\nlooks something like this:\n\n```ruby\ncontent_tag(:div, \"hi\", title: user_input.html_safe)\n```\n\nSome helpers like the `sanitize` helper will automatically mark strings as\n\"HTML safe\", so impacted code could also look something like this:\n\n```ruby\ncontent_tag(:div, \"hi\", title: sanitize(user_input))\n```\n\nAll users running an affected release should either upgrade or use one of the\nworkarounds immediately.\n\nWorkarounds\n-----------\nYou can work around this issue by either *not* marking arbitrary user input as\nsafe, or by manually escaping quotes like this:\n\n```ruby\ndef escape_quotes(value)\n value.gsub(/\"/, \u0027\u0026quot;\u0027.freeze)\nend\n\ncontent_tag(:div, \"hi\", title: escape_quotes(sanitize(user_input)))\n```\n",
"framework": "rails",
"gem": "actionview",
"ghsa": "pc3m-v286-2jwj",
"notes": "\u0027~\u003e 3.2.22.3\u0027 is found in gems/actionpack/CVE-2016-6316.yml",
"patched_versions": [
"~\u003e 4.2.7.1",
"~\u003e 4.2.8",
"\u003e= 5.0.0.1"
],
"title": "Possible XSS Vulnerability in Action View",
"unaffected_versions": [
"\u003c 3.0.0"
],
"url": "https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk"
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003e=3.0.0.alpha \u003c3.2.22.3",
"affected_versions": "All versions starting from 3.0.0.alpha before 3.2.22.3",
"credit": "Andrew Carpenter of Critical Juncture",
"cvss_v2": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-79",
"CWE-937"
],
"date": "2019-08-08",
"description": "There is a possible XSS vulnerability in Action View. Text declared as `HTML safe` will not have quotes escaped when used as attribute values in tag helpers.",
"fixed_versions": [
"3.2.22.3"
],
"identifier": "CVE-2016-6316",
"identifiers": [
"CVE-2016-6316"
],
"not_impacted": "2.x and earlier",
"package_slug": "gem/actionpack",
"pubdate": "2016-09-07",
"solution": "Upgrade to latest or use workaround; see provided link.",
"title": "Possible XSS Vulnerability in ActionView",
"urls": [
"https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk"
],
"uuid": "bc9b53b3-440c-403a-b95f-258724675236"
},
{
"affected_range": "\u003e=4.0.0.alpha \u003c4.2.7.1||\u003e=5.0.0.alpha \u003c5.0.0.1",
"affected_versions": "All versions starting from 4.0.0.alpha before 4.2.7.1, all versions starting from 5.0.0.alpha before 5.0.0.1",
"credit": "Andrew Carpenter of Critical Juncture",
"cvss_v2": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"cvss_v3": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"cwe_ids": [
"CWE-1035",
"CWE-79",
"CWE-937"
],
"date": "2019-08-08",
"description": "There is a possible XSS vulnerability in Action View. Text declared as \"HTML safe\" will not have quotes escaped when used as attribute values in tag helpers.",
"fixed_versions": [
"4.2.7.1",
"5.0.0.1"
],
"identifier": "CVE-2016-6316",
"identifiers": [
"CVE-2016-6316"
],
"package_slug": "gem/actionview",
"pubdate": "2016-09-07",
"solution": "Upgrade to latest or use workaround; see provided link.",
"title": "Possible XSS Vulnerability",
"urls": [
"https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk"
],
"uuid": "72a9b095-3b6c-47d0-a8e2-4ae3de117ad0"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:5.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:5.0.0:beta1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:5.0.0:beta1.1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.14.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.1:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.1:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:5.0.0:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:5.0.0:racecar1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:5.0.0:beta4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.0:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.0:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.1:rc4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.10:rc4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.1.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.12:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.0:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.6:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.7:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.0:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.0:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.5:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.8:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.8:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.13:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.15:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.15:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.22:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.10:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.1.14.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.13:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.0:beta1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.7.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.2:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.2:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.15:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.14:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.0:beta2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.0:beta3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.1:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.1:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.6:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.19:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.17:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.7:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.9:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.18:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.19:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:5.0.0:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:5.0.0:beta3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:5.0.0:beta2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.13:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.0:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.6:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.6:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.6:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.10:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.10:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.0:-:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.2:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.14:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.5.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.5.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.0:beta4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.5:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.1:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.15:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.21:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.22.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.10:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.10:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.11.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.0:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.1:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.1:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.0.4:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.9:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.0:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.0:beta2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.6:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.15:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.16:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.1.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.0:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.0:beta1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.1:rc4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.4:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:4.2.3:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.20:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.18:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.9:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.9:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.13:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.17:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.22.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2016-6316"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/",
"refsource": "CONFIRM",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/"
},
{
"name": "DSA-3651",
"refsource": "DEBIAN",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2016/dsa-3651"
},
{
"name": "[oss-security] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View",
"refsource": "MLIST",
"tags": [
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/11/3"
},
{
"name": "92430",
"refsource": "BID",
"tags": [],
"url": "http://www.securityfocus.com/bid/92430"
},
{
"name": "RHSA-2016:1858",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1858.html"
},
{
"name": "RHSA-2016:1857",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1857.html"
},
{
"name": "RHSA-2016:1856",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1856.html"
},
{
"name": "RHSA-2016:1855",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2016-1855.html"
},
{
"name": "https://puppet.com/security/cve/cve-2016-6316",
"refsource": "CONFIRM",
"tags": [],
"url": "https://puppet.com/security/cve/cve-2016-6316"
},
{
"name": "[ruby-security-ann] 20160811 [CVE-2016-6316] Possible XSS Vulnerability in Action View",
"refsource": "MLIST",
"tags": [],
"url": "https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "MEDIUM",
"userInteractionRequired": true
},
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7
}
},
"lastModifiedDate": "2019-08-08T15:43Z",
"publishedDate": "2016-09-07T19:28Z"
}
}
}
fkie_cve-2016-6316
Vulnerability from fkie_nvd
Published
2016-09-07 19:28
Modified
2025-04-12 10:46
Severity ?
Summary
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
References
Impacted products
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E3BE7DFE-BA20-434B-A1DE-AD038B255C60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*",
"matchCriteriaId": "DCEE5B21-C990-4705-8239-0D7B29DAEDA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "65EE33B1-B079-4CDE-B9C2-F1613A4610DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "5CAAA20B-824F-4448-99DC-9712FE628073",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "D2BEBDFB-0F30-454A-B74C-F820C9D2708B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*",
"matchCriteriaId": "1D7CD8C1-95D1-477E-AD96-6582EC33BA01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B6F00D98-3D0F-40AF-AE4F-090B1E6B660C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9476CE55-69C0-45D3-B723-6F459C90BF05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "112FC73B-A8BC-4EEA-9F4B-CCE685EF2838",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D26565B1-2BA6-4A3C-9264-7FC9A1820B59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "644EF85E-6D3E-4F5C-96B0-49AD2A2D90CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "392E2D58-CB39-4832-B4D9-9C2E23B8E14C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "1F2466EA-7039-46A1-B4A3-8DACD1953A59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0CAB4E72-0A15-4B26-9B69-074C278568D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "A085E105-9375-440A-80CB-9B23E6D7EB4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:*",
"matchCriteriaId": "25911E48-C5D7-4ED8-B4DB-7523A74CCF49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "FE6EC1E5-3A4A-4751-9F77-28EF5AF681E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B29674E3-CC80-446B-9A43-82594AE7A058",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:*",
"matchCriteriaId": "FF34D8CB-2B6D-4CB8-A206-108293BCFFE7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "8E5187F6-E3AC-4E0D-B1D0-83DE76C20A4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "272268EE-E3E8-4683-B679-55D748877A7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:*",
"matchCriteriaId": "7B69FD33-61FE-4F10-BBE1-215F59035D30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:*",
"matchCriteriaId": "08D7CB5D-82EF-4A24-A792-938FAB40863D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:*",
"matchCriteriaId": "8A044B21-47D5-468D-AF4A-06B3B5CC0824",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "2196F3D0-532A-40F9-843A-1DFBC8B63FDC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:*",
"matchCriteriaId": "CBEDA932-6CB5-438C-94E4-824732A91BE0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:*",
"matchCriteriaId": "903E5524-5E45-48CE-A804-EDAEBE3A79AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:*",
"matchCriteriaId": "08534AF2-F94E-4FB6-A572-4FB9827276D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:*",
"matchCriteriaId": "29E3B4A6-1346-4358-B7BC-84D00ED3ABBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:*",
"matchCriteriaId": "B52D7A6B-DD93-45F0-9186-18ABEFF28DF4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "1F07C641-48DF-43BE-9EB5-72B337C54846",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:*",
"matchCriteriaId": "A1CB1B12-99F5-430F-AE19-9A95C17FA123",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D1A7C449-8F9A-4CE5-9C3D-375996BFAEE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "05D5D58C-DB79-41EA-81AE-5D95C48211B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:*",
"matchCriteriaId": "FE331D6D-99BA-4369-AD8B-B556DEE4955F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "58304E17-ADFD-4686-9CCF-C1CA31843B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:*",
"matchCriteriaId": "05108EF0-81AD-4378-9843-5C23F2AC79A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "4EE7DA7E-23A5-42AF-9D5C-39240CE2FBDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "0C448F62-8231-4221-ADA0-C9B848AE03D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.17:*:*:*:*:*:*:*",
"matchCriteriaId": "5FBD11A1-51C7-4AF7-AA0B-3A14C5435E70",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.18:*:*:*:*:*:*:*",
"matchCriteriaId": "60255706-C44A-48CB-B98B-A1F0991CBC74",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.19:*:*:*:*:*:*:*",
"matchCriteriaId": "0456E2E8-EF06-414E-8A7D-8005F0EB46B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.20:*:*:*:*:*:*:*",
"matchCriteriaId": "D9EE4763-2495-4B6A-B72F-344967E51C27",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DB51F3E9-4899-49A9-9E7B-0DCA92A91DD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "F884F2F4-94F3-46CB-860B-1BCC0EEF408A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "88DFBB48-1C29-4639-9369-F5B413CA2337",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "D37696D7-BEE6-4587-9E33-A7FE24780409",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "E95B5D44-0C8D-47BC-A89D-48A5BDEB84F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "1DFDAF6A-76AA-436F-A4F3-DA69892DE2B8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:*",
"matchCriteriaId": "D3172982-3FA4-427F-BE3E-2321D804E49D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:*",
"matchCriteriaId": "FD6EC85B-F092-48FF-966A-96B9227C8656",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:*",
"matchCriteriaId": "9000F3C1-57A0-474C-9C82-E58688F29838",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:*",
"matchCriteriaId": "6E55E42E-AB6A-4E47-AC69-DFDAEB0A8735",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A42F4E7A-6F6A-485C-8D30-95F3B0285922",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "30B9C0CB-F6E6-4233-84E4-D6E69104DD73",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "84309CC7-A8B7-4ADB-AEA1-964DA5F7B0E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "5343241F-274D-45FF-97C7-2BC2E920BAF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FED122B8-AF4C-4C48-B1E5-54F4A7A31A53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "157ACCAD-0FB8-4CC9-9DFB-70835DE6506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "3E50ACF6-7277-4C9A-B42A-E7EFDC317691",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C191DC2B-1EC3-48E0-A586-867E6EE4431C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3AA51263-6680-42C6-B119-8241D6F76206",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B4BC41E8-FEDA-4C31-B479-D49A59FC4D63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "09C20971-53B5-43B0-AC45-5AA0FDF1B054",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D1AEFA5D-A793-4BAB-8DED-3D3A31260AD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "496902D6-409A-40D9-849F-C41264BE5B04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "2482AB3F-8303-4F95-BE04-C5F06EEF2015",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "244C6952-377C-4AF0-8BA2-C34516A3EB5A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "98A79CC5-71EC-4E90-9E99-2DF62ABC0122",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "6562F3C3-D794-4107-95D4-1C0B0486940B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "11F211A0-AC69-482A-B659-AEE7BE4E4CD6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2816C02C-E13E-4367-91F3-14756A90EC9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "E82AF7C7-B725-40EF-8EE3-18F8E7FAEB29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "1AE674DE-65DB-437E-A034-A2EE5C584B33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0524F3E3-BAD7-4CD3-A6E7-74CFBE4B46E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "32EB2C3F-0F24-43DB-988E-BD2973598F71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EB32713D-FE64-445E-872E-B4678C243AB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C55E6B4A-2B9C-46C8-A739-109EA4BA7FD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "89C618DC-38BC-4484-8C41-BC38B7EB636B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "FE1EF01A-F358-45D3-ADA2-51DD1D8CB6E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "AC2616BD-A4E8-42F3-BB5A-7517DC4EDA3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "0E376782-98B0-4766-B6FC-67E032A00C62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "96D08DC1-14E9-4DB9-BC95-3F73B454FBC4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "F365C9E5-27DC-46C3-AFE4-4876EC7B352B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "6F0016A6-0ED6-443D-B969-CB1226D8E28C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "42232305-7D62-4692-81CC-B7E9CE642372",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "E69470EA-5EBC-4FB9-A722-5B61C70C1140",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DD2818D7-5006-4486-AE55-47B63C8F114B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.8:rc2:*:*:*:*:*:*",
"matchCriteriaId": "83EF40E0-1C62-415A-892B-C071B109D924",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "B13A8EBB-4211-4AB1-8872-244EEEE20ABD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.9:rc1:*:*:*:*:*:*",
"matchCriteriaId": "22D707A0-7CA9-4CED-8DBA-1B50B57EDB2B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.9:rc2:*:*:*:*:*:*",
"matchCriteriaId": "0C3CADF8-3316-4514-9A70-AD3DF16B19E1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.9:rc3:*:*:*:*:*:*",
"matchCriteriaId": "D0D4AF31-A47B-4BE3-A99B-9A0EB7C53D20",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.10:*:*:*:*:*:*:*",
"matchCriteriaId": "C9AB2152-DED8-4CFD-B915-94A9F56FDD05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.11:*:*:*:*:*:*:*",
"matchCriteriaId": "C630AB60-DBAF-421E-B663-492BAE8A180F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.12:*:*:*:*:*:*:*",
"matchCriteriaId": "0F41CCF8-14EB-4327-A675-83BFDBB53196",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.13:*:*:*:*:*:*:*",
"matchCriteriaId": "75842F7D-B1B1-48BA-858F-01148867B3AA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.13:rc1:*:*:*:*:*:*",
"matchCriteriaId": "FE65D701-AA6E-48E4-B62B-C22DEE863503",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.13:rc2:*:*:*:*:*:*",
"matchCriteriaId": "17B1E475-C873-4561-9348-027721C08D79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.15:*:*:*:*:*:*:*",
"matchCriteriaId": "C0406FF0-30F5-40E2-B9B8-FE465D923DE4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.15:rc3:*:*:*:*:*:*",
"matchCriteriaId": "6646610D-279B-4AEC-B445-981E7784EE5B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.16:*:*:*:*:*:*:*",
"matchCriteriaId": "50F51980-EAD9-4E4D-A2E7-1FACFA80AAB0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.17:*:*:*:*:*:*:*",
"matchCriteriaId": "CC02A7D1-CB1A-4793-86E3-CF88D0BCDF83",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.18:*:*:*:*:*:*:*",
"matchCriteriaId": "A499584B-6E2E-42F3-B0CE-DA7BDD732897",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.21:*:*:*:*:*:*:*",
"matchCriteriaId": "AE982FFD-D30F-4872-9C36-74DE50405B18",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.22.2:*:*:*:*:*:*:*",
"matchCriteriaId": "EA770BE3-DD37-45C9-9E6D-8D3407D1A5D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.0:-:*:*:*:*:*:*",
"matchCriteriaId": "2E950E33-CD03-45F5-83F9-F106060B4A8B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.0:beta:*:*:*:*:*:*",
"matchCriteriaId": "547C62C8-4B3E-431B-AA73-5C42ED884671",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "4CDAD329-35F7-4C82-8019-A0CF6D069059",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "56D3858B-0FEE-4E8D-83C2-68AF0431F478",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.1:-:*:*:*:*:*:*",
"matchCriteriaId": "254884EE-EBA4-45D0-9704-B5CB22569668",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "35FC7015-267C-403B-A23D-EDA6223D2104",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "5C913A56-959D-44F1-BD89-D246C66D1F09",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "5D5BA926-38EE-47BE-9D16-FDCF360A503B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.1:rc4:*:*:*:*:*:*",
"matchCriteriaId": "18EA25F1-279A-4F1A-883D-C064369F592E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FD794856-6F30-4ABF-8AE4-720BB75E6F89",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "B4199B8B-A6F9-4BFD-8D27-0E663D8C579D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "F11E76A3-FA5B-4038-AB52-3D7D5E54D8A2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "C583ACDE-55D5-4D2F-838F-BEC5BDCDE3B7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "767C481D-6616-4CA9-9A9B-C994D9121796",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "D5496953-0C5E-45F8-A7FB-240CEC2CCEB8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "CA46B621-125E-497F-B2DE-91C989B25936",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.6:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B3239443-2E19-4540-BA0C-05A27E44CB6C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.6:rc3:*:*:*:*:*:*",
"matchCriteriaId": "104AC9CF-6611-4469-9852-7FDAF4EC7638",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "DC9E1864-B1E5-42C3-B4AF-9A002916B66D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "31AC91AA-6A9A-43B4-B3E9-A66A34B6E612",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "A462C151-982E-4A83-A376-025015F40645",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "660C2AD2-CEC8-4391-84AF-27515A88B29E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.0.10:rc1:*:*:*:*:*:*",
"matchCriteriaId": "578CC013-776B-4868-B448-B7ACAF3AF832",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.0:-:*:*:*:*:*:*",
"matchCriteriaId": "C310EA3E-399A-48FD-8DE9-6950E328CF23",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "293B2998-5169-4960-BEC4-21DAC837E32B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "FB42A8E7-D273-4CE2-9182-D831D8089BFA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "DB757DFD-BF47-4483-A2C0-DF37F7D10989",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B6C375F2-5027-4B55-9112-C5DD2F787E43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EAB8D57F-9849-428C-B8E9-D0A1020728BB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "B0359DA8-6B41-46C5-AA95-41B1B366DD4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "0965BDB6-9644-465C-AA32-9278B2D53197",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "7F6B15CF-37C1-4C9B-8457-4A8C9A480188",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.2:rc3:*:*:*:*:*:*",
"matchCriteriaId": "072EB16D-1325-4869-B156-65E786A834C7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "847B3C3D-8656-404D-A954-09C159EDC8E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "65CA2D50-B33C-4088-BDDF-EB964C9A092C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "CADB5989-5260-4F60-ACF2-BEB6D7F97654",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "9036E3C7-0AD5-489D-BCEE-31DFE13F5ADA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "509597D0-22E1-4BE8-95AD-C54FE4D15FA4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.6:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B86E26CB-2376-4EBC-913C-B354E2D6711B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "539C550D-FEDD-415E-95AE-40E1AE2BAF1A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "D5150753-E86D-4859-A046-97B83EAE2C14",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "59C5B869-74FC-4051-A103-A721332B3CF2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.9:*:*:*:*:*:*:*",
"matchCriteriaId": "7C31EBD2-CD2D-4D38-AA51-A5A56487939A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.9:rc1:*:*:*:*:*:*",
"matchCriteriaId": "F11E9791-7BCE-43E5-A4BA-6449623FE4F9",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.10:*:*:*:*:*:*:*",
"matchCriteriaId": "33FBD4E4-0BCD-49E1-BA84-86621B7C4556",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.10:rc1:*:*:*:*:*:*",
"matchCriteriaId": "CE521626-2876-455C-9D99-DB74726DC724",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.10:rc2:*:*:*:*:*:*",
"matchCriteriaId": "2DFDD32E-F49E-47F7-B033-B6C3C0E07FC4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.10:rc3:*:*:*:*:*:*",
"matchCriteriaId": "DCBA26F1-FBBA-444D-9C14-F15AB14A4FC5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.10:rc4:*:*:*:*:*:*",
"matchCriteriaId": "16D3B0EA-49F7-401A-A1D9-437429D33EAD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.12:*:*:*:*:*:*:*",
"matchCriteriaId": "83D1EB17-EE67-48E5-B637-AA9A75D397F6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.12:rc1:*:*:*:*:*:*",
"matchCriteriaId": "17EBD8B4-C4D3-44A6-9DC1-89D948F126A1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.13:*:*:*:*:*:*:*",
"matchCriteriaId": "A2B1711A-5541-412C-A5A0-274CEAB9E387",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.13:rc1:*:*:*:*:*:*",
"matchCriteriaId": "FCB08CD7-E9B9-454F-BAF7-96162D177677",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.14:*:*:*:*:*:*:*",
"matchCriteriaId": "C3AF00C3-93D9-4284-BCB9-40E42CB8386E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.14:rc1:*:*:*:*:*:*",
"matchCriteriaId": "0D3DA0B4-E374-4ED4-8C3B-F723C968666F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.14:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B1730A9A-6810-4470-AE6C-A5356D5BFF43",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.14.2:*:*:*:*:*:*:*",
"matchCriteriaId": "AE4B688E-8638-4539-961D-4FDCBEB4B1C5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.15:*:*:*:*:*:*:*",
"matchCriteriaId": "5D0346BB-9180-4FE5-AA35-DC466675ED5D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.15:rc1:*:*:*:*:*:*",
"matchCriteriaId": "2D6DD9BF-F174-4BE3-9910-BDE3658DC36E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.16:*:*:*:*:*:*:*",
"matchCriteriaId": "40B79E40-75CB-4EBB-8A4B-AF41AED2AE1E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.1.16:rc1:*:*:*:*:*:*",
"matchCriteriaId": "89B4DCF6-1A21-4B91-ACB4-7DE05487C497",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "9A68D41F-36A9-4B77-814D-996F4E48FA79",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "709A19A5-8FD1-4F9C-A38C-F06242A94D68",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "8104482C-E8F5-40A7-8B27-234FEF725FD0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "2CFF8677-EA00-4F7E-BFF9-272482206DB5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "8D7DF5CD-DA28-492D-B5EE-D252ECCC8D96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "85435026-9855-4BF4-A436-832628B005FD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "56C2308F-A590-47B0-9791-7865D189196F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "9A266882-DABA-4A4C-88E6-60E993EE0947",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "83F1142C-3BFB-4B72-A033-81E20DB19D02",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "1FA738A1-227B-4665-B65E-666883FFAE96",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "6F00718C-A9E8-4E85-8DA6-33BF11F2DCCE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "10789A2D-6401-4119-BFBE-2EE4C16216D3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.1:rc4:*:*:*:*:*:*",
"matchCriteriaId": "70ABD462-7142-4831-8EB6-801EC1D05573",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "81D717DB-7C80-48AA-A774-E291D2E75D6E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "06B357FB-0307-4EFA-9C5B-3C2CDEA48584",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "E4BD8840-0F1C-49D3-B843-9CFE64948018",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "79D5B492-43F9-470F-BD21-6EFD93E78453",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "4EC1F602-D48C-458A-A063-4050BE3BB25F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "F6A1C015-56AD-489C-B301-68CF1DBF1BEF",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "FD191625-ACE2-46B6-9AAD-12D682C732C2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.5:rc2:*:*:*:*:*:*",
"matchCriteriaId": "02C7DB56-267B-4057-A9BA-36D1E58C6282",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "EC163D49-691B-4125-A983-6CF6F6D86DEE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "68B537D1-1584-4D15-9C75-08ED4D45DC3A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "6A19315C-9A9D-45FE-81C8-074744825B98",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "1E3B4233-E117-4E77-A60D-3DFD5073154D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "392CF25B-8400-4185-863F-D6353B664FB2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:4.2.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3037282A-863A-4C92-A40C-4D436D2621C1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:5.0.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "AF8F94CF-D504-4165-A69E-3F1198CB162A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:5.0.0:beta1.1:*:*:*:*:*:*",
"matchCriteriaId": "C8C25977-AB6C-45E1-8956-871EB31B36BA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:5.0.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "5F0AB6B0-3506-4332-A183-309FAC4882CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:5.0.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "6D7B4EBC-B634-4AD7-9F7A-54D14821D5AE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:5.0.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "F844FB25-6E27-412F-8394-A7FB15AC1191",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:5.0.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "A4E608ED-F4AB-4F29-B34E-2841A59580A6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:5.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "6320DD44-7D7E-4075-A865-BEAFF86FDA9D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "224BD488-0D7E-4F8B-9012-DE872DEB544C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:*:*:*:*:*:*:*",
"matchCriteriaId": "A325F57E-0055-4279-9ED7-A26E75FC38E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:rc1:*:*:*:*:*:*",
"matchCriteriaId": "9A3BA4AE-B4F0-4204-AFA1-1016F0A6F7AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.14:rc2:*:*:*:*:*:*",
"matchCriteriaId": "991F368C-CEB5-4DE6-A7EE-C341F358A4CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.15:rc1:*:*:*:*:*:*",
"matchCriteriaId": "01DB164E-E08E-4649-84BD-15B4159A3AA0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.15:rc2:*:*:*:*:*:*",
"matchCriteriaId": "E0F7ECFB-86A1-4F00-AD47-971FA23C6D21",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.19:*:*:*:*:*:*:*",
"matchCriteriaId": "69702127-AB96-4FE0-9AC4-FBE7B8CA77E5",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.20:*:*:*:*:*:*:*",
"matchCriteriaId": "48D71F7B-CF93-41D4-A824-51CB11F08692",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.22:*:*:*:*:*:*:*",
"matchCriteriaId": "60CE659B-DF49-477B-8879-C33823F6527F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.2.22.1:*:*:*:*:*:*:*",
"matchCriteriaId": "7EF68196-7C9E-40FE-868D-C42FF82D52EE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.10:rc2:*:*:*:*:*:*",
"matchCriteriaId": "9C8E749B-2908-442A-99F0-91E2772336ED",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "9E43D2D7-89AE-4805-9732-F1C601D8D8B8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.11.1:*:*:*:*:*:*:*",
"matchCriteriaId": "5F3D8911-060D-435D-ACA2-E29271170CAA",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "EA7A4939-16CF-450D-846A-75B231E32D61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "C964D4A2-3F39-4CC7-A028-B42C94DDB56F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.0.13:rc1:*:*:*:*:*:*",
"matchCriteriaId": "3B54D9FE-0A38-4053-9F3C-8831E2DD2BF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.1.11:*:*:*:*:*:*:*",
"matchCriteriaId": "23FD6D82-9A14-4BD4-AA00-1875F0962ACE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:4.1.14.1:*:*:*:*:*:*:*",
"matchCriteriaId": "91AB2B26-A6F1-44D2-92EB-8078DD6FD63A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:5.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E971CF9D-B807-4A74-81EB-D7CB4E5B8099",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:5.0.0:racecar1:*:*:*:*:*:*",
"matchCriteriaId": "0B31291C-CBB5-4E51-B0AC-4144E8BAD65B",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:o:debian:debian_linux:8.0:*:*:*:*:*:*:*",
"matchCriteriaId": "C11E6FB0-C8C0-4527-9AA0-CB9B316F8F43",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers."
},
{
"lang": "es",
"value": "Vulnerabilidad de XSS en Action View en Ruby en Rails 3.x en versiones anteriores a 3.2.22.3, 4.x en versiones anteriores a 4.2.7.1 y 5.x en versiones anteriores a 5.0.0.1 podr\u00eda permitir a atacantes remotos inyectar secuencias de comandos web o HTML arbitrarios a trav\u00e9s de texto declarado como \"HTML safe\" y utilizado como valores de atributos en los manejadores de etiquetas."
}
],
"id": "CVE-2016-6316",
"lastModified": "2025-04-12T10:46:40.837",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "MEDIUM",
"cvssData": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"exploitabilityScore": 8.6,
"impactScore": 2.9,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": true
}
],
"cvssMetricV30": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"exploitabilityScore": 2.8,
"impactScore": 2.7,
"source": "nvd@nist.gov",
"type": "Primary"
}
]
},
"published": "2016-09-07T19:28:10.067",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1855.html"
},
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1856.html"
},
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1857.html"
},
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1858.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2016/dsa-3651"
},
{
"source": "secalert@redhat.com",
"tags": [
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/11/3"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/92430"
},
{
"source": "secalert@redhat.com",
"url": "https://groups.google.com/forum/#%21topic/ruby-security-ann/8B2iV2tPRSE"
},
{
"source": "secalert@redhat.com",
"url": "https://puppet.com/security/cve/cve-2016-6316"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1855.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1856.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1857.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1858.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Release Notes",
"Vendor Advisory"
],
"url": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.debian.org/security/2016/dsa-3651"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Third Party Advisory"
],
"url": "http://www.openwall.com/lists/oss-security/2016/08/11/3"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/92430"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://groups.google.com/forum/#%21topic/ruby-security-ann/8B2iV2tPRSE"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://puppet.com/security/cve/cve-2016-6316"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-79"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
RHSA-2016:1858
Vulnerability from csaf_redhat
Published
2016-09-13 11:05
Modified
2025-09-10 14:13
Summary
Red Hat Security Advisory: ruby193-rubygem-actionpack security update
Notes
Topic
An update for ruby193-rubygem-actionpack is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.
Security Fix(es):
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for ruby193-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nRed Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1858",
"url": "https://access.redhat.com/errata/RHSA-2016:1858"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1858.json"
}
],
"title": "Red Hat Security Advisory: ruby193-rubygem-actionpack security update",
"tracking": {
"current_release_date": "2025-09-10T14:13:27+00:00",
"generator": {
"date": "2025-09-10T14:13:27+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.7"
}
},
"id": "RHSA-2016:1858",
"initial_release_date": "2016-09-13T11:05:54+00:00",
"revision_history": [
{
"date": "2016-09-13T11:05:54+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:05:54+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-09-10T14:13:27+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el7?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el6?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"product_id": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack-doc@3.2.8-20.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"product_id": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack-doc@3.2.8-20.el6?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:05:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running applications using ruby193-rubygem-actionpack must be restarted for this update to take effect.",
"product_ids": [
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1858"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
}
]
}
rhsa-2016:1856
Vulnerability from csaf_redhat
Published
2016-09-13 11:08
Modified
2025-09-10 14:13
Summary
Red Hat Security Advisory: rh-ror41-rubygem-actionview security update
Notes
Topic
An update for rh-ror41-rubygem-actionview is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component.
Security Fix(es):
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for rh-ror41-rubygem-actionview is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component.\n\nSecurity Fix(es):\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nRed Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1856",
"url": "https://access.redhat.com/errata/RHSA-2016:1856"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1856.json"
}
],
"title": "Red Hat Security Advisory: rh-ror41-rubygem-actionview security update",
"tracking": {
"current_release_date": "2025-09-10T14:13:27+00:00",
"generator": {
"date": "2025-09-10T14:13:27+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.7"
}
},
"id": "RHSA-2016:1856",
"initial_release_date": "2016-09-13T11:08:25+00:00",
"revision_history": [
{
"date": "2016-09-13T11:08:25+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:08:25+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-09-10T14:13:27+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"product_id": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview-doc@4.1.5-6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"product_id": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview-doc@4.1.5-6.el6?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:08:25+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running applications using rh-ror41-rubygem-actionviewmust be restarted for this update to take effect.",
"product_ids": [
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1856"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
}
]
}
rhsa-2016_1855
Vulnerability from csaf_redhat
Published
2016-09-13 11:09
Modified
2024-11-14 20:47
Summary
Red Hat Security Advisory: rh-ror42 security update
Notes
Topic
An update for rh-ror42-rubygem-actionview, rh-ror42-rubygem-activerecord, and rh-ror42-rubygem-actionpack is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component, and Active Record implements the model component.
Security Fix(es) in rubygem-actionview:
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Security Fix(es) in rubygem-activerecord:
* A flaw was found in the way Active Record handled certain special values in dynamic finders and relations. If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application. (CVE-2016-6317)
Red Hat would like to thank the Ruby on Rails project for reporting these issues. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter of CVE-2016-6316; and joernchen (Phenoelit) as the original reporter of CVE-2016-6317.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for rh-ror42-rubygem-actionview, rh-ror42-rubygem-activerecord, and rh-ror42-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component, and Active Record implements the model component.\n\nSecurity Fix(es) in rubygem-actionview:\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nSecurity Fix(es) in rubygem-activerecord:\n\n* A flaw was found in the way Active Record handled certain special values in dynamic finders and relations. If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application. (CVE-2016-6317)\n\nRed Hat would like to thank the Ruby on Rails project for reporting these issues. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter of CVE-2016-6316; and joernchen (Phenoelit) as the original reporter of CVE-2016-6317.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1855",
"url": "https://access.redhat.com/errata/RHSA-2016:1855"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "1365017",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365017"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1855.json"
}
],
"title": "Red Hat Security Advisory: rh-ror42 security update",
"tracking": {
"current_release_date": "2024-11-14T20:47:47+00:00",
"generator": {
"date": "2024-11-14T20:47:47+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:1855",
"initial_release_date": "2016-09-13T11:09:39+00:00",
"revision_history": [
{
"date": "2016-09-13T11:09:39+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:09:39+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T20:47:47+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionview@4.2.6-3.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionview-doc@4.2.6-3.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-activerecord-doc@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-activerecord@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack-doc@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"product": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"product_id": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionview@4.2.6-3.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"product": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"product_id": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-activerecord@4.2.6-3.el7?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"product": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-3.el7?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:09:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1855"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
},
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"joernchen"
],
"organization": "Phenoelit",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6317",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365017"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the way Active Record handled certain special values in dynamic finders and relations. If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-activerecord: unsafe query generation in Active Record",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6317"
},
{
"category": "external",
"summary": "RHBZ#1365017",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365017"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6317",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6317"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6317",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6317"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/rgO20zYW33s/gmamLa-wDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/rgO20zYW33s/gmamLa-wDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:09:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1855"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-activerecord: unsafe query generation in Active Record"
}
]
}
rhsa-2016_1858
Vulnerability from csaf_redhat
Published
2016-09-13 11:05
Modified
2024-11-14 20:48
Summary
Red Hat Security Advisory: ruby193-rubygem-actionpack security update
Notes
Topic
An update for ruby193-rubygem-actionpack is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.
Security Fix(es):
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for ruby193-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nRed Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1858",
"url": "https://access.redhat.com/errata/RHSA-2016:1858"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1858.json"
}
],
"title": "Red Hat Security Advisory: ruby193-rubygem-actionpack security update",
"tracking": {
"current_release_date": "2024-11-14T20:48:46+00:00",
"generator": {
"date": "2024-11-14T20:48:46+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:1858",
"initial_release_date": "2016-09-13T11:05:54+00:00",
"revision_history": [
{
"date": "2016-09-13T11:05:54+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:05:54+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T20:48:46+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el7?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el6?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"product_id": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack-doc@3.2.8-20.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"product_id": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack-doc@3.2.8-20.el6?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:05:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running applications using ruby193-rubygem-actionpack must be restarted for this update to take effect.",
"product_ids": [
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1858"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
}
]
}
RHSA-2016:1857
Vulnerability from csaf_redhat
Published
2016-09-13 11:07
Modified
2025-09-10 14:13
Summary
Red Hat Security Advisory: ror40-rubygem-actionpack security update
Notes
Topic
An update for ror40-rubygem-actionpack is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.
Security Fix(es):
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for ror40-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nRed Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1857",
"url": "https://access.redhat.com/errata/RHSA-2016:1857"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1857.json"
}
],
"title": "Red Hat Security Advisory: ror40-rubygem-actionpack security update",
"tracking": {
"current_release_date": "2025-09-10T14:13:27+00:00",
"generator": {
"date": "2025-09-10T14:13:27+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.7"
}
},
"id": "RHSA-2016:1857",
"initial_release_date": "2016-09-13T11:07:09+00:00",
"revision_history": [
{
"date": "2016-09-13T11:07:09+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:07:09+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-09-10T14:13:27+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"product": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"product_id": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack-doc@4.0.2-8.el6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"product": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"product_id": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack-doc@4.0.2-8.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el7?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el6?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el7?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:07:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running applications using ror40-rubygem-actionpack must be restarted for this update to take effect.",
"product_ids": [
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1857"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
}
]
}
RHSA-2016:1856
Vulnerability from csaf_redhat
Published
2016-09-13 11:08
Modified
2025-09-10 14:13
Summary
Red Hat Security Advisory: rh-ror41-rubygem-actionview security update
Notes
Topic
An update for rh-ror41-rubygem-actionview is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component.
Security Fix(es):
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for rh-ror41-rubygem-actionview is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component.\n\nSecurity Fix(es):\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nRed Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1856",
"url": "https://access.redhat.com/errata/RHSA-2016:1856"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1856.json"
}
],
"title": "Red Hat Security Advisory: rh-ror41-rubygem-actionview security update",
"tracking": {
"current_release_date": "2025-09-10T14:13:27+00:00",
"generator": {
"date": "2025-09-10T14:13:27+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.7"
}
},
"id": "RHSA-2016:1856",
"initial_release_date": "2016-09-13T11:08:25+00:00",
"revision_history": [
{
"date": "2016-09-13T11:08:25+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:08:25+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-09-10T14:13:27+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"product_id": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview-doc@4.1.5-6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"product_id": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview-doc@4.1.5-6.el6?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:08:25+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running applications using rh-ror41-rubygem-actionviewmust be restarted for this update to take effect.",
"product_ids": [
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1856"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
}
]
}
RHSA-2016:1855
Vulnerability from csaf_redhat
Published
2016-09-13 11:09
Modified
2025-09-10 14:13
Summary
Red Hat Security Advisory: rh-ror42 security update
Notes
Topic
An update for rh-ror42-rubygem-actionview, rh-ror42-rubygem-activerecord, and rh-ror42-rubygem-actionpack is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component, and Active Record implements the model component.
Security Fix(es) in rubygem-actionview:
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Security Fix(es) in rubygem-activerecord:
* A flaw was found in the way Active Record handled certain special values in dynamic finders and relations. If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application. (CVE-2016-6317)
Red Hat would like to thank the Ruby on Rails project for reporting these issues. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter of CVE-2016-6316; and joernchen (Phenoelit) as the original reporter of CVE-2016-6317.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for rh-ror42-rubygem-actionview, rh-ror42-rubygem-activerecord, and rh-ror42-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component, and Active Record implements the model component.\n\nSecurity Fix(es) in rubygem-actionview:\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nSecurity Fix(es) in rubygem-activerecord:\n\n* A flaw was found in the way Active Record handled certain special values in dynamic finders and relations. If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application. (CVE-2016-6317)\n\nRed Hat would like to thank the Ruby on Rails project for reporting these issues. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter of CVE-2016-6316; and joernchen (Phenoelit) as the original reporter of CVE-2016-6317.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1855",
"url": "https://access.redhat.com/errata/RHSA-2016:1855"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "1365017",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365017"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1855.json"
}
],
"title": "Red Hat Security Advisory: rh-ror42 security update",
"tracking": {
"current_release_date": "2025-09-10T14:13:26+00:00",
"generator": {
"date": "2025-09-10T14:13:26+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.7"
}
},
"id": "RHSA-2016:1855",
"initial_release_date": "2016-09-13T11:09:39+00:00",
"revision_history": [
{
"date": "2016-09-13T11:09:39+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:09:39+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-09-10T14:13:26+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionview@4.2.6-3.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionview-doc@4.2.6-3.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-activerecord-doc@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-activerecord@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack-doc@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"product": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"product_id": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionview@4.2.6-3.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"product": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"product_id": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-activerecord@4.2.6-3.el7?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"product": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-3.el7?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:09:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1855"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
},
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"joernchen"
],
"organization": "Phenoelit",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6317",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365017"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the way Active Record handled certain special values in dynamic finders and relations. If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-activerecord: unsafe query generation in Active Record",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6317"
},
{
"category": "external",
"summary": "RHBZ#1365017",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365017"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6317",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6317"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6317",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6317"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/rgO20zYW33s/gmamLa-wDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/rgO20zYW33s/gmamLa-wDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:09:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1855"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-activerecord: unsafe query generation in Active Record"
}
]
}
rhsa-2016_1856
Vulnerability from csaf_redhat
Published
2016-09-13 11:08
Modified
2024-11-14 20:48
Summary
Red Hat Security Advisory: rh-ror41-rubygem-actionview security update
Notes
Topic
An update for rh-ror41-rubygem-actionview is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component.
Security Fix(es):
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for rh-ror41-rubygem-actionview is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component.\n\nSecurity Fix(es):\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nRed Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1856",
"url": "https://access.redhat.com/errata/RHSA-2016:1856"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1856.json"
}
],
"title": "Red Hat Security Advisory: rh-ror41-rubygem-actionview security update",
"tracking": {
"current_release_date": "2024-11-14T20:48:37+00:00",
"generator": {
"date": "2024-11-14T20:48:37+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:1856",
"initial_release_date": "2016-09-13T11:08:25+00:00",
"revision_history": [
{
"date": "2016-09-13T11:08:25+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:08:25+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T20:48:37+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"product_id": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview-doc@4.1.5-6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"product": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"product_id": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview-doc@4.1.5-6.el6?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"product": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"product_id": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror41-rubygem-actionview@4.1.5-6.el6?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src"
},
"product_reference": "rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
},
"product_reference": "rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:08:25+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running applications using rh-ror41-rubygem-actionviewmust be restarted for this update to take effect.",
"product_ids": [
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1856"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.6.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2-6.7.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.noarch",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el6.src",
"6Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Server-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-0:4.1.5-6.el7.src",
"7Workstation-RHSCL-2.2:rh-ror41-rubygem-actionview-doc-0:4.1.5-6.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
}
]
}
rhsa-2016:1857
Vulnerability from csaf_redhat
Published
2016-09-13 11:07
Modified
2025-09-10 14:13
Summary
Red Hat Security Advisory: ror40-rubygem-actionpack security update
Notes
Topic
An update for ror40-rubygem-actionpack is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.
Security Fix(es):
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for ror40-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nRed Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1857",
"url": "https://access.redhat.com/errata/RHSA-2016:1857"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1857.json"
}
],
"title": "Red Hat Security Advisory: ror40-rubygem-actionpack security update",
"tracking": {
"current_release_date": "2025-09-10T14:13:27+00:00",
"generator": {
"date": "2025-09-10T14:13:27+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.7"
}
},
"id": "RHSA-2016:1857",
"initial_release_date": "2016-09-13T11:07:09+00:00",
"revision_history": [
{
"date": "2016-09-13T11:07:09+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:07:09+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-09-10T14:13:27+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"product": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"product_id": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack-doc@4.0.2-8.el6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"product": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"product_id": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack-doc@4.0.2-8.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el7?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el6?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el7?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:07:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running applications using ror40-rubygem-actionpack must be restarted for this update to take effect.",
"product_ids": [
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1857"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
}
]
}
rhsa-2016_1857
Vulnerability from csaf_redhat
Published
2016-09-13 11:07
Modified
2024-11-14 20:48
Summary
Red Hat Security Advisory: ror40-rubygem-actionpack security update
Notes
Topic
An update for ror40-rubygem-actionpack is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.
Security Fix(es):
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for ror40-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nRed Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1857",
"url": "https://access.redhat.com/errata/RHSA-2016:1857"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1857.json"
}
],
"title": "Red Hat Security Advisory: ror40-rubygem-actionpack security update",
"tracking": {
"current_release_date": "2024-11-14T20:48:42+00:00",
"generator": {
"date": "2024-11-14T20:48:42+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2016:1857",
"initial_release_date": "2016-09-13T11:07:09+00:00",
"revision_history": [
{
"date": "2016-09-13T11:07:09+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:07:09+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-14T20:48:42+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"product": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"product_id": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack-doc@4.0.2-8.el6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"product": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"product_id": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack-doc@4.0.2-8.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el7?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el6?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"product": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"product_id": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ror40-rubygem-actionpack@4.0.2-8.el7?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src"
},
"product_reference": "ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
},
"product_reference": "ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:07:09+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running applications using ror40-rubygem-actionpack must be restarted for this update to take effect.",
"product_ids": [
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1857"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.noarch",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el6.src",
"6Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Server-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.noarch",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-1:4.0.2-8.el7.src",
"7Workstation-RHSCL-2.2:ror40-rubygem-actionpack-doc-1:4.0.2-8.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
}
]
}
rhsa-2016:1858
Vulnerability from csaf_redhat
Published
2016-09-13 11:05
Modified
2025-09-10 14:13
Summary
Red Hat Security Advisory: ruby193-rubygem-actionpack security update
Notes
Topic
An update for ruby193-rubygem-actionpack is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.
Security Fix(es):
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for ruby193-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.\n\nSecurity Fix(es):\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nRed Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1858",
"url": "https://access.redhat.com/errata/RHSA-2016:1858"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1858.json"
}
],
"title": "Red Hat Security Advisory: ruby193-rubygem-actionpack security update",
"tracking": {
"current_release_date": "2025-09-10T14:13:27+00:00",
"generator": {
"date": "2025-09-10T14:13:27+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.7"
}
},
"id": "RHSA-2016:1858",
"initial_release_date": "2016-09-13T11:05:54+00:00",
"revision_history": [
{
"date": "2016-09-13T11:05:54+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:05:54+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-09-10T14:13:27+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el7?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el6?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"product_id": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack-doc@3.2.8-20.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"product_id": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.8-20.el6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"product": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"product_id": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack-doc@3.2.8-20.el6?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.6)",
"product_id": "6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.6.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 6.7)",
"product_id": "6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2-6.7.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 6)",
"product_id": "6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 6)",
"product_id": "6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"relates_to_product_reference": "6Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src"
},
"product_reference": "ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
},
"product_reference": "ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:05:54+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258\n\nAll running applications using ruby193-rubygem-actionpack must be restarted for this update to take effect.",
"product_ids": [
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1858"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.6.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2-6.7.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.noarch",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el6.src",
"6Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el6.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.1.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2-7.2.Z:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Server-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.noarch",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-1:3.2.8-20.el7.src",
"7Workstation-RHSCL-2.2:ruby193-rubygem-actionpack-doc-1:3.2.8-20.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
}
]
}
rhsa-2016:1855
Vulnerability from csaf_redhat
Published
2016-09-13 11:09
Modified
2025-09-10 14:13
Summary
Red Hat Security Advisory: rh-ror42 security update
Notes
Topic
An update for rh-ror42-rubygem-actionview, rh-ror42-rubygem-activerecord, and rh-ror42-rubygem-actionpack is now available for Red Hat Software Collections.
Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.
Details
Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component, and Active Record implements the model component.
Security Fix(es) in rubygem-actionview:
* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)
Security Fix(es) in rubygem-activerecord:
* A flaw was found in the way Active Record handled certain special values in dynamic finders and relations. If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application. (CVE-2016-6317)
Red Hat would like to thank the Ruby on Rails project for reporting these issues. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter of CVE-2016-6316; and joernchen (Phenoelit) as the original reporter of CVE-2016-6317.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "An update for rh-ror42-rubygem-actionview, rh-ror42-rubygem-activerecord, and rh-ror42-rubygem-actionpack is now available for Red Hat Software Collections.\n\nRed Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action View implements the view component, and Active Record implements the model component.\n\nSecurity Fix(es) in rubygem-actionview:\n\n* It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)\n\nSecurity Fix(es) in rubygem-activerecord:\n\n* A flaw was found in the way Active Record handled certain special values in dynamic finders and relations. If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application. (CVE-2016-6317)\n\nRed Hat would like to thank the Ruby on Rails project for reporting these issues. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter of CVE-2016-6316; and joernchen (Phenoelit) as the original reporter of CVE-2016-6317.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2016:1855",
"url": "https://access.redhat.com/errata/RHSA-2016:1855"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "1365017",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365017"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_1855.json"
}
],
"title": "Red Hat Security Advisory: rh-ror42 security update",
"tracking": {
"current_release_date": "2025-09-10T14:13:26+00:00",
"generator": {
"date": "2025-09-10T14:13:26+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.7"
}
},
"id": "RHSA-2016:1855",
"initial_release_date": "2016-09-13T11:09:39+00:00",
"revision_history": [
{
"date": "2016-09-13T11:09:39+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2016-09-13T11:09:39+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-09-10T14:13:26+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
},
{
"category": "product_name",
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product": {
"name": "Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:rhel_software_collections:2::el7"
}
}
}
],
"category": "product_family",
"name": "Red Hat Software Collections"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionview@4.2.6-3.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionview-doc@4.2.6-3.el7?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-activerecord-doc@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-activerecord@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack-doc@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"product": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-3.el7?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"product": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"product_id": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionview@4.2.6-3.el7?arch=src"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"product": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"product_id": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-activerecord@4.2.6-3.el7?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"product": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"product_id": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rh-ror42-rubygem-actionpack@4.2.6-3.el7?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.1)",
"product_id": "7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.1.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server EUS (v. 7.2)",
"product_id": "7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2-7.2.Z"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Server (v. 7)",
"product_id": "7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Server-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src"
},
"product_reference": "rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch as a component of Red Hat Software Collections for Red Hat Enterprise Linux Workstation (v. 7)",
"product_id": "7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
},
"product_reference": "rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"relates_to_product_reference": "7Workstation-RHSCL-2.2"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"Andrew Carpenter"
],
"organization": "Critical Juncture",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6316",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365008"
}
],
"notes": [
{
"category": "description",
"text": "It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionview: cross-site scripting flaw in Action View",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "RHBZ#1365008",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365008"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6316",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6316"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/I-VWr034ouk/gGu2FrCwDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:09:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1855"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "LOW",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "CHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionview: cross-site scripting flaw in Action View"
},
{
"acknowledgments": [
{
"names": [
"the Ruby on Rails project"
]
},
{
"names": [
"joernchen"
],
"organization": "Phenoelit",
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2016-6317",
"cwe": {
"id": "CWE-20",
"name": "Improper Input Validation"
},
"discovery_date": "2016-08-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "1365017"
}
],
"notes": [
{
"category": "description",
"text": "A flaw was found in the way Active Record handled certain special values in dynamic finders and relations. If a Ruby on Rails application performed JSON parameter parsing, a remote attacker could possibly manipulate search conditions in SQL queries generated by the application.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-activerecord: unsafe query generation in Active Record",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2016-6317"
},
{
"category": "external",
"summary": "RHBZ#1365017",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=1365017"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2016-6317",
"url": "https://www.cve.org/CVERecord?id=CVE-2016-6317"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2016-6317",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6317"
},
{
"category": "external",
"summary": "https://groups.google.com/forum/#!msg/rubyonrails-security/rgO20zYW33s/gmamLa-wDAAJ",
"url": "https://groups.google.com/forum/#!msg/rubyonrails-security/rgO20zYW33s/gmamLa-wDAAJ"
}
],
"release_date": "2016-08-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2016-09-13T11:09:39+00:00",
"details": "For details on how to apply this update, which includes the changes described in this advisory, refer to:\n\nhttps://access.redhat.com/articles/11258",
"product_ids": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2016:1855"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 5.3,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.1.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2-7.2.Z:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Server-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionpack-doc-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-0:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-actionview-doc-0:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.noarch",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-1:4.2.6-3.el7.src",
"7Workstation-RHSCL-2.2:rh-ror42-rubygem-activerecord-doc-1:4.2.6-3.el7.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-activerecord: unsafe query generation in Active Record"
}
]
}
cnvd-2016-06329
Vulnerability from cnvd
Title: Ruby on Rails Action View跨站脚本漏洞
Description:
Ruby on Rails（Rails）是Rails核心团队开发维护的一套基于Ruby语言的开源Web应用框架，它是由大卫-海纳梅尔-韩森从美国37signals公司的项目管理工具Basecamp里分离出来的。Action View是其中的一个用于渲染视图并可以在任何Ruby代码库中使用的独立代码库。
Ruby on Rails Action View 3.0版本中存在跨站脚本漏洞，该漏洞源于程序未能充分过滤用户提交的输入。当用户浏览受影响的网站时，其浏览器将执行攻击者提供的任意脚本代码。
Severity: 中
Patch Name: Ruby on Rails Action View跨站脚本漏洞的补丁
Patch Description:
Ruby on Rails（Rails）是Rails核心团队开发维护的一套基于Ruby语言的开源Web应用框架，它是由大卫-海纳梅尔-韩森从美国37signals公司的项目管理工具Basecamp里分离出来的。Action View是其中的一个用于渲染视图并可以在任何Ruby代码库中使用的独立代码库。
Ruby on Rails Action View 3.0版本中存在跨站脚本漏洞，该漏洞源于程序未能充分过滤用户提交的输入。当用户浏览受影响的网站时，其浏览器将执行攻击者提供的任意脚本代码。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description:
目前厂商已经发布了升级补丁以修复此安全问题，详情请关注厂商主页： http://rubyonrails.org/
Reference: http://www.securityfocus.com/bid/92430
Impacted products
| Name | Ruby on Rails Action View 3.0 |
|---|
{
"bids": {
"bid": {
"bidNumber": "92430"
}
},
"cves": {
"cve": {
"cveNumber": "CVE-2016-6316"
}
},
"description": "Ruby on Rails\uff08Rails\uff09\u662fRails\u6838\u5fc3\u56e2\u961f\u5f00\u53d1\u7ef4\u62a4\u7684\u4e00\u5957\u57fa\u4e8eRuby\u8bed\u8a00\u7684\u5f00\u6e90Web\u5e94\u7528\u6846\u67b6\uff0c\u5b83\u662f\u7531\u5927\u536b-\u6d77\u7eb3\u6885\u5c14-\u97e9\u68ee\u4ece\u7f8e\u56fd37signals\u516c\u53f8\u7684\u9879\u76ee\u7ba1\u7406\u5de5\u5177Basecamp\u91cc\u5206\u79bb\u51fa\u6765\u7684\u3002Action View\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u7528\u4e8e\u6e32\u67d3\u89c6\u56fe\u5e76\u53ef\u4ee5\u5728\u4efb\u4f55Ruby\u4ee3\u7801\u5e93\u4e2d\u4f7f\u7528\u7684\u72ec\u7acb\u4ee3\u7801\u5e93\u3002\r\n\r\nRuby on Rails Action View 3.0\u7248\u672c\u4e2d\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u5145\u5206\u8fc7\u6ee4\u7528\u6237\u63d0\u4ea4\u7684\u8f93\u5165\u3002\u5f53\u7528\u6237\u6d4f\u89c8\u53d7\u5f71\u54cd\u7684\u7f51\u7ad9\u65f6\uff0c\u5176\u6d4f\u89c8\u5668\u5c06\u6267\u884c\u653b\u51fb\u8005\u63d0\u4f9b\u7684\u4efb\u610f\u811a\u672c\u4ee3\u7801\u3002",
"discovererName": "Andrew Carpenter of Critical Juncture.",
"formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u7ecf\u53d1\u5e03\u4e86\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6b64\u5b89\u5168\u95ee\u9898\uff0c\u8be6\u60c5\u8bf7\u5173\u6ce8\u5382\u5546\u4e3b\u9875\uff1a\r\nhttp://rubyonrails.org/",
"isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
"number": "CNVD-2016-06329",
"openTime": "2016-08-16",
"patchDescription": "Ruby on Rails\uff08Rails\uff09\u662fRails\u6838\u5fc3\u56e2\u961f\u5f00\u53d1\u7ef4\u62a4\u7684\u4e00\u5957\u57fa\u4e8eRuby\u8bed\u8a00\u7684\u5f00\u6e90Web\u5e94\u7528\u6846\u67b6\uff0c\u5b83\u662f\u7531\u5927\u536b-\u6d77\u7eb3\u6885\u5c14-\u97e9\u68ee\u4ece\u7f8e\u56fd37signals\u516c\u53f8\u7684\u9879\u76ee\u7ba1\u7406\u5de5\u5177Basecamp\u91cc\u5206\u79bb\u51fa\u6765\u7684\u3002Action View\u662f\u5176\u4e2d\u7684\u4e00\u4e2a\u7528\u4e8e\u6e32\u67d3\u89c6\u56fe\u5e76\u53ef\u4ee5\u5728\u4efb\u4f55Ruby\u4ee3\u7801\u5e93\u4e2d\u4f7f\u7528\u7684\u72ec\u7acb\u4ee3\u7801\u5e93\u3002\r\n\r\nRuby on Rails Action View 3.0\u7248\u672c\u4e2d\u5b58\u5728\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\uff0c\u8be5\u6f0f\u6d1e\u6e90\u4e8e\u7a0b\u5e8f\u672a\u80fd\u5145\u5206\u8fc7\u6ee4\u7528\u6237\u63d0\u4ea4\u7684\u8f93\u5165\u3002\u5f53\u7528\u6237\u6d4f\u89c8\u53d7\u5f71\u54cd\u7684\u7f51\u7ad9\u65f6\uff0c\u5176\u6d4f\u89c8\u5668\u5c06\u6267\u884c\u653b\u51fb\u8005\u63d0\u4f9b\u7684\u4efb\u610f\u811a\u672c\u4ee3\u7801\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
"patchName": "Ruby on Rails Action View\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e\u7684\u8865\u4e01",
"products": {
"product": "Ruby on Rails Action View 3.0"
},
"referenceLink": "http://www.securityfocus.com/bid/92430",
"serverity": "\u4e2d",
"submitTime": "2016-08-16",
"title": "Ruby on Rails Action View\u8de8\u7ad9\u811a\u672c\u6f0f\u6d1e"
}
ghsa-pc3m-v286-2jwj
Vulnerability from github
Published
2017-10-24 18:33
Modified
2023-01-23 17:59
Severity ?
VLAI Severity ?
Summary
actionview Cross-site Scripting vulnerability
Details
Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as "HTML safe" and used as attribute values in tag handlers.
{
"affected": [
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 3.2.22.2"
},
"package": {
"ecosystem": "RubyGems",
"name": "actionview"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0"
},
{
"fixed": "3.2.22.3"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"database_specific": {
"last_known_affected_version_range": "\u003c= 4.2.7"
},
"package": {
"ecosystem": "RubyGems",
"name": "actionview"
},
"ranges": [
{
"events": [
{
"introduced": "4.0.0"
},
{
"fixed": "4.2.7.1"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "actionview"
},
"ranges": [
{
"events": [
{
"introduced": "5.0.0"
},
{
"fixed": "5.0.0.1"
}
],
"type": "ECOSYSTEM"
}
],
"versions": [
"5.0.0"
]
}
],
"aliases": [
"CVE-2016-6316"
],
"database_specific": {
"cwe_ids": [
"CWE-79"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:48:48Z",
"nvd_published_at": "2016-09-07T19:28:10Z",
"severity": "MODERATE"
},
"details": "Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers.",
"id": "GHSA-pc3m-v286-2jwj",
"modified": "2023-01-23T17:59:42Z",
"published": "2017-10-24T18:33:35Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2016-6316"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-6316.yml"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#!topic/ruby-security-ann/8B2iV2tPRSE"
},
{
"type": "WEB",
"url": "https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200227202008/http://www.securityfocus.com/bid/92430"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20200812154343/https://puppet.com/security/cve/cve-2016-6316"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1855.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1856.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1857.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2016-1858.html"
},
{
"type": "WEB",
"url": "http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released"
},
{
"type": "WEB",
"url": "http://www.debian.org/security/2016/dsa-3651"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2016/08/11/3"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"type": "CVSS_V3"
}
],
"summary": "actionview Cross-site Scripting vulnerability"
}
suse-su-2017:2716-1
Vulnerability from csaf_suse
Published
2017-10-12 12:43
Modified
2017-10-12 12:43
Summary
Security update for the Ruby on Rails stack
Notes
Title of the patch
Security update for the Ruby on Rails stack
Description of the patch
This update brings version 4.2.9 of the Ruby on Rails stack to provide the latest fixes and
improvements from upstream.
The following security issues have been fixed by upstream:
rubygem-actionpack-4_2
- CVE-2016-2098: Action Pack in Ruby on Rails allowed remote attackers to execute arbitrary Ruby code by leveraging
an application's unrestricted use of the render method (bsc#968849).
rubygem-activerecord-4_2
- CVE-2016-6317: Action Record did not properly consider differences in parameter handling between the Active Record
component and the JSON implementation, which allowed remote attackers to bypass intended database-query restrictions
and perform NULL checks or trigger missing WHERE clauses via a crafted request (bsc#993313).
rubygem-actionview-4_2
- CVE-2016-6316: Cross-site scripting (XSS) vulnerability in Action View might have allowed remote attackers to inject
arbitrary web script or HTML via text declared as 'HTML safe' and used as attribute values in tag handlers
(bsc#993302).
Additionally, the following packages have been updated to version 4.2.9:
- rubygem-rails-4_2
- rubygem-railties-4_2
- rubygem-activesupport-4_2
- rubygem-activerecord-4_2
- rubygem-activejob-4_2
- rubygem-actionview-4_2
- rubygem-actionpack-4_2
- rubygem-actionmailer-4_2
Patchnames
SUSE-OpenStack-Cloud-6-2017-1679,SUSE-OpenStack-Cloud-7-2017-1679,SUSE-Storage-3-2017-1679,SUSE-Storage-4-2017-1679
Terms of use
CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).
{
"document": {
"aggregate_severity": {
"namespace": "https://www.suse.com/support/security/rating/",
"text": "moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright 2024 SUSE LLC. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Security update for the Ruby on Rails stack",
"title": "Title of the patch"
},
{
"category": "description",
"text": "This update brings version 4.2.9 of the Ruby on Rails stack to provide the latest fixes and\nimprovements from upstream.\n\nThe following security issues have been fixed by upstream:\n\nrubygem-actionpack-4_2\n\n- CVE-2016-2098: Action Pack in Ruby on Rails allowed remote attackers to execute arbitrary Ruby code by leveraging\n an application\u0027s unrestricted use of the render method (bsc#968849).\n\nrubygem-activerecord-4_2\n\n- CVE-2016-6317: Action Record did not properly consider differences in parameter handling between the Active Record\n component and the JSON implementation, which allowed remote attackers to bypass intended database-query restrictions\n and perform NULL checks or trigger missing WHERE clauses via a crafted request (bsc#993313).\n\nrubygem-actionview-4_2\n\n- CVE-2016-6316: Cross-site scripting (XSS) vulnerability in Action View might have allowed remote attackers to inject\n arbitrary web script or HTML via text declared as \u0027HTML safe\u0027 and used as attribute values in tag handlers\n (bsc#993302).\n\nAdditionally, the following packages have been updated to version 4.2.9:\n\n- rubygem-rails-4_2\n- rubygem-railties-4_2\n- rubygem-activesupport-4_2\n- rubygem-activerecord-4_2\n- rubygem-activejob-4_2\n- rubygem-actionview-4_2\n- rubygem-actionpack-4_2\n- rubygem-actionmailer-4_2",
"title": "Description of the patch"
},
{
"category": "details",
"text": "SUSE-OpenStack-Cloud-6-2017-1679,SUSE-OpenStack-Cloud-7-2017-1679,SUSE-Storage-3-2017-1679,SUSE-Storage-4-2017-1679",
"title": "Patchnames"
},
{
"category": "legal_disclaimer",
"text": "CSAF 2.0 data is provided by SUSE under the Creative Commons License 4.0 with Attribution (CC-BY-4.0).",
"title": "Terms of use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://www.suse.com/support/security/contact/",
"name": "SUSE Product Security Team",
"namespace": "https://www.suse.com/"
},
"references": [
{
"category": "external",
"summary": "SUSE ratings",
"url": "https://www.suse.com/support/security/rating/"
},
{
"category": "self",
"summary": "URL of this CSAF notice",
"url": "https://ftp.suse.com/pub/projects/security/csaf/suse-su-2017_2716-1.json"
},
{
"category": "self",
"summary": "URL for SUSE-SU-2017:2716-1",
"url": "https://www.suse.com/support/update/announcement/2017/suse-su-20172716-1/"
},
{
"category": "self",
"summary": "E-Mail link for SUSE-SU-2017:2716-1",
"url": "https://lists.suse.com/pipermail/sle-security-updates/2017-October/003293.html"
},
{
"category": "self",
"summary": "SUSE Bug 1055962",
"url": "https://bugzilla.suse.com/1055962"
},
{
"category": "self",
"summary": "SUSE Bug 968849",
"url": "https://bugzilla.suse.com/968849"
},
{
"category": "self",
"summary": "SUSE Bug 993302",
"url": "https://bugzilla.suse.com/993302"
},
{
"category": "self",
"summary": "SUSE Bug 993313",
"url": "https://bugzilla.suse.com/993313"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-2098 page",
"url": "https://www.suse.com/security/cve/CVE-2016-2098/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6316 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6316/"
},
{
"category": "self",
"summary": "SUSE CVE CVE-2016-6317 page",
"url": "https://www.suse.com/security/cve/CVE-2016-6317/"
}
],
"title": "Security update for the Ruby on Rails stack",
"tracking": {
"current_release_date": "2017-10-12T12:43:34Z",
"generator": {
"date": "2017-10-12T12:43:34Z",
"engine": {
"name": "cve-database.git:bin/generate-csaf.pl",
"version": "1"
}
},
"id": "SUSE-SU-2017:2716-1",
"initial_release_date": "2017-10-12T12:43:34Z",
"revision_history": [
{
"date": "2017-10-12T12:43:34Z",
"number": "1",
"summary": "Current version"
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_version",
"name": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"product": {
"name": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"product_id": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"product": {
"name": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"product_id": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"product": {
"name": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"product_id": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"product": {
"name": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"product_id": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"product": {
"name": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"product_id": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"product": {
"name": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"product_id": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"product": {
"name": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"product_id": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"product": {
"name": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"product_id": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"product": {
"name": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"product_id": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"product": {
"name": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"product_id": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64"
}
}
],
"category": "architecture",
"name": "aarch64"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.s390x",
"product": {
"name": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.s390x",
"product_id": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.s390x"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.s390x",
"product": {
"name": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.s390x",
"product_id": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.s390x"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.s390x",
"product": {
"name": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.s390x",
"product_id": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.s390x"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.s390x",
"product": {
"name": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.s390x",
"product_id": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.s390x"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.s390x",
"product": {
"name": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.s390x",
"product_id": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.s390x"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.s390x",
"product": {
"name": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.s390x",
"product_id": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.s390x"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.s390x",
"product": {
"name": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.s390x",
"product_id": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.s390x"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.s390x",
"product": {
"name": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.s390x",
"product_id": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.s390x"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.s390x",
"product": {
"name": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.s390x",
"product_id": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.s390x"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.s390x",
"product": {
"name": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.s390x",
"product_id": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.s390x"
}
}
],
"category": "architecture",
"name": "s390x"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"product": {
"name": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"product_id": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"product": {
"name": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"product_id": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"product": {
"name": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"product_id": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"product": {
"name": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"product_id": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"product": {
"name": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"product_id": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"product": {
"name": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"product_id": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"product": {
"name": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"product_id": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"product": {
"name": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"product_id": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"product": {
"name": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"product_id": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64"
}
},
{
"category": "product_version",
"name": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"product": {
"name": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"product_id": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64"
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_name",
"name": "SUSE OpenStack Cloud 6",
"product": {
"name": "SUSE OpenStack Cloud 6",
"product_id": "SUSE OpenStack Cloud 6",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-openstack-cloud:6"
}
}
},
{
"category": "product_name",
"name": "SUSE OpenStack Cloud 7",
"product": {
"name": "SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7",
"product_identification_helper": {
"cpe": "cpe:/o:suse:suse-openstack-cloud:7"
}
}
},
{
"category": "product_name",
"name": "SUSE Enterprise Storage 3",
"product": {
"name": "SUSE Enterprise Storage 3",
"product_id": "SUSE Enterprise Storage 3",
"product_identification_helper": {
"cpe": "cpe:/o:suse:ses:3"
}
}
},
{
"category": "product_name",
"name": "SUSE Enterprise Storage 4",
"product": {
"name": "SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4",
"product_identification_helper": {
"cpe": "cpe:/o:suse:ses:4"
}
}
}
],
"category": "product_family",
"name": "SUSE Linux Enterprise"
}
],
"category": "vendor",
"name": "SUSE"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64 as component of SUSE OpenStack Cloud 6",
"product_id": "SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64 as component of SUSE OpenStack Cloud 6",
"product_id": "SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64 as component of SUSE OpenStack Cloud 6",
"product_id": "SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64 as component of SUSE OpenStack Cloud 6",
"product_id": "SUSE OpenStack Cloud 6:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64 as component of SUSE OpenStack Cloud 6",
"product_id": "SUSE OpenStack Cloud 6:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64 as component of SUSE OpenStack Cloud 6",
"product_id": "SUSE OpenStack Cloud 6:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64 as component of SUSE OpenStack Cloud 6",
"product_id": "SUSE OpenStack Cloud 6:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64 as component of SUSE OpenStack Cloud 6",
"product_id": "SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64 as component of SUSE OpenStack Cloud 6",
"product_id": "SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64 as component of SUSE OpenStack Cloud 6",
"product_id": "SUSE OpenStack Cloud 6:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 6"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.s390x as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.s390x"
},
"product_reference": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.s390x",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.s390x as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.s390x"
},
"product_reference": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.s390x",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.s390x as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.s390x"
},
"product_reference": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.s390x",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.s390x as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.s390x"
},
"product_reference": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.s390x",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.s390x as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.s390x"
},
"product_reference": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.s390x",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.s390x as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.s390x"
},
"product_reference": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.s390x",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.s390x as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.s390x"
},
"product_reference": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.s390x",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.s390x as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.s390x"
},
"product_reference": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.s390x",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.s390x as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.s390x"
},
"product_reference": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.s390x",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.s390x as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.s390x"
},
"product_reference": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.s390x",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64 as component of SUSE OpenStack Cloud 7",
"product_id": "SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"relates_to_product_reference": "SUSE OpenStack Cloud 7"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64 as component of SUSE Enterprise Storage 3",
"product_id": "SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64 as component of SUSE Enterprise Storage 3",
"product_id": "SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64 as component of SUSE Enterprise Storage 3",
"product_id": "SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64 as component of SUSE Enterprise Storage 3",
"product_id": "SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64 as component of SUSE Enterprise Storage 3",
"product_id": "SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64 as component of SUSE Enterprise Storage 3",
"product_id": "SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64 as component of SUSE Enterprise Storage 3",
"product_id": "SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64 as component of SUSE Enterprise Storage 3",
"product_id": "SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64 as component of SUSE Enterprise Storage 3",
"product_id": "SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64 as component of SUSE Enterprise Storage 3",
"product_id": "SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64 as component of SUSE Enterprise Storage 3",
"product_id": "SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64 as component of SUSE Enterprise Storage 3",
"product_id": "SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64 as component of SUSE Enterprise Storage 3",
"product_id": "SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64 as component of SUSE Enterprise Storage 3",
"product_id": "SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64 as component of SUSE Enterprise Storage 3",
"product_id": "SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64 as component of SUSE Enterprise Storage 3",
"product_id": "SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64 as component of SUSE Enterprise Storage 3",
"product_id": "SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64 as component of SUSE Enterprise Storage 3",
"product_id": "SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64 as component of SUSE Enterprise Storage 3",
"product_id": "SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64 as component of SUSE Enterprise Storage 3",
"product_id": "SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 3"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64 as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64 as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64 as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64 as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64 as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64 as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64 as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64 as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64 as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64 as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64 as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64 as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64 as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64 as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64 as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64 as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64 as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64 as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64 as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64"
},
"product_reference": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64 as component of SUSE Enterprise Storage 4",
"product_id": "SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64"
},
"product_reference": "ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"relates_to_product_reference": "SUSE Enterprise Storage 4"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2016-2098",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-2098"
}
],
"notes": [
{
"category": "general",
"text": "Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application\u0027s unrestricted use of the render method.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-2098",
"url": "https://www.suse.com/security/cve/CVE-2016-2098"
},
{
"category": "external",
"summary": "SUSE Bug 968849 for CVE-2016-2098",
"url": "https://bugzilla.suse.com/968849"
},
{
"category": "external",
"summary": "SUSE Bug 969943 for CVE-2016-2098",
"url": "https://bugzilla.suse.com/969943"
},
{
"category": "external",
"summary": "SUSE Bug 993313 for CVE-2016-2098",
"url": "https://bugzilla.suse.com/993313"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.3,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L",
"version": "3.0"
},
"products": [
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-10-12T12:43:34Z",
"details": "important"
}
],
"title": "CVE-2016-2098"
},
{
"cve": "CVE-2016-6316",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6316"
}
],
"notes": [
{
"category": "general",
"text": "Cross-site scripting (XSS) vulnerability in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1 might allow remote attackers to inject arbitrary web script or HTML via text declared as \"HTML safe\" and used as attribute values in tag handlers.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6316",
"url": "https://www.suse.com/security/cve/CVE-2016-6316"
},
{
"category": "external",
"summary": "SUSE Bug 993302 for CVE-2016-6316",
"url": "https://bugzilla.suse.com/993302"
},
{
"category": "external",
"summary": "SUSE Bug 993313 for CVE-2016-6316",
"url": "https://bugzilla.suse.com/993313"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 6.1,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N",
"version": "3.0"
},
"products": [
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-10-12T12:43:34Z",
"details": "moderate"
}
],
"title": "CVE-2016-6316"
},
{
"cve": "CVE-2016-6317",
"ids": [
{
"system_name": "SUSE CVE Page",
"text": "https://www.suse.com/security/cve/CVE-2016-6317"
}
],
"notes": [
{
"category": "general",
"text": "Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain \"[nil]\" values, a related issue to CVE-2012-2660, CVE-2012-2694, and CVE-2013-0155.",
"title": "CVE description"
}
],
"product_status": {
"recommended": [
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64"
]
},
"references": [
{
"category": "external",
"summary": "CVE-2016-6317",
"url": "https://www.suse.com/security/cve/CVE-2016-6317"
},
{
"category": "external",
"summary": "SUSE Bug 993313 for CVE-2016-6317",
"url": "https://bugzilla.suse.com/993313"
}
],
"remediations": [
{
"category": "vendor_fix",
"details": "To install this SUSE Security Update use the SUSE recommended installation methods like YaST online_update or \"zypper patch\".\n",
"product_ids": [
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64"
]
}
],
"scores": [
{
"cvss_v3": {
"baseScore": 7.5,
"baseSeverity": "HIGH",
"vectorString": "CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N",
"version": "3.0"
},
"products": [
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 3:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE Enterprise Storage 4:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE OpenStack Cloud 6:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionmailer-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionpack-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-actionview-4_2-4.2.9-9.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activejob-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activemodel-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activerecord-4_2-4.2.9-6.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-activesupport-4_2-4.2.9-7.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-4_2-4.2.9-3.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-rails-html-sanitizer-1.0.3-8.3.1.x86_64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.aarch64",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.s390x",
"SUSE OpenStack Cloud 7:ruby2.1-rubygem-railties-4_2-4.2.9-3.3.1.x86_64"
]
}
],
"threats": [
{
"category": "impact",
"date": "2017-10-12T12:43:34Z",
"details": "moderate"
}
],
"title": "CVE-2016-6317"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…