Skip to content
OpenAdvisories
Unscored RHSA-2013:0698 2 CVEs

Red Hat Security Advisory: rubygem-actionpack and ruby193-rubygem-actionpack security update

Published Sep 15, 2024 · Updated Jun 28, 2026

Ecosystem: Red Hat

Fixed packages 3

ReleasePackageFixed in
Red Hat · OpenShift 1 openshift:1::el6 ruby193-rubygem-actionpack 1:3.2.8-5.el6
Red Hat · OpenShift 1 openshift:1::el6 ruby193-rubygem-actionpack-doc 1:3.2.8-5.el6
Red Hat · OpenShift 1 openshift:1::el6 rubygem-actionpack 1:3.0.13-8.el6op

Vulnerabilities 2

  • Medium —
    CVE-2013-1855

    actionpack Cross-site Scripting vulnerability

    The sanitize_css method in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle \n (newline) characters, which …

    rails actionpack Debian RubyGems
  • Medium —
    CVE-2013-1857

    actionpack Cross-site Scripting vulnerability

    The sanitize helper in lib/action_controller/vendor/html-scanner/html/sanitizer.rb in the Action Pack component in Ruby on Rails before 2.3.18, 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 does not properly handle encoded : (colon) characters in URL…

    rails actionpack Debian RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#moderate
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=921331
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=921335
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0698.json
  • report
    https://access.redhat.com/security/cve/CVE-2013-1855
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-1855
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-1855
  • report
    https://access.redhat.com/security/cve/CVE-2013-1857
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-1857
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-1857