Skip to content
OpenAdvisories
High RHSA-2016:0456 2 CVEs

Red Hat Security Advisory: rh-ror41 security update

Published Sep 13, 2024 · Updated Jun 29, 2026

Ecosystem: Red Hat

Fixed packages 8

ReleasePackageFixed in
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ror41-rubygem-actionpack 1:4.1.5-4.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ror41-rubygem-actionpack-doc 1:4.1.5-4.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ror41-rubygem-actionview 0:4.1.5-5.el6
Red Hat · RHEL 2 rhel_software_collections:2::el6 rh-ror41-rubygem-actionview-doc 0:4.1.5-5.el6
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ror41-rubygem-actionpack 1:4.1.5-4.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ror41-rubygem-actionpack-doc 1:4.1.5-4.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ror41-rubygem-actionview 0:4.1.5-5.el7
Red Hat · RHEL 2 rhel_software_collections:2::el7 rh-ror41-rubygem-actionview-doc 0:4.1.5-5.el7

Vulnerabilities 2

  • High 7.3
    CVE-2016-2098 Public exploit EPSS 81%

    actionpack allows remote code execution via application's unrestricted use of render method

    Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.

    rails actionpack Debian RubyGems
  • Medium 5.3
    CVE-2016-2097

    actionview contains Path Traversal vulnerability

    Directory traversal vulnerability in Action View in Ruby on Rails before 3.2.22.2 and 4.x before 4.1.14.2 allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a .. (dot dot) in a pa…

    rails actionpack actionview Debian RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#important
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1310043
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=1310054
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0456.json
  • report
    https://access.redhat.com/security/cve/CVE-2016-2097
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-2097
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-2097
  • article
    https://groups.google.com/forum/#!msg/rubyonrails-security/ddY6HgqB2z4/we0RasMZIAAJ
  • report
    https://access.redhat.com/security/cve/CVE-2016-2098
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2016-2098
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2016-2098
  • article
    https://groups.google.com/forum/#!msg/rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ