Skip to content
OpenAdvisories
Medium · 5.4 Public exploit CVE-2020-15169 EUVD-2020-0979GHSA-cfjv-5498-mph5

XSS in Action View

Published Sep 11, 2020 · Updated Aug 4, 2024 · Assigned by GitHub_M

Vendor: rails Product: actionview Package: actionview Package: rails Package: rails Ecosystem: Debian Ecosystem: RubyGems Ecosystem: Ubuntu

Description

In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential Cross-Site Scripting (XSS) vulnerability in Action View's translation helpers. Views that allow the user to control the default (not found) value of the `t` and `translate` helpers could be susceptible to XSS attacks. When an HTML-unsafe string is passed as the default for a missing translation key named html or ending in _html, the default string is incorrectly marked as HTML-safe and not escaped. This is patched in versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in the source advisory.

Affected products

VendorProductAffectedFixed
rails actionview < 5.2.4.4, >= 6.0.0.0, < 6.0.3.3 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 rails 2:6.0.3.3+dfsg-1 —
Debian 13 rails 2:6.0.3.3+dfsg-1 —
Debian 12 rails 2:6.0.3.3+dfsg-1 —
Debian 10 rails 2:5.2.2.1+dfsg-1+deb10u2 DSA-4766-1
Debian 9 rails 2:4.2.7.1-1+deb9u4 DLA-2403-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 rails No fix yet —
Ubuntu 26.04 LTS rails No fix yet —
Ubuntu 25.10 rails No fix yet —
Ubuntu 24.04 LTS rails No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS rails No fix yet —
Ubuntu Pro 20.04 LTS rails No fix yet —
Ubuntu Pro 18.04 LTS rails No fix yet —
Ubuntu Pro 16.04 LTS rails No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Satellite Capsule 6 ansible-collection-redhat-satellite 2.0.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 ansible-runner +1 1.4.6-1.el7ar RHSA-2021:1313
Red Hat Satellite Capsule 6 ansiblerole-insights-client 1.7.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 ansiblerole-satellite-receptor-installer 0.6.13-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 crane-selinux +1 3.5.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 createrepo_c +1 0.17.1-1.el7pc RHSA-2021:1313
Red Hat Satellite Capsule 6 foreman +1 2.3.1.20-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 foreman-bootloaders-redhat +1 202005201200-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 foreman-discovery-image 1:3.7.4-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 foreman-discovery-image-service +1 1.0.0-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 foreman-installer +1 1:2.3.1.10-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 foreman-proxy +3 2.3.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 future +1 0.16.0-11.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 gofer +2 2.12.5-7.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 hfsplus-tools 332.14-12.el7 RHSA-2021:1313
Red Hat Satellite Capsule 6 katello +3 3.18.1-3.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 katello-certs-tools 2.7.3-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 katello-client-bootstrap 1.7.5-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 kobo 0.5.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 libmodulemd 1.7.0-1.pulp.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 libsolv +1 0.7.12-2.el7pc RHSA-2021:1313
Red Hat Satellite Capsule 6 libwebsockets 2.4.2-2.el7 RHSA-2021:1313
Red Hat Satellite Capsule 6 livecd-tools +1 1:20.4-1.6.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 mod_xsendfile 0.12-11.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 ostree 2017.1-2.atomic.el7 RHSA-2021:1313
Red Hat Satellite Capsule 6 pulp +23 2.21.5-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 pulp-docker +3 3.2.9-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 pulp-katello 1.0.3-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 pulp-ostree +3 1.3.1-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 puppet-agent 6.19.1-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 puppet-agent-oauth 0.5.1-3.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 puppet-foreman_scap_client 0.4.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 puppetlabs-stdlib 5.2.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 puppetserver 6.14.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 pycairo 1.16.3-9.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 pygobject3 +2 3.28.3-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-amqp +1 2.2.2-5.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-anyjson +1 0.3.3-11.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-billiard +1 1:3.5.0.3-3.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-blinker 1.3-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-bson +2 3.2-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-celery +1 4.0.2-9.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-click +1 6.7-9.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-crane +1 3.3.1-9.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-daemon +1 2.1.2-7.el7at RHSA-2021:1313
Red Hat Satellite Capsule 6 python-django +1 1.11.29-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-flask +1 1:0.12.2-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-gnupg 0.3.7-1.el7ui RHSA-2021:1313
Red Hat Satellite Capsule 6 python-isodate +1 0.5.4-12.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-itsdangerous +1 0.24-15.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-jinja2 +1 2.10-10.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-jmespath +1 0.9.0-6.el7_7 RHSA-2021:1313
Red Hat Satellite Capsule 6 python-kid 0.9.6-11.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-kombu +1 10:4.0.2-14.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-lockfile +1 1:0.11.0-10.el7ar RHSA-2021:1313
Red Hat Satellite Capsule 6 python-markupsafe +1 0.23-21.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-mongoengine 0.10.5-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-nectar 1.6.4-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-oauth2 1.5.211-8.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-okaara +1 1.0.37-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-pexpect +1 4.6-1.el7at RHSA-2021:1313
Red Hat Satellite Capsule 6 python-psutil +1 5.7.2-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-ptyprocess +1 0.5.2-3.el7at RHSA-2021:1313
Red Hat Satellite Capsule 6 python-pycurl +1 7.43.0.2-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-qpid 1.35.0-5.el7 RHSA-2021:1313
Red Hat Satellite Capsule 6 python-semantic_version 2.2.0-6.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-simplejson 3.2.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-twisted +1 16.4.1-12.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-vine +1 10:1.1.3-6.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-werkzeug +1 0.12.2-5.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-zope-interface 4.0.5-4.el7 RHSA-2021:1313
Red Hat Satellite Capsule 6 qpid-cpp +6 1.36.0-28.el7amq RHSA-2021:1313
Red Hat Satellite Capsule 6 qpid-dispatch +2 1.5.0-4.el7 RHSA-2021:1313
Red Hat Satellite Capsule 6 qpid-proton +2 0.28.0-4.el7 RHSA-2021:1313
Red Hat Satellite Capsule 6 redhat-access-insights-puppet 1.0.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 repoview 0.6.6-11.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 rubygem-fast_gettext +1 1.1.0-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 rubygem-highline 1.7.8-3.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 rubygem-oauth 0.5.4-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 saslwrapper +1 0.22-5.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 satellite +3 6.9.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 satellite-installer 6.9.0.10-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm +1 6.1-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-algebrick 0.7.3-6.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-ansi 1.5.0-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-apipie-params 0.0.5-5.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-bundler_ext 0.4.1-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-clamp 1.1.2-5.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-concurrent-ruby 1:1.1.6-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-concurrent-ruby-edge 1:0.6.0-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-domain_name 0.5.20160310-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-dynflow 1.4.7-1.fm2_1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-excon 0.76.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-faraday 0.17.3-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-faraday_middleware 0.13.1-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-fast_gettext 1.4.1-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-ffi 1.12.2-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-foreman-tasks-core 0.3.4-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-foreman_ansible_core 4.0.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-foreman_remote_execution_core 1.4.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-gssapi 1.2.0-6.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-hashie 3.6.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-highline 1.7.8-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-http-cookie 1.0.2-5.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-infoblox 3.0.0-3.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-journald-logger 2.0.4-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-journald-native 1.0.11-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-jwt 2.2.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-kafo 6.2.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-kafo_parsers 1.1.0-3.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-kafo_wizards 0.0.1-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-little-plugger 1.1.4-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-logging 2.3.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-logging-journald 2.0.0-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-mime-types 3.2.2-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-mime-types-data 3.2018.0812-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-multi_json 1.14.1-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-multipart-post 2.0.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-mustermann 1.0.2-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-net-ssh 4.2.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-net-ssh-krb 0.4.0-3.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-netrc 0.11.0-3.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-newt 0.9.7-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-openscap 0.4.9-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-powerbar 2.0.1-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-rack 2.2.3-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-rb-inotify 0.9.7-5.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-redfish_client 0.5.2-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-rest-client 2.0.2-3.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-rkerberos 0.1.5-18.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-rsec 0.4.3-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-ruby-libvirt 0.7.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-rubyipmi 0.10.0-6.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-sd_notify +1 0.1.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-sequel 5.7.1-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-server_sent_events 0.1.2-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-sinatra +1 2.0.3-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_ansible 3.0.1-6.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_dhcp_infoblox 0.0.16-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_dhcp_remote_isc 0.0.5-3.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_discovery 1.0.5-6.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_discovery_image 1.3.2-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_dynflow_core 0.3.2-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_openscap 0.7.4-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_pulp 2.1.0-3.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_remote_execution_ssh 0.3.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-sqlite3 1.3.13-5.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-statsd-instrument 2.1.4-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-tilt 2.0.8-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-unf 0.1.3-7.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-unf_ext 0.0.7.2-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-xmlrpc +1 0.3.0-2.el7sat RHSA-2021:1313
Red Hat Satellite 6 ansible-collection-redhat-satellite 2.0.1-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 ansible-runner 1.4.6-1.el7ar RHSA-2021:1313
Red Hat Satellite 6 ansiblerole-foreman_scap_client 0.1.0-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 ansiblerole-insights-client 1.7.1-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 ansiblerole-satellite-receptor-installer 0.6.13-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 candlepin +1 3.1.26-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 crane-selinux +1 3.5.1-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 createrepo_c +1 0.17.1-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 foreman +13 2.3.1.20-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 foreman-bootloaders-redhat +1 202005201200-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 foreman-discovery-image 1:3.7.4-2.el7sat RHSA-2021:1313
Red Hat Satellite 6 foreman-discovery-image-service +1 1.0.0-4.el7sat RHSA-2021:1313
Red Hat Satellite 6 foreman-installer +1 1:2.3.1.10-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 foreman-proxy +2 2.3.1-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 future 0.16.0-11.el7sat RHSA-2021:1313
Red Hat Satellite 6 gofer 2.12.5-7.el7sat RHSA-2021:1313
Red Hat Satellite 6 hfsplus-tools 332.14-12.el7 RHSA-2021:1313
Red Hat Satellite 6 katello +2 3.18.1-3.el7sat RHSA-2021:1313
Red Hat Satellite 6 katello-certs-tools 2.7.3-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 katello-client-bootstrap 1.7.5-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 keycloak-httpd-client-install 1.2.2-2.el7sat RHSA-2021:1313
Red Hat Satellite 6 kobo 0.5.1-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 libcomps 0.1.15-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 libmodulemd 1.7.0-1.pulp.el7sat RHSA-2021:1313
Red Hat Satellite 6 libmodulemd2 2.9.3-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 libsolv 0.7.12-2.el7pc RHSA-2021:1313
Red Hat Satellite 6 libwebsockets 2.4.2-2.el7 RHSA-2021:1313
Red Hat Satellite 6 livecd-tools 1:20.4-1.6.el7sat RHSA-2021:1313
Red Hat Satellite 6 mod_passenger 4.0.18-24.el7sat RHSA-2021:1313
Red Hat Satellite 6 mod_xsendfile 0.12-11.el7sat RHSA-2021:1313
Red Hat Satellite 6 ostree 2017.1-2.atomic.el7 RHSA-2021:1313
Red Hat Satellite 6 pcp-mmvstatsd 0.4-2.el7sat RHSA-2021:1313
Red Hat Satellite 6 pulp +11 2.21.5-2.el7sat RHSA-2021:1313
Red Hat Satellite 6 pulp-docker +2 3.2.9-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 pulp-katello 1.0.3-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 pulp-ostree +2 1.3.1-2.el7sat RHSA-2021:1313
Red Hat Satellite 6 pulpcore-selinux 1.2.3-2.el7pc RHSA-2021:1313
Red Hat Satellite 6 puppet-agent 6.19.1-2.el7sat RHSA-2021:1313
Red Hat Satellite 6 puppet-agent-oauth 0.5.1-3.el7sat RHSA-2021:1313
Red Hat Satellite 6 puppet-foreman_scap_client 0.4.0-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 puppetlabs-stdlib 5.2.0-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 puppetserver 6.14.1-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 pycairo 1.16.3-9.el7sat RHSA-2021:1313
Red Hat Satellite 6 pygobject3 3.28.3-2.el7sat RHSA-2021:1313
Red Hat Satellite 6 python-aiodns 2.0.0-3.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-aiofiles +1 0.6.0-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-aiohttp 3.6.2-4.el7ar RHSA-2021:1313
Red Hat Satellite 6 python-amqp 2.2.2-5.el7sat RHSA-2021:1313
Red Hat Satellite 6 python-anyjson 0.3.3-11.el7sat RHSA-2021:1313
Red Hat Satellite 6 python-async-timeout 3.0.1-2.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-attrs 19.3.0-2.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-backoff 1.10.0-3.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-billiard 1:3.5.0.3-3.el7sat RHSA-2021:1313
Red Hat Satellite 6 python-blinker 1.3-2.el7sat RHSA-2021:1313
Red Hat Satellite 6 python-bson 3.2-2.el7sat RHSA-2021:1313
Red Hat Satellite 6 python-celery 4.0.2-9.el7sat RHSA-2021:1313
Red Hat Satellite 6 python-certifi 2020.6.20-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-cffi 1.14.3-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-chardet 3.0.4-10.el7ar RHSA-2021:1313
Red Hat Satellite 6 python-click 6.7-9.el7sat RHSA-2021:1313
Red Hat Satellite 6 python-crane 3.3.1-9.el7sat RHSA-2021:1313
Red Hat Satellite 6 python-cryptography 2.9.2-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-daemon 2.1.2-7.el7at RHSA-2021:1313
Red Hat Satellite 6 python-dateutil 2.8.1-3.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-diff-match-patch 20200713-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-django 1.11.29-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 python-django-currentuser 0.5.1-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-django-filter +2 2.3.0-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-django-lifecycle 0.8.0-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-django-prometheus 2.1.0-1.el7pc RHSA-2021:1313

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP4 rubygem-actionview-5_1 5.1.4-150000.3.6.1 SUSE-SU-2023:2059-1
SLES 15 SP3 rubygem-actionview-5_1 5.1.4-150000.3.6.1 SUSE-SU-2023:2059-1
SLES 15 SP2 rmt-server 2.6.5-3.3.1 SUSE-SU-2020:3036-1
SLES 15 SP2 rubygem-actionview-5_1 5.1.4-150000.3.6.1 SUSE-SU-2023:2059-1
SLES 15 SP1 rmt-server 2.6.5-3.18.1 SUSE-SU-2020:3160-1
SLES 15 SP1 rubygem-actionview-5_1 5.1.4-150000.3.6.1 SUSE-SU-2023:2059-1
SLES 15 rmt-server 2.6.5-3.34.1 SUSE-SU-2020:3147-1
Show 6 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 rmt-server 2.6.5-3.34.1 SUSE-SU-2020:3147-1
SLE HPC 15 rmt-server 2.6.5-3.34.1 SUSE-SU-2020:3147-1
SUSE OpenStack Cloud Crowbar 9 rubygem-actionview-4_2 4.2.9-9.12.1 SUSE-SU-2020:2686-1
SUSE OpenStack Cloud Crowbar 8 rubygem-actionview-4_2 4.2.9-9.12.1 SUSE-SU-2020:2686-1
SUSE OpenStack Cloud 7 rubygem-actionview-4_2 4.2.9-9.12.1 SUSE-SU-2020:2686-1
SUSE OpenStack Cloud 6 rubygem-actionview-4_2 4.2.9-9.12.1 SUSE-SU-2020:2686-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed rmt-server 2.6.13-1.1 openSUSE-SU-2024:10589-1
openSUSE Leap 15.4 rubygem-actionview-5_1 5.1.4-150000.3.6.1 SUSE-SU-2023:2059-1
openSUSE Leap 15.2 rmt-server 2.6.5-lp152.2.3.1 openSUSE-SU-2020:1993-1
openSUSE Leap 15.1 rmt-server 2.6.5-lp151.2.18.2 openSUSE-SU-2020:2000-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems actionview < 5.2.4.4 5.2.4.4 GHSA-cfjv-5498-mph5
RubyGems actionview >= 6.0.0.0, < 6.0.3.3 6.0.3.3 GHSA-cfjv-5498-mph5

Advisories 12

References