Skip to content
OpenAdvisories
High DLA-2655-1 2 CVEs

rails - security update

Published May 12, 2021 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 9 rails 2:4.2.7.1-1+deb9u5

Vulnerabilities 2

  • High 7.5
    CVE-2021-22885

    Action Pack contains Information Disclosure / Unintended Method Execution vulnerability

    A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the `redirect_to` or `polymorphic_url`helper with untrusted user input.

    rails rails actionpack Debian Ubuntu RubyGems
  • High 7.5
    CVE-2021-22904

    Possible DoS Vulnerability in Action Controller Token Authentication

    The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses `authenticate_or_requ…

    rails rails actionpack Debian Ubuntu RubyGems