rpm package
suse/rubygem-actionpack-5_1&distro=SUSE Linux Enterprise High Availability Extension 15 SP2
pkg:rpm/suse/rubygem-actionpack-5_1&distro=SUSE%20Linux%20Enterprise%20High%20Availability%20Extension%2015%20SP2
Vulnerabilities (8)
| CVE | Sev | CVSS | KEV | Affected versions | Fixed in | Published | Description |
|---|---|---|---|---|---|---|---|
| CVE-2023-28362 | Med | 4.0 | < 5.1.4-150000.3.18.1 | 5.1.4-150000.3.18.1 | Jan 9, 2025 | The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header. | |
| CVE-2023-22795 | — | < 5.1.4-150000.3.15.1 | 5.1.4-150000.3.15.1 | Feb 9, 2023 | A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Rub | ||
| CVE-2023-22792 | — | < 5.1.4-150000.3.15.1 | 5.1.4-150000.3.15.1 | Feb 9, 2023 | A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This | ||
| CVE-2022-23633 | — | < 5.1.4-150000.3.12.1 | 5.1.4-150000.3.12.1 | Feb 11, 2022 | Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next reques | ||
| CVE-2021-22904 | — | < 5.1.4-150000.3.12.1 | 5.1.4-150000.3.12.1 | Jun 11, 2021 | The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token` | ||
| CVE-2021-22885 | — | < 5.1.4-3.9.1 | 5.1.4-3.9.1 | May 27, 2021 | A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input. | ||
| CVE-2020-8166 | Med | 4.3 | < 5.1.4-150000.3.29.1 | 5.1.4-150000.3.29.1 | Jul 2, 2020 | A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token. | |
| CVE-2020-8164 | — | < 5.1.4-3.6.1 | 5.1.4-3.6.1 | Jun 19, 2020 | A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters. |
- affected < 5.1.4-150000.3.18.1fixed 5.1.4-150000.3.18.1
The redirect_to method in Rails allows provided values to contain characters which are not legal in an HTTP header value. This results in the potential for downstream services which enforce RFC compliance on HTTP response headers to remove the assigned Location header.
- CVE-2023-22795Feb 9, 2023affected < 5.1.4-150000.3.15.1fixed 5.1.4-150000.3.15.1
A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Rub
- CVE-2023-22792Feb 9, 2023affected < 5.1.4-150000.3.15.1fixed 5.1.4-150000.3.15.1
A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This
- CVE-2022-23633Feb 11, 2022affected < 5.1.4-150000.3.12.1fixed 5.1.4-150000.3.12.1
Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local state for the next reques
- CVE-2021-22904Jun 11, 2021affected < 5.1.4-150000.3.12.1fixed 5.1.4-150000.3.12.1
The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_request_with_http_token`
- CVE-2021-22885May 27, 2021affected < 5.1.4-3.9.1fixed 5.1.4-3.9.1
A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input.
- affected < 5.1.4-150000.3.29.1fixed 5.1.4-150000.3.29.1
A CSRF forgery vulnerability exists in rails < 5.2.5, rails < 6.0.4 that makes it possible for an attacker to, given a global CSRF token such as the one present in the authenticity_token meta tag, forge a per-form CSRF token.
- CVE-2020-8164Jun 19, 2020affected < 5.1.4-3.6.1fixed 5.1.4-3.6.1
A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters.