Skip to content
OpenAdvisories
Critical DLA-2282-1 3 CVEs

rails - security update

Published Jul 20, 2020 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 rails 2:4.2.7.1-1+deb9u3

Vulnerabilities 3

  • Critical 9.8
    CVE-2020-8165 Public exploit EPSS 46%

    ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore

    A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.

    rails rails activesupport Debian Ubuntu RubyGems
  • High 8.8
    CVE-2020-8163 Public exploit Scanner template EPSS 82%

    Remote code execution via user-provided local names in ActionView

    The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.

    rails rails actionview Debian Ubuntu RubyGems
  • High 7.5
    CVE-2020-8164

    Possible Strong Parameters Bypass in ActionPack

    A deserialization of untrusted data vulnerability exists in rails < 5.2.4.3, rails < 6.0.3.1 which can allow an attacker to supply information can be inadvertently leaked fromStrong Parameters.

    rails rails actionpack Debian Ubuntu RubyGems