Skip to content
OpenAdvisories
Critical DLA-3093-1 4 CVEs

rails - security update

Published Sep 3, 2022 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 10 rails 2:5.2.2.1+dfsg-1+deb10u4

Vulnerabilities 4

  • Critical 9.8
    CVE-2022-21831 Public exploit

    Possible code injection vulnerability in Rails / Active Storage

    A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments.

    rails rails activestorage Debian Ubuntu RubyGems
  • High 7.4
    CVE-2022-23633

    Exposure of sensitive information in Action Pack

    Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is *not* notified of a `close`, `ActionDispatch::Executor` will not know to reset thread local stat…

    rails rails rails rails Debian Ubuntu RubyGems
  • Medium 6.1
    CVE-2022-22577

    Cross-site Scripting Vulnerability in Action Pack

    An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses.

    rails rails actionpack Debian Ubuntu RubyGems
  • Medium 6.1
    CVE-2022-27777

    XSS Vulnerability in Action View tag helpers

    A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes.

    rails rails redmine actionview Debian Ubuntu RubyGems