Skip to content
OpenAdvisories
Critical DLA-2251-1 2 CVEs

rails - security update

Published Jun 19, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 8 rails 2:4.1.8-1+deb8u7

Vulnerabilities 2

  • Critical 9.8
    CVE-2020-8165 Public exploit EPSS 46%

    ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore

    A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.

    rails rails activesupport Debian Ubuntu RubyGems
  • High 7.5
    CVE-2020-8164

    Possible Strong Parameters Bypass in ActionPack

    A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters.

    rails rails actionpack Debian Ubuntu RubyGems