Fedora 25 update for rubygem-actioncable, rubygem-actionmailer, rubygem-actionpack, rubygem-actionview, rubygem-activejob, rubygem-activemodel, rubygem-activerecord, rubygem-activesupport, rubygem-rails, rubygem-railties



| Updated: 2025-04-24
Risk Low
Patch available YES
Number of vulnerabilities 2
CVE-ID CVE-2016-6317
CVE-2016-6316
CWE-ID CWE-20
CWE-79
Exploitation vector Network
Public exploit N/A
Vulnerable software
 Fedora
Operating systems & Components / Operating system

rubygem-railties
Operating systems & Components / Operating system package or component

rubygem-rails
Operating systems & Components / Operating system package or component

rubygem-activesupport
Operating systems & Components / Operating system package or component

rubygem-activerecord
Operating systems & Components / Operating system package or component

rubygem-activemodel
Operating systems & Components / Operating system package or component

rubygem-activejob
Operating systems & Components / Operating system package or component

rubygem-actionview
Operating systems & Components / Operating system package or component

rubygem-actionpack
Operating systems & Components / Operating system package or component

rubygem-actionmailer
Operating systems & Components / Operating system package or component

rubygem-actioncable
Operating systems & Components / Operating system package or component

Vendor Fedoraproject

Security Bulletin

This security bulletin contains information about 2 vulnerabilities.

1) Security restrictions bypass

EUVDB-ID: #VU8576

Risk: Low

CVSSv4.0: 2.7 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:L/VI:N/VA:N/SC:N/SI:N/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-6317

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote attacker to bypass certain security restrictions.

Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 25

rubygem-railties: before 5.0.0.1-2.fc25

rubygem-rails: before 5.0.0.1-1.fc25

rubygem-activesupport: before 5.0.0.1-1.fc25

rubygem-activerecord: before 5.0.0.1-1.fc25

rubygem-activemodel: before 5.0.0.1-1.fc25

rubygem-activejob: before 5.0.0.1-1.fc25

rubygem-actionview: before 5.0.0.1-2.fc25

rubygem-actionpack: before 5.0.0.1-2.fc25

rubygem-actionmailer: before 5.0.0.1-1.fc25

rubygem-actioncable: before 5.0.0.1-1.fc25

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2016-5760339e76


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.

2) Cross-site scripting

EUVDB-ID: #VU8575

Risk: Low

CVSSv4.0: 1.2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:U/U:Clear]

CVE-ID: CVE-2016-6316

CWE-ID: CWE-79 - Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Exploit availability: No

Description

Vulnerability allows a remote attacker to perform XSS attacks.

The vulnerability is caused by an input validation error in Action View in Ruby on Rails 3.x before 3.2.22.3, 4.x before 4.2.7.1, and 5.x before 5.0.0.1. A remote authenticated attacker can trick the victim to follow a specially specially crafted link and execute arbitrary HTML and script code in victim's browser in security context of vulnerable website.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's repository.

Vulnerable software versions

Fedora: 25

rubygem-railties: before 5.0.0.1-2.fc25

rubygem-rails: before 5.0.0.1-1.fc25

rubygem-activesupport: before 5.0.0.1-1.fc25

rubygem-activerecord: before 5.0.0.1-1.fc25

rubygem-activemodel: before 5.0.0.1-1.fc25

rubygem-activejob: before 5.0.0.1-1.fc25

rubygem-actionview: before 5.0.0.1-2.fc25

rubygem-actionpack: before 5.0.0.1-2.fc25

rubygem-actionmailer: before 5.0.0.1-1.fc25

rubygem-actioncable: before 5.0.0.1-1.fc25

CPE2.3 External links

https://bodhi.fedoraproject.org/updates/FEDORA-2016-5760339e76


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.



###SIDEBAR###