Skip to content
OpenAdvisories
Unscored DSA-2260-1 2 CVEs

rails - several

Published Jun 14, 2011 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 5.0 rails 2.1.0-7+lenny0.2

Vulnerabilities 2

  • Medium —
    CVE-2009-3086

    actionpack and activesupport vulnerable to information leaks

    A certain algorithm in Ruby on Rails 2.1.0 through 2.2.2, and 2.3.x before 2.3.4, leaks information about the complexity of message-digest signature verification in the cookie store, which might allow remote attackers to forge a digest via multiple attempts.

    rails actionpack activesupport Debian RubyGems
  • Medium —
    CVE-2009-4214

    Moderate severity vulnerability that affects rails

    Cross-site scripting (XSS) vulnerability in the strip_tags function in Ruby on Rails before 2.2.s, and 2.3.x before 2.3.5, allows remote attackers to inject arbitrary web script or HTML via vectors involving non-printing ASCII characters, related to HTML::Tok…

    rails rails Debian RubyGems