{"action":"Upgrade railties to 5.2.2.1 or later.","affected":[{"fixed":"5.2.2.1","introduced":"5.2.0"}],"component":"railties","cve_ids":["CVE-2019-5420"],"ecosystem":"RubyGems","epss":0.8933,"exploited":false,"fixed_versions":["5.2.2.1"],"ghsa_id":"GHSA-m42h-mh85-4qgc","id":"tcs_01M5KEM3RR59QP019DDCR8W838","modified_at":"2024-02-22T05:42:03.074508Z","published_at":"2019-03-13T17:28:35Z","references":["https://osv.dev/vulnerability/GHSA-m42h-mh85-4qgc","https://nvd.nist.gov/vuln/detail/CVE-2019-5420","https://github.com/rubysec/ruby-advisory-db/blob/master/gems/railties/CVE-2019-5420.yml","https://groups.google.com/forum/#!topic/rubyonrails-security/IsQKvDqZdKw","https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/message/Y43636TH4D6T46IC6N2RQVJTRFJAAYGA","https://weblog.rubyonrails.org/2019/3/13/Rails-4-2-5-1-5-1-6-2-have-been-released","https://www.exploit-db.com/exploits/46785","http://packetstormsecurity.com/files/152704/Ruby-On-Rails-DoubleTap-Development-Mode-secret_key_base-Remote-Code-Execution.html"],"severity":{"label":"critical","score":9.8},"sources":[{"source":"osv","source_id":"GHSA-m42h-mh85-4qgc","url":"https://osv.dev/vulnerability/GHSA-m42h-mh85-4qgc"}],"summary":"Use of Insufficiently Random Values in Railties Allows Remote Code Execution"}