Information disclosure in actionpack - CVE-2020-8164
Published: May 26, 2020
Vulnerability identifier: #VU28243
CSH Severity: Medium
CVSS v4: 6.9 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:N/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2020-8164
CWE-ID: CWE-200
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to gain access to potentially sensitive information.
The vulnerability exists due to excessive data output by the application in the return value of "each", or "each_value", or "each_pair" will return the underlying "untrusted" hash of data that was read from the parameters. A remote attacker can gain unauthorized access to sensitive information on the system.
Affected software
actionpack
rails (Debian package)
SUSE Linux
Opensuse
rails (Debian package)
SUSE Linux
Opensuse
How to mitigate CVE-2020-8164
Install updates from vendor's website.
actionpack - addressed in versions 5.2.4.3, 6.0.3.1
rails (Debian package) - update to 5.2.2.1+dfsg-1+deb10u2
rails (Debian package) - update to 5.2.2.1+dfsg-1+deb10u2