{ "document": { "aggregate_severity": { "namespace": "https://access.redhat.com/security/updates/classification/", "text": "Important" }, "category": "csaf_security_advisory", "csaf_version": "2.0", "distribution": { "text": "Copyright © Red Hat, Inc. All rights reserved.", "tlp": { "label": "WHITE", "url": "https://www.first.org/tlp/" } }, "lang": "en", "notes": [ { "category": "summary", "text": "Updated Subscription Asset Manager 1.4 packages that fix multiple security\nissues are now available.\n\nRed Hat Product Security has rated this update as having Important security\nimpact. Common Vulnerability Scoring System (CVSS) base scores, which give\ndetailed severity ratings, are available for each vulnerability from the\nCVE links in the References section.", "title": "Topic" }, { "category": "general", "text": "Red Hat Subscription Asset Manager acts as a proxy for handling\nsubscription information and software updates on client machines. Red Hat\nSubscription Asset Manager is built on Ruby on Rails, a\nmodel-view-controller (MVC) framework for web application development.\nAction Pack implements the controller and the view components.\n\nA directory traversal flaw was found in the way Ruby on Rails handled\nwildcard segments in routes with implicit rendering. A remote attacker\ncould use this flaw to retrieve arbitrary local files accessible to a Ruby\non Rails application using the aforementioned routes via a specially\ncrafted request. (CVE-2014-0130)\n\nA flaw was found in the way Ruby on Rails handled hashes in certain\nqueries. A remote attacker could use this flaw to perform a denial of\nservice (resource consumption) attack by sending specially crafted queries\nthat would result in the creation of Ruby symbols, which were never garbage\ncollected. (CVE-2013-1854)\n\nTwo cross-site scripting (XSS) flaws were found in Action Pack. A remote\nattacker could use these flaws to conduct XSS attacks against users of an\napplication using Action Pack. (CVE-2013-1855, CVE-2013-1857)\n\nIt was discovered that the internationalization component of Ruby on Rails\ncould, under certain circumstances, return a fallback HTML string that\ncontained user input. A remote attacker could possibly use this flaw to\nperform a reflective cross-site scripting (XSS) attack by providing a\nspecially crafted input to an application using the aforementioned\ncomponent. (CVE-2013-4491)\n\nA denial of service flaw was found in the header handling component of\nAction View. A remote attacker could send strings in specially crafted\nheaders that would be cached indefinitely, which would result in all\navailable system memory eventually being consumed. (CVE-2013-6414)\n\nIt was found that the number_to_currency Action View helper did not\nproperly escape the unit parameter. An attacker could use this flaw to\nperform a cross-site scripting (XSS) attack on an application that uses\ndata submitted by a user in the unit parameter. (CVE-2013-6415)\n\nRed Hat would like to thank Ruby on Rails upstream for reporting these\nissues. Upstream acknowledges Ben Murphy as the original reporter of\nCVE-2013-1854, Charlie Somerville as the original reporter of\nCVE-2013-1855, Alan Jenkins as the original reporter of CVE-2013-1857,\nPeter McLarnan as the original reporter of CVE-2013-4491, Toby Hsieh as the\noriginal reporter of CVE-2013-6414, and Ankit Gupta as the original\nreporter of CVE-2013-6415.\n\nAll Subscription Asset Manager users are advised to upgrade to these\nupdated packages, which contain backported patches to correct these issues.", "title": "Details" }, { "category": "legal_disclaimer", "text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.", "title": "Terms of Use" } ], "publisher": { "category": "vendor", "contact_details": "https://access.redhat.com/security/team/contact/", "issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.", "name": "Red Hat Product Security", "namespace": "https://www.redhat.com" }, "references": [ { "category": "self", "summary": "https://access.redhat.com/errata/RHSA-2014:1863", "url": "https://access.redhat.com/errata/RHSA-2014:1863" }, { "category": "external", "summary": "https://access.redhat.com/security/updates/classification/#important", "url": "https://access.redhat.com/security/updates/classification/#important" }, { "category": "external", "summary": "921329", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=921329" }, { "category": "external", "summary": "921331", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=921331" }, { "category": "external", "summary": "921335", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=921335" }, { "category": "external", "summary": "1036483", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1036483" }, { "category": "external", "summary": "1036910", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1036910" }, { "category": "external", "summary": "1036922", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1036922" }, { "category": "external", "summary": "1095105", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1095105" }, { "category": "self", "summary": "Canonical URL", "url": "https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_1863.json" } ], "title": "Red Hat Security Advisory: Subscription Asset Manager 1.4 security update", "tracking": { "current_release_date": "2026-06-28T12:09:18+00:00", "generator": { "date": "2026-06-28T12:09:18+00:00", "engine": { "name": "Red Hat SDEngine", "version": "5.2.6" } }, "id": "RHSA-2014:1863", "initial_release_date": "2014-11-17T17:08:19+00:00", "revision_history": [ { "date": "2014-11-17T17:08:19+00:00", "number": "1", "summary": "Initial version" }, { "date": "2014-11-17T17:08:19+00:00", "number": "2", "summary": "Last updated version" }, { "date": "2026-06-28T12:09:18+00:00", "number": "3", "summary": "Last generated version" } ], "status": "final", "version": "3" } }, "product_tree": { "branches": [ { "branches": [ { "branches": [ { "category": "product_name", "name": "Red Hat Subscription Asset Manager for RHEL 6 Server", "product": { "name": "Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14", "product_identification_helper": { "cpe": "cpe:/a:rhel_sam:1.4::el6" } } } ], "category": "product_family", "name": "Red Hat Subscription Asset Manager" }, { "branches": [ { "category": "product_version", "name": "ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "product": { "name": "ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "product_id": "ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-activemodel@3.2.17-1.el6sam?arch=src&epoch=1" } } }, { "category": "product_version", "name": "ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "product": { "name": "ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "product_id": "ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-activeresource@3.2.17-1.el6sam?arch=src&epoch=1" } } }, { "category": "product_version", "name": "ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "product": { "name": "ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "product_id": "ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-actionmailer@3.2.17-1.el6sam?arch=src&epoch=1" } } }, { "category": "product_version", "name": "ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "product": { "name": "ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "product_id": "ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.17-6.el6sam?arch=src&epoch=1" } } }, { "category": "product_version", "name": "ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "product": { "name": "ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "product_id": "ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-rails@3.2.17-1.el6sam?arch=src&epoch=1" } } }, { "category": "product_version", "name": "ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "product": { "name": "ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "product_id": "ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-rack@1.4.5-3.el6sam?arch=src&epoch=1" } } }, { "category": "product_version", "name": "ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "product": { "name": "ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "product_id": "ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-mail@2.5.4-1.el6sam?arch=src" } } }, { "category": "product_version", "name": "ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "product": { "name": "ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "product_id": "ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-i18n@0.6.9-1.el6sam?arch=src" } } }, { "category": "product_version", "name": "ruby193-rubygem-railties-1:3.2.17-1.el6sam.src", "product": { "name": "ruby193-rubygem-railties-1:3.2.17-1.el6sam.src", "product_id": "ruby193-rubygem-railties-1:3.2.17-1.el6sam.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-railties@3.2.17-1.el6sam?arch=src&epoch=1" } } }, { "category": "product_version", "name": "ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "product": { "name": "ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "product_id": "ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-activesupport@3.2.17-2.el6sam?arch=src&epoch=1" } } }, { "category": "product_version", "name": "ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "product": { "name": "ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "product_id": "ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-activerecord@3.2.17-5.el6sam?arch=src&epoch=1" } } }, { "category": "product_version", "name": "katello-0:1.4.3.28-1.el6sam_splice.src", "product": { "name": "katello-0:1.4.3.28-1.el6sam_splice.src", "product_id": "katello-0:1.4.3.28-1.el6sam_splice.src", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello@1.4.3.28-1.el6sam_splice?arch=src" } } } ], "category": "architecture", "name": "src" }, { "branches": [ { "category": "product_version", "name": "ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "product": { "name": "ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "product_id": "ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-activemodel@3.2.17-1.el6sam?arch=noarch&epoch=1" } } }, { "category": "product_version", "name": "ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "product": { "name": "ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "product_id": "ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-activeresource@3.2.17-1.el6sam?arch=noarch&epoch=1" } } }, { "category": "product_version", "name": "ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "product": { "name": "ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "product_id": "ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-actionmailer@3.2.17-1.el6sam?arch=noarch&epoch=1" } } }, { "category": "product_version", "name": "ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "product": { "name": "ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "product_id": "ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-actionpack@3.2.17-6.el6sam?arch=noarch&epoch=1" } } }, { "category": "product_version", "name": "ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "product": { "name": "ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "product_id": "ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-rails@3.2.17-1.el6sam?arch=noarch&epoch=1" } } }, { "category": "product_version", "name": "ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "product": { "name": "ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "product_id": "ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-rack@1.4.5-3.el6sam?arch=noarch&epoch=1" } } }, { "category": "product_version", "name": "ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "product": { "name": "ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "product_id": "ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-mail@2.5.4-1.el6sam?arch=noarch" } } }, { "category": "product_version", "name": "ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "product": { "name": "ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "product_id": "ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-i18n@0.6.9-1.el6sam?arch=noarch" } } }, { "category": "product_version", "name": "ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "product": { "name": "ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "product_id": "ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-railties@3.2.17-1.el6sam?arch=noarch&epoch=1" } } }, { "category": "product_version", "name": "ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "product": { "name": "ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "product_id": "ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-activesupport@3.2.17-2.el6sam?arch=noarch&epoch=1" } } }, { "category": "product_version", "name": "ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "product": { "name": "ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "product_id": "ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/ruby193-rubygem-activerecord@3.2.17-5.el6sam?arch=noarch&epoch=1" } } }, { "category": "product_version", "name": "katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "product": { "name": "katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "product_id": "katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-headpin-all@1.4.3.28-1.el6sam_splice?arch=noarch" } } }, { "category": "product_version", "name": "katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "product": { "name": "katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "product_id": "katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-common@1.4.3.28-1.el6sam_splice?arch=noarch" } } }, { "category": "product_version", "name": "katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "product": { "name": "katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "product_id": "katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-headpin@1.4.3.28-1.el6sam_splice?arch=noarch" } } }, { "category": "product_version", "name": "katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "product": { "name": "katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "product_id": "katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-glue-candlepin@1.4.3.28-1.el6sam_splice?arch=noarch" } } }, { "category": "product_version", "name": "katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "product": { "name": "katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "product_id": "katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "product_identification_helper": { "purl": "pkg:rpm/redhat/katello-glue-elasticsearch@1.4.3.28-1.el6sam_splice?arch=noarch" } } } ], "category": "architecture", "name": "noarch" } ], "category": "vendor", "name": "Red Hat" } ], "relationships": [ { "category": "default_component_of", "full_product_name": { "name": "katello-0:1.4.3.28-1.el6sam_splice.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src" }, "product_reference": "katello-0:1.4.3.28-1.el6sam_splice.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "katello-common-0:1.4.3.28-1.el6sam_splice.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch" }, "product_reference": "katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch" }, "product_reference": "katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch" }, "product_reference": "katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch" }, "product_reference": "katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch" }, "product_reference": "katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch" }, "product_reference": "ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src" }, "product_reference": "ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch" }, "product_reference": "ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src" }, "product_reference": "ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch" }, "product_reference": "ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src" }, "product_reference": "ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch" }, "product_reference": "ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src" }, "product_reference": "ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch" }, "product_reference": "ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src" }, "product_reference": "ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch" }, "product_reference": "ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src" }, "product_reference": "ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch" }, "product_reference": "ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src" }, "product_reference": "ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch" }, "product_reference": "ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-mail-0:2.5.4-1.el6sam.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src" }, "product_reference": "ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch" }, "product_reference": "ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-rack-1:1.4.5-3.el6sam.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src" }, "product_reference": "ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch" }, "product_reference": "ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-rails-1:3.2.17-1.el6sam.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src" }, "product_reference": "ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch" }, "product_reference": "ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" }, { "category": "default_component_of", "full_product_name": { "name": "ruby193-rubygem-railties-1:3.2.17-1.el6sam.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server", "product_id": "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src" }, "product_reference": "ruby193-rubygem-railties-1:3.2.17-1.el6sam.src", "relates_to_product_reference": "6Server-SubscriptionAssetManager14" } ] }, "vulnerabilities": [ { "acknowledgments": [ { "names": [ "Ruby on Rails upstream" ] }, { "names": [ "Ben Murphy" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2013-1854", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2013-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "921329" } ], "notes": [ { "category": "description", "text": "A flaw was found in the way Ruby on Rails handled hashes in certain queries. A remote attacker could use this flaw to perform a denial of service (resource consumption) attack by sending specially crafted queries that would result in the creation of Ruby symbols, which were never garbage collected.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-activerecord: attribute_dos Symbol DoS vulnerability", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src", "6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-1854" }, { "category": "external", "summary": "RHBZ#921329", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=921329" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-1854", "url": "https://www.cve.org/CVERecord?id=CVE-2013-1854" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-1854", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1854" } ], "release_date": "2013-03-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2014-11-17T17:08:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src", "6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2014:1863" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P", "version": "2.0" }, "products": [ "6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src", "6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-activerecord: attribute_dos Symbol DoS vulnerability" }, { "acknowledgments": [ { "names": [ "Ruby on Rails upstream" ] }, { "names": [ "Charlie Somerville" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2013-1855", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "discovery_date": "2013-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "921331" } ], "notes": [ { "category": "description", "text": "A cross-site scripting (XSS) flaw was found in Action Pack. A remote attacker could use this flaw to conduct XSS attacks against users of an application using Action Pack.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-actionpack: css_sanitization: XSS vulnerability in sanitize_css", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src", "6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-1855" }, { "category": "external", "summary": "RHBZ#921331", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=921331" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-1855", "url": "https://www.cve.org/CVERecord?id=CVE-2013-1855" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-1855", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1855" } ], "release_date": "2013-03-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2014-11-17T17:08:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src", "6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2014:1863" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "products": [ "6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src", "6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-actionpack: css_sanitization: XSS vulnerability in sanitize_css" }, { "acknowledgments": [ { "names": [ "Ruby on Rails upstream" ] }, { "names": [ "Alan Jenkins" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2013-1857", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "discovery_date": "2013-03-13T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "921335" } ], "notes": [ { "category": "description", "text": "A cross-site scripting (XSS) flaw was found in Action Pack. A remote attacker could use this flaw to conduct XSS attacks against users of an application using Action Pack.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-actionpack: sanitize_protocol: XSS Vulnerability in the helper of Ruby on Rails", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src", "6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-1857" }, { "category": "external", "summary": "RHBZ#921335", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=921335" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-1857", "url": "https://www.cve.org/CVERecord?id=CVE-2013-1857" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-1857", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1857" } ], "release_date": "2013-03-18T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2014-11-17T17:08:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src", "6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2014:1863" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "products": [ "6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src", "6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-actionpack: sanitize_protocol: XSS Vulnerability in the helper of Ruby on Rails" }, { "acknowledgments": [ { "names": [ "Ruby on Rails upstream" ] }, { "names": [ "Peter McLarnan" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2013-4491", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "discovery_date": "2013-12-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1036922" } ], "notes": [ { "category": "description", "text": "It was discovered that the internationalization component of Ruby on Rails could, under certain circumstances, return a fallback HTML string that contained user input. A remote attacker could possibly use this flaw to perform a reflective cross-site scripting (XSS) attack by providing a specially crafted input to an application using the aforementioned component.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-actionpack: i18n missing translation XSS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src", "6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-4491" }, { "category": "external", "summary": "RHBZ#1036922", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1036922" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-4491", "url": "https://www.cve.org/CVERecord?id=CVE-2013-4491" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-4491", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-4491" } ], "release_date": "2013-12-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2014-11-17T17:08:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src", "6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2014:1863" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "products": [ "6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src", "6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-actionpack: i18n missing translation XSS" }, { "acknowledgments": [ { "names": [ "Ruby on Rails upstream" ] }, { "names": [ "Toby Hsieh" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2013-6414", "cwe": { "id": "CWE-400", "name": "Uncontrolled Resource Consumption" }, "discovery_date": "2013-12-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1036483" } ], "notes": [ { "category": "description", "text": "A denial of service flaw was found in the header handling component of Action View. A remote attacker could send strings in specially crafted headers that would be cached indefinitely, which would result in all available system memory eventually being consumed.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-actionpack: Action View DoS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src", "6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-6414" }, { "category": "external", "summary": "RHBZ#1036483", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1036483" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-6414", "url": "https://www.cve.org/CVERecord?id=CVE-2013-6414" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-6414", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6414" } ], "release_date": "2013-12-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2014-11-17T17:08:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src", "6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2014:1863" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 5.0, "confidentialityImpact": "NONE", "integrityImpact": "NONE", "vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P", "version": "2.0" }, "products": [ "6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src", "6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-actionpack: Action View DoS" }, { "acknowledgments": [ { "names": [ "Ruby on Rails upstream" ] }, { "names": [ "Ankit Gupta" ], "summary": "Acknowledged by upstream." } ], "cve": "CVE-2013-6415", "cwe": { "id": "CWE-79", "name": "Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')" }, "discovery_date": "2013-12-01T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1036910" } ], "notes": [ { "category": "description", "text": "It was found that the number_to_currency Action View helper did not properly escape the unit parameter. An attacker could use this flaw to perform a cross-site scripting (XSS) attack on an application that uses data submitted by a user in the unit parameter.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-actionpack: number_to_currency XSS", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src", "6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2013-6415" }, { "category": "external", "summary": "RHBZ#1036910", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1036910" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2013-6415", "url": "https://www.cve.org/CVERecord?id=CVE-2013-6415" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-6415", "url": "https://nvd.nist.gov/vuln/detail/CVE-2013-6415" } ], "release_date": "2013-12-03T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2014-11-17T17:08:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src", "6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2014:1863" } ], "scores": [ { "cvss_v2": { "accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "NONE", "baseScore": 4.3, "confidentialityImpact": "NONE", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "version": "2.0" }, "products": [ "6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src", "6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src" ] } ], "threats": [ { "category": "impact", "details": "Moderate" } ], "title": "rubygem-actionpack: number_to_currency XSS" }, { "cve": "CVE-2014-0130", "cwe": { "id": "CWE-22", "name": "Improper Limitation of a Pathname to a Restricted Directory ('Path Traversal')" }, "discovery_date": "2014-05-07T00:00:00+00:00", "ids": [ { "system_name": "Red Hat Bugzilla ID", "text": "1095105" } ], "notes": [ { "category": "description", "text": "A directory traversal flaw was found in the way Ruby on Rails handled wildcard segments in routes with implicit rendering. A remote attacker could use this flaw to retrieve arbitrary local files accessible to a Ruby on Rails application using the aforementioned routes via a specially crafted request.", "title": "Vulnerability description" }, { "category": "summary", "text": "rubygem-actionpack: directory traversal issue", "title": "Vulnerability summary" }, { "category": "general", "text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product's status, and are included for informational purposes to better understand the severity of this vulnerability.", "title": "CVSS score applicability" } ], "product_status": { "fixed": [ "6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src", "6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src" ] }, "references": [ { "category": "self", "summary": "Canonical URL", "url": "https://access.redhat.com/security/cve/CVE-2014-0130" }, { "category": "external", "summary": "RHBZ#1095105", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=1095105" }, { "category": "external", "summary": "https://www.cve.org/CVERecord?id=CVE-2014-0130", "url": "https://www.cve.org/CVERecord?id=CVE-2014-0130" }, { "category": "external", "summary": "https://nvd.nist.gov/vuln/detail/CVE-2014-0130", "url": "https://nvd.nist.gov/vuln/detail/CVE-2014-0130" }, { "category": "external", "summary": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog", "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog" } ], "release_date": "2014-05-06T00:00:00+00:00", "remediations": [ { "category": "vendor_fix", "date": "2014-11-17T17:08:19+00:00", "details": "Before applying this update, make sure all previously released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to use the\nRed Hat Network to apply this update are available at\nhttps://access.redhat.com/articles/11258", "product_ids": [ "6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src", "6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src" ], "restart_required": { "category": "none" }, "url": "https://access.redhat.com/errata/RHSA-2014:1863" } ], "scores": [ { "cvss_v2": { "accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0" }, "products": [ "6Server-SubscriptionAssetManager14:katello-0:1.4.3.28-1.el6sam_splice.src", "6Server-SubscriptionAssetManager14:katello-common-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-candlepin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-glue-elasticsearch-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:katello-headpin-all-0:1.4.3.28-1.el6sam_splice.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionmailer-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-actionpack-1:3.2.17-6.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activemodel-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activerecord-1:3.2.17-5.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activeresource-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-activesupport-1:3.2.17-2.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-i18n-0:0.6.9-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-mail-0:2.5.4-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rack-1:1.4.5-3.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-rails-1:3.2.17-1.el6sam.src", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.noarch", "6Server-SubscriptionAssetManager14:ruby193-rubygem-railties-1:3.2.17-1.el6sam.src" ] } ], "threats": [ { "category": "exploit_status", "date": "2022-03-25T00:00:00+00:00", "details": "CISA: https://www.cisa.gov/known-exploited-vulnerabilities-catalog" }, { "category": "impact", "details": "Important" } ], "title": "rubygem-actionpack: directory traversal issue" } ] }