CVE-2020-8185
1 advisory.
RubyGems/actionpack CVE-2020-8185: medium 6.5
Untrusted users can run pending migrations in production in Rails
Action: Upgrade actionpack to 6.0.3.2 or later.
bundle update actionpackAffected
| introduced | fixed | last affected |
|---|---|---|
| 6.0.0 | 6.0.3.2 | - |
Fixed versions
| 6.0.3.2 |
Sources
- osv: GHSA-c6qr-h5vq-59jc
- https://nvd.nist.gov/vuln/detail/CVE-2020-8185
- https://github.com/rails/rails/commit/2121b9d20b60ed503aa041ef7b926d331ed79fc2
- https://hackerone.com/reports/899069
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2020-8185.yml
- https://groups.google.com/g/rubyonrails-security/c/pAe9EV8gbM0
- https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/XJ7NUWXAEVRQCROIIBV4C6WXO6IR3KSB
CVE-2020-8185 · published · modified · JSON