CVE-2016-2098

RubyGems/actionpack CVE-2016-2098: high 7.3

actionpack allows remote code execution via application's unrestricted use of render method

Action: Upgrade actionpack to 3.2.22.2 or later.

bundle update actionpack

Affected

Fixed versions

Sources

• osv: GHSA-78rc-8c29-p45g
• https://nvd.nist.gov/vuln/detail/CVE-2016-2098
• https://github.com/rails/rails
• https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-2098.yml
• https://groups.google.com/forum/#!topic/rubyonrails-security/ly-IH-fxr_Q
• https://web.archive.org/web/20200228015318/http://www.securityfocus.com/bid/83725
• https://web.archive.org/web/20210612214217/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ
• https://web.archive.org/web/20211205173437/https://securitytracker.com/id/1035122
• https://www.exploit-db.com/exploits/40086
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00057.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html
• http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00086.html
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html
• http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html
• http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released
• http://www.debian.org/security/2016/dsa-3509

CVE-2016-2098 · published 2017-10-24T18:33:35Z · modified 2024-02-20T05:23:27.150669Z · JSON