Ruby on Rails: Mehrere Schwachstellen ermöglichen Cross-Site Scripting

Summary

Product

Vulnerabilities 2

• Medium 6.1
  CVE-2022-22577

  Cross-site Scripting Vulnerability in Action Pack

  An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses.

  rails rails actionpack Debian Ubuntu RubyGems
  May 26, 2022
• Medium 6.1
  CVE-2022-27777

  XSS Vulnerability in Action View tag helpers

  A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes.

  rails rails redmine actionview Debian Ubuntu RubyGems
  May 26, 2022

Revision history

1. 2023-04-27 #7

   Neue Updates von SUSE aufgenommen

2. 2022-11-03 #6

   Neue Updates von SUSE aufgenommen

3. 2022-10-18 #5

   Neue Updates von SUSE aufgenommen

4. 2022-10-12 #4

   Neue Updates von HCL aufgenommen

5. 2022-09-04 #3

   Neue Updates von Debian aufgenommen

6. 2022-05-01 #2

   Referenz(en) aufgenommen: 2080296, 2080302

7. 2022-04-26 #1

   Initiale Fassung

References

• SUSE Security Update SUSE-SU-2023:2059-1 vom 2023-04-27
  https://lists.suse.com/pipermail/sle-security-updates/2023-April/014619.html
• Ruby Security Advisory vom 2022-04-26
  https://rubyonrails.org/2022/4/26/Rails-7-0-2-4-6-1-5-1-6-0-4-8-and-5-2-7-1-have-been-released
• Debian Security Advisory DLA-3093 vom 2022-09-03
  https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html
• HCL Article KB0100982 vom 2022-10-12
  https://support.hcltechsw.com/csm?id=kb_article&sysparm_article=KB0100982
• SUSE Security Update SUSE-SU-2022:3621-1 vom 2022-10-18
  https://lists.suse.com/pipermail/sle-security-updates/2022-October/012561.html
• SUSE Security Update SUSE-SU-2022:3860-1 vom 2022-11-03
  https://lists.suse.com/pipermail/sle-security-updates/2022-November/012803.html