rpm package
suse/rubygem-actionpack-4_2&distro=SUSE OpenStack Cloud Crowbar 8
pkg:rpm/suse/rubygem-actionpack-4_2&distro=SUSE%20OpenStack%20Cloud%20Crowbar%208
Vulnerabilities (7)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-28362 | Med | 4.0 | < 4.2.9-7.18.1 | 4.2.9-7.18.1 | Jan 9, 2025 | The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header. | |
| CVE-2023-22795 | — | < 4.2.9-7.15.1 | 4.2.9-7.15.1 | Feb 9, 2023 | A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Rub | ||
| CVE-2023-22792 | — | < 4.2.9-7.15.1 | 4.2.9-7.15.1 | Feb 9, 2023 | A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This | ||
| CVE-2021-22885 | — | < 4.2.9-7.12.1 | 4.2.9-7.12.1 | May 27, 2021 | A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input. | ||
| CVE-2019-16782 | — | < 4.2.9-7.9.1 | 4.2.9-7.9.1 | Dec 18, 2019 | There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually store | ||
| CVE-2019-5419 | — | < 4.2.9-7.6.1 | 4.2.9-7.6.1 | Mar 27, 2019 | There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive. | ||
| CVE-2019-5418 | — | KEV | < 4.2.9-7.6.1 | 4.2.9-7.6.1 | Mar 27, 2019 | There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed. |
- affected < 4.2.9-7.18.1fixed 4.2.9-7.18.1
The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.
- CVE-2023-22795Feb 9, 2023affected < 4.2.9-7.15.1fixed 4.2.9-7.15.1
A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Rub
- CVE-2023-22792Feb 9, 2023affected < 4.2.9-7.15.1fixed 4.2.9-7.15.1
A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This
- CVE-2021-22885May 27, 2021affected < 4.2.9-7.12.1fixed 4.2.9-7.12.1
A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input.
- CVE-2019-16782Dec 18, 2019affected < 4.2.9-7.9.1fixed 4.2.9-7.9.1
There's a possible information leak / session hijack vulnerability in Rack (RubyGem rack). This vulnerability is patched in versions 1.6.12 and 2.0.8. Attackers may be able to find and hijack sessions by using timing attacks targeting the session id. Session ids are usually store
- CVE-2019-5419Mar 27, 2019affected < 4.2.9-7.6.1fixed 4.2.9-7.6.1
There is a possible denial of service vulnerability in Action View (Rails) <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 where specially crafted accept headers can cause action view to consume 100% cpu and make the server unresponsive.
- affected < 4.2.9-7.6.1fixed 4.2.9-7.6.1
There is a File Content Disclosure vulnerability in Action View <5.2.2.1, <5.1.6.2, <5.0.7.2, <4.2.11.1 and v3 where specially crafted accept headers can cause contents of arbitrary files on the target system's filesystem to be exposed.