Skip to content
OpenAdvisories
Unscored RHSA-2014:0008 4 CVEs

Red Hat Security Advisory: ruby193-rubygem-actionpack security update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 2

ReleasePackageFixed in
Red Hat · OpenStack 3 openstack:3::el6 ruby193-rubygem-actionpack 1:3.2.8-5.1.el6
Red Hat · OpenStack 3 openstack:3::el6 ruby193-rubygem-actionpack-doc 1:3.2.8-5.1.el6

Vulnerabilities 4

  • Medium —
    CVE-2013-4491

    actionpack vulnerable to Cross-site Scripting

    Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/translation_helper.rb in the internationalization component in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML v…

    actionpack RubyGems
  • Medium —
    CVE-2013-6414 Public exploit EPSS 21%

    actionpack Improper Input Validation vulnerability

    actionpack/lib/action_view/lookup_context.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive …

    actionpack RubyGems
  • Medium —
    CVE-2013-6415

    actionpack vulnerable to Cross-site Scripting

    Cross-site scripting (XSS) vulnerability in the number_to_currency helper in actionpack/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 allows remote attackers to inject arbitrary web script or HTML via the unit pa…

    actionpack RubyGems
  • Medium —
    CVE-2013-6417

    actionpack allows bypass of database-query restrictions

    actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.2.16 and 4.x before 4.0.2 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to b…

    actionpack RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1036409
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1036483
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1036910
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1036922
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2014/rhsa-2014_0008.json
  • report
    https://access.redhat.com/security/cve/CVE-2013-4491
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-4491
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-4491
  • report
    https://access.redhat.com/security/cve/CVE-2013-6414
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-6414
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-6414
  • report
    https://access.redhat.com/security/cve/CVE-2013-6415
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-6415
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-6415
  • report
    https://access.redhat.com/security/cve/CVE-2013-6417
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-6417
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-6417