Description
The Safemode gem before 1.2.4 for Ruby, when initialized with a delegate object that is a Rails controller, allows context-dependent attackers to obtain sensitive information via the inspect method.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat Satellite Capsule 6 | foreman +1 | 1.15.6.34-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | foreman-bootloaders-redhat +1 | 201801241201-2.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | foreman-discovery-image | 1:3.4.4-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | foreman-installer | 1:1.15.6.8-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | foreman-proxy | 1.15.6.4-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | foreman-selinux | 1.15.6.2-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | hiera | 1.3.1-2.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | katello +3 | 3.4.5-15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | katello-certs-tools | 2.4.0-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | katello-client-bootstrap | 1.5.1-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | katello-installer-base +1 | 3.4.5.26-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | katello-selinux | 3.0.2-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | kobo | 0.5.1-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | pulp +13 | 2.13.4.6-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | pulp-docker +3 | 2.4.1-2.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | pulp-katello | 1.0.2-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | pulp-ostree +3 | 1.2.1.1-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | pulp-puppet +3 | 2.13.4-3.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | pulp-rpm +3 | 2.13.4.8-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | puppet-foreman_scap_client | 0.3.16-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | python-zope-interface | 4.0.5-4.el7 | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | redhat-access-insights-puppet | 0.0.9-2.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | rubygem-kafo | 2.0.2-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | rubygem-kafo_parsers +1 | 0.1.6-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | rubygem-kafo_wizards | 0.0.1-2.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | rubygem-smart_proxy_dhcp_remote_isc | 0.0.2.1-1.fm1_15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | rubygem-smart_proxy_discovery | 1.0.4-3.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | rubygem-smart_proxy_discovery_image | 1.0.9-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | rubygem-smart_proxy_dynflow | 0.1.10-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | rubygem-smart_proxy_openscap | 0.6.9-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | rubygem-smart_proxy_pulp | 1.3.0-1.git.0.b5c2768.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | rubygem-tilt | 1.3.7-2.git.0.3b416c9.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | satellite +3 | 6.3.0-23.0.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | satellite-installer | 6.3.0.12-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | tfm-rubygem-foreman-tasks-core | 0.1.8-1.fm1_15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | tfm-rubygem-foreman_remote_execution_core | 1.0.6-1.fm1_15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite Capsule 6 | tfm-rubygem-smart_proxy_dynflow_core | 0.1.10-1.fm1_15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | candlepin +1 | 2.1.14-1.el7 | RHSA-2018:0336 |
| Red Hat Satellite 6 | foreman +11 | 1.15.6.34-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | foreman-bootloaders-redhat +1 | 201801241201-2.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | foreman-discovery-image | 1:3.4.4-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | foreman-installer | 1:1.15.6.8-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | foreman-proxy | 1.15.6.4-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | foreman-selinux | 1.15.6.2-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | hiera | 1.3.1-2.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | katello +4 | 3.4.5-15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | katello-certs-tools | 2.4.0-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | katello-client-bootstrap | 1.5.1-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | katello-installer-base +1 | 3.4.5.26-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | katello-selinux | 3.0.2-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | kobo | 0.5.1-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | pulp +9 | 2.13.4.6-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | pulp-docker +3 | 2.4.1-2.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | pulp-katello | 1.0.2-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | pulp-ostree +3 | 1.2.1.1-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | pulp-puppet +4 | 2.13.4-3.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | pulp-rpm +3 | 2.13.4.8-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | puppet-foreman_scap_client | 0.3.16-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | python-zope-interface | 4.0.5-4.el7 | RHSA-2018:0336 |
| Red Hat Satellite 6 | redhat-access-insights-puppet | 0.0.9-2.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | rubygem-foreman_scap_client | 0.3.0-2.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | rubygem-kafo | 2.0.2-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | rubygem-kafo_parsers +1 | 0.1.6-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | rubygem-kafo_wizards | 0.0.1-2.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | rubygem-smart_proxy_dhcp_remote_isc | 0.0.2.1-1.fm1_15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | rubygem-smart_proxy_discovery | 1.0.4-3.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | rubygem-smart_proxy_discovery_image | 1.0.9-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | rubygem-smart_proxy_dynflow | 0.1.10-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | rubygem-smart_proxy_openscap | 0.6.9-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | rubygem-smart_proxy_pulp | 1.3.0-1.git.0.b5c2768.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | rubygem-tilt | 1.3.7-2.git.0.3b416c9.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | satellite +4 | 6.3.0-23.0.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | satellite-installer | 6.3.0.12-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-bastion | 5.1.1.4-1.fm1_15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-foreman-redhat_access | 2.0.13-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-foreman-tasks | 0.9.6.4-1.fm1_15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-foreman-tasks-core | 0.1.8-1.fm1_15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-foreman_bootdisk | 10.0.2.2-1.fm1_15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-foreman_discovery | 9.1.5.3-1.fm1_15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-foreman_docker | 3.1.0.3-1.fm1_15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-foreman_hooks | 0.3.14-1.fm1_15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-foreman_openscap | 0.7.11-1.fm1_15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-foreman_remote_execution | 1.3.7.2-1.fm1_15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-foreman_remote_execution_core | 1.0.6-1.fm1_15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-foreman_templates | 5.0.1-1.fm1_15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-foreman_theme_satellite | 1.0.4.16-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-foreman_virt_who_configure | 0.1.9-1.fm1_15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-hammer_cli | 0.11.0.1-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-hammer_cli_csv | 2.3.0-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-hammer_cli_foreman | 0.11.0.5-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-hammer_cli_foreman_admin | 0.0.8-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-hammer_cli_foreman_bootdisk | 0.1.3.3-2.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-hammer_cli_foreman_discovery | 1.0.0-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-hammer_cli_foreman_docker | 0.0.6-2.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-hammer_cli_foreman_openscap | 0.1.5-1.fm1_15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-hammer_cli_foreman_remote_execution | 0.0.6-1.fm1_15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-hammer_cli_foreman_tasks | 0.0.12-1.fm1_15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-hammer_cli_foreman_virt_who_configure | 0.0.3-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-hammer_cli_katello | 0.11.3.5-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-katello +1 | 3.4.5.58-1.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-ovirt_provision_plugin | 1.0.2-1.fm1_15.el7sat | RHSA-2018:0336 |
| Red Hat Satellite 6 | tfm-rubygem-smart_proxy_dynflow_core | 0.1.10-1.fm1_15.el7sat | RHSA-2018:0336 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | safemode | < 1.2.4 | 1.2.4 | GHSA-c92m-rrrc-q5wf |
Advisories 1
- RHSA-2018:0336 Red Hat Security Advisory: Satellite 6.3 security, bug fix, and enhancement update Red Hat Security Advisories (RHSA) · Jul 1, 2026
References
- https://github.com/theforeman/foreman/commit/82f9b93c54f72c5814df6bab7fad057eab65b2f2
- http://theforeman.org/security.html#2016-3693
- RHSA-2018:0336 vendor-advisory
- [oss-security] 20160420 CVE-2016-3693: Foreman application information leakage through templates mailing-list
- http://rubysec.com/advisories/CVE-2016-3693/
- https://github.com/svenfuchs/safemode/commit/0f764a1720a3a68fd2842e21377c8bfad6d7126f
- http://projects.theforeman.org/issues/14635