Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2020-8165 EUVD-2020-0401GHSA-2p68-f74v-9wc6

ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore

Published Jun 19, 2020 · Updated May 9, 2025 · Assigned by hackerone

Package: activesupport Package: rails Package: rails Ecosystem: Debian Ecosystem: RubyGems Ecosystem: Ubuntu

Description

A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.

Affected products

VendorProductAffectedFixed
— https://github.com/rails/rails Fixed in 5.2.4.3, 6.0.3.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 rails 2:5.2.4.3+dfsg-1 —
Debian 13 rails 2:5.2.4.3+dfsg-1 —
Debian 12 rails 2:5.2.4.3+dfsg-1 —
Debian 10 rails 2:5.2.2.1+dfsg-1+deb10u2 DSA-4766-1
Debian 9 rails 2:4.2.7.1-1+deb9u3 DLA-2282-1
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Debian 8 rails 2:4.1.8-1+deb8u7 DLA-2251-1

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu Pro 20.04 LTS rails No fix yet —
Ubuntu Pro 18.04 LTS rails No fix yet —
Ubuntu Pro 16.04 LTS rails No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Satellite Capsule 6 ansible-collection-redhat-satellite 2.0.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 ansible-runner +1 1.4.6-1.el7ar RHSA-2021:1313
Red Hat Satellite Capsule 6 ansiblerole-insights-client 1.7.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 ansiblerole-satellite-receptor-installer 0.6.13-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 crane-selinux +1 3.5.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 createrepo_c +1 0.17.1-1.el7pc RHSA-2021:1313
Red Hat Satellite Capsule 6 foreman +1 2.3.1.20-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 foreman-bootloaders-redhat +1 202005201200-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 foreman-discovery-image 1:3.7.4-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 foreman-discovery-image-service +1 1.0.0-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 foreman-installer +1 1:2.3.1.10-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 foreman-proxy +3 2.3.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 future +1 0.16.0-11.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 gofer +2 2.12.5-7.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 hfsplus-tools 332.14-12.el7 RHSA-2021:1313
Red Hat Satellite Capsule 6 katello +3 3.18.1-3.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 katello-certs-tools 2.7.3-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 katello-client-bootstrap 1.7.5-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 kobo 0.5.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 libmodulemd 1.7.0-1.pulp.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 libsolv +1 0.7.12-2.el7pc RHSA-2021:1313
Red Hat Satellite Capsule 6 libwebsockets 2.4.2-2.el7 RHSA-2021:1313
Red Hat Satellite Capsule 6 livecd-tools +1 1:20.4-1.6.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 mod_xsendfile 0.12-11.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 ostree 2017.1-2.atomic.el7 RHSA-2021:1313
Red Hat Satellite Capsule 6 pulp +23 2.21.5-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 pulp-docker +3 3.2.9-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 pulp-katello 1.0.3-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 pulp-ostree +3 1.3.1-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 puppet-agent 6.19.1-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 puppet-agent-oauth 0.5.1-3.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 puppet-foreman_scap_client 0.4.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 puppetlabs-stdlib 5.2.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 puppetserver 6.14.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 pycairo 1.16.3-9.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 pygobject3 +2 3.28.3-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-amqp +1 2.2.2-5.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-anyjson +1 0.3.3-11.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-billiard +1 1:3.5.0.3-3.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-blinker 1.3-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-bson +2 3.2-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-celery +1 4.0.2-9.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-click +1 6.7-9.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-crane +1 3.3.1-9.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-daemon +1 2.1.2-7.el7at RHSA-2021:1313
Red Hat Satellite Capsule 6 python-django +1 1.11.29-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-flask +1 1:0.12.2-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-gnupg 0.3.7-1.el7ui RHSA-2021:1313
Red Hat Satellite Capsule 6 python-isodate +1 0.5.4-12.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-itsdangerous +1 0.24-15.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-jinja2 +1 2.10-10.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-jmespath +1 0.9.0-6.el7_7 RHSA-2021:1313
Red Hat Satellite Capsule 6 python-kid 0.9.6-11.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-kombu +1 10:4.0.2-14.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-lockfile +1 1:0.11.0-10.el7ar RHSA-2021:1313
Red Hat Satellite Capsule 6 python-markupsafe +1 0.23-21.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-mongoengine 0.10.5-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-nectar 1.6.4-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-oauth2 1.5.211-8.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-okaara +1 1.0.37-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-pexpect +1 4.6-1.el7at RHSA-2021:1313
Red Hat Satellite Capsule 6 python-psutil +1 5.7.2-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-ptyprocess +1 0.5.2-3.el7at RHSA-2021:1313
Red Hat Satellite Capsule 6 python-pycurl +1 7.43.0.2-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-qpid 1.35.0-5.el7 RHSA-2021:1313
Red Hat Satellite Capsule 6 python-semantic_version 2.2.0-6.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-simplejson 3.2.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-twisted +1 16.4.1-12.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-vine +1 10:1.1.3-6.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-werkzeug +1 0.12.2-5.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 python-zope-interface 4.0.5-4.el7 RHSA-2021:1313
Red Hat Satellite Capsule 6 qpid-cpp +6 1.36.0-28.el7amq RHSA-2021:1313
Red Hat Satellite Capsule 6 qpid-dispatch +2 1.5.0-4.el7 RHSA-2021:1313
Red Hat Satellite Capsule 6 qpid-proton +2 0.28.0-4.el7 RHSA-2021:1313
Red Hat Satellite Capsule 6 redhat-access-insights-puppet 1.0.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 repoview 0.6.6-11.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 rubygem-fast_gettext +1 1.1.0-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 rubygem-highline 1.7.8-3.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 rubygem-oauth 0.5.4-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 saslwrapper +1 0.22-5.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 satellite +3 6.9.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 satellite-installer 6.9.0.10-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm +1 6.1-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-algebrick 0.7.3-6.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-ansi 1.5.0-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-apipie-params 0.0.5-5.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-bundler_ext 0.4.1-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-clamp 1.1.2-5.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-concurrent-ruby 1:1.1.6-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-concurrent-ruby-edge 1:0.6.0-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-domain_name 0.5.20160310-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-dynflow 1.4.7-1.fm2_1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-excon 0.76.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-faraday 0.17.3-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-faraday_middleware 0.13.1-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-fast_gettext 1.4.1-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-ffi 1.12.2-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-foreman-tasks-core 0.3.4-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-foreman_ansible_core 4.0.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-foreman_remote_execution_core 1.4.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-gssapi 1.2.0-6.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-hashie 3.6.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-highline 1.7.8-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-http-cookie 1.0.2-5.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-infoblox 3.0.0-3.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-journald-logger 2.0.4-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-journald-native 1.0.11-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-jwt 2.2.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-kafo 6.2.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-kafo_parsers 1.1.0-3.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-kafo_wizards 0.0.1-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-little-plugger 1.1.4-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-logging 2.3.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-logging-journald 2.0.0-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-mime-types 3.2.2-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-mime-types-data 3.2018.0812-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-multi_json 1.14.1-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-multipart-post 2.0.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-mustermann 1.0.2-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-net-ssh 4.2.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-net-ssh-krb 0.4.0-3.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-netrc 0.11.0-3.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-newt 0.9.7-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-openscap 0.4.9-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-powerbar 2.0.1-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-rack 2.2.3-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-rb-inotify 0.9.7-5.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-redfish_client 0.5.2-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-rest-client 2.0.2-3.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-rkerberos 0.1.5-18.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-rsec 0.4.3-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-ruby-libvirt 0.7.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-rubyipmi 0.10.0-6.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-sd_notify +1 0.1.0-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-sequel 5.7.1-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-server_sent_events 0.1.2-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-sinatra +1 2.0.3-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_ansible 3.0.1-6.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_dhcp_infoblox 0.0.16-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_dhcp_remote_isc 0.0.5-3.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_discovery 1.0.5-6.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_discovery_image 1.3.2-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_dynflow_core 0.3.2-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_openscap 0.7.4-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_pulp 2.1.0-3.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_remote_execution_ssh 0.3.1-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-sqlite3 1.3.13-5.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-statsd-instrument 2.1.4-2.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-tilt 2.0.8-4.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-unf 0.1.3-7.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-unf_ext 0.0.7.2-1.el7sat RHSA-2021:1313
Red Hat Satellite Capsule 6 tfm-rubygem-xmlrpc +1 0.3.0-2.el7sat RHSA-2021:1313
Red Hat Satellite 6 ansible-collection-redhat-satellite 2.0.1-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 ansible-runner 1.4.6-1.el7ar RHSA-2021:1313
Red Hat Satellite 6 ansiblerole-foreman_scap_client 0.1.0-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 ansiblerole-insights-client 1.7.1-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 ansiblerole-satellite-receptor-installer 0.6.13-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 candlepin +1 3.1.26-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 crane-selinux +1 3.5.1-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 createrepo_c +1 0.17.1-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 foreman +13 2.3.1.20-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 foreman-bootloaders-redhat +1 202005201200-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 foreman-discovery-image 1:3.7.4-2.el7sat RHSA-2021:1313
Red Hat Satellite 6 foreman-discovery-image-service +1 1.0.0-4.el7sat RHSA-2021:1313
Red Hat Satellite 6 foreman-installer +1 1:2.3.1.10-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 foreman-proxy +2 2.3.1-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 future 0.16.0-11.el7sat RHSA-2021:1313
Red Hat Satellite 6 gofer 2.12.5-7.el7sat RHSA-2021:1313
Red Hat Satellite 6 hfsplus-tools 332.14-12.el7 RHSA-2021:1313
Red Hat Satellite 6 katello +2 3.18.1-3.el7sat RHSA-2021:1313
Red Hat Satellite 6 katello-certs-tools 2.7.3-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 katello-client-bootstrap 1.7.5-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 keycloak-httpd-client-install 1.2.2-2.el7sat RHSA-2021:1313
Red Hat Satellite 6 kobo 0.5.1-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 libcomps 0.1.15-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 libmodulemd 1.7.0-1.pulp.el7sat RHSA-2021:1313
Red Hat Satellite 6 libmodulemd2 2.9.3-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 libsolv 0.7.12-2.el7pc RHSA-2021:1313
Red Hat Satellite 6 libwebsockets 2.4.2-2.el7 RHSA-2021:1313
Red Hat Satellite 6 livecd-tools 1:20.4-1.6.el7sat RHSA-2021:1313
Red Hat Satellite 6 mod_passenger 4.0.18-24.el7sat RHSA-2021:1313
Red Hat Satellite 6 mod_xsendfile 0.12-11.el7sat RHSA-2021:1313
Red Hat Satellite 6 ostree 2017.1-2.atomic.el7 RHSA-2021:1313
Red Hat Satellite 6 pcp-mmvstatsd 0.4-2.el7sat RHSA-2021:1313
Red Hat Satellite 6 pulp +11 2.21.5-2.el7sat RHSA-2021:1313
Red Hat Satellite 6 pulp-docker +2 3.2.9-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 pulp-katello 1.0.3-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 pulp-ostree +2 1.3.1-2.el7sat RHSA-2021:1313
Red Hat Satellite 6 pulpcore-selinux 1.2.3-2.el7pc RHSA-2021:1313
Red Hat Satellite 6 puppet-agent 6.19.1-2.el7sat RHSA-2021:1313
Red Hat Satellite 6 puppet-agent-oauth 0.5.1-3.el7sat RHSA-2021:1313
Red Hat Satellite 6 puppet-foreman_scap_client 0.4.0-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 puppetlabs-stdlib 5.2.0-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 puppetserver 6.14.1-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 pycairo 1.16.3-9.el7sat RHSA-2021:1313
Red Hat Satellite 6 pygobject3 3.28.3-2.el7sat RHSA-2021:1313
Red Hat Satellite 6 python-aiodns 2.0.0-3.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-aiofiles +1 0.6.0-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-aiohttp 3.6.2-4.el7ar RHSA-2021:1313
Red Hat Satellite 6 python-amqp 2.2.2-5.el7sat RHSA-2021:1313
Red Hat Satellite 6 python-anyjson 0.3.3-11.el7sat RHSA-2021:1313
Red Hat Satellite 6 python-async-timeout 3.0.1-2.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-attrs 19.3.0-2.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-backoff 1.10.0-3.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-billiard 1:3.5.0.3-3.el7sat RHSA-2021:1313
Red Hat Satellite 6 python-blinker 1.3-2.el7sat RHSA-2021:1313
Red Hat Satellite 6 python-bson 3.2-2.el7sat RHSA-2021:1313
Red Hat Satellite 6 python-celery 4.0.2-9.el7sat RHSA-2021:1313
Red Hat Satellite 6 python-certifi 2020.6.20-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-cffi 1.14.3-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-chardet 3.0.4-10.el7ar RHSA-2021:1313
Red Hat Satellite 6 python-click 6.7-9.el7sat RHSA-2021:1313
Red Hat Satellite 6 python-crane 3.3.1-9.el7sat RHSA-2021:1313
Red Hat Satellite 6 python-cryptography 2.9.2-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-daemon 2.1.2-7.el7at RHSA-2021:1313
Red Hat Satellite 6 python-dateutil 2.8.1-3.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-diff-match-patch 20200713-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-django 1.11.29-1.el7sat RHSA-2021:1313
Red Hat Satellite 6 python-django-currentuser 0.5.1-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-django-filter +2 2.3.0-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-django-lifecycle 0.8.0-1.el7pc RHSA-2021:1313
Red Hat Satellite 6 python-django-prometheus 2.1.0-1.el7pc RHSA-2021:1313

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SLES 15 SP2 rmt-server 2.6.5-3.3.1 SUSE-SU-2020:3036-1
SLES 15 SP2 rubygem-activesupport-5_1 5.1.4-3.3.1 SUSE-SU-2020:2899-1
SLES 15 SP1 rmt-server 2.6.5-3.18.1 SUSE-SU-2020:3160-1
SLES 15 SP1 rubygem-activesupport-5_1 5.1.4-3.3.1 SUSE-SU-2020:2899-1
SLES 15 rmt-server 2.6.5-3.34.1 SUSE-SU-2020:3147-1
SLES 15 rubygem-activesupport-5_1 5.1.4-3.3.1 SUSE-SU-2020:2899-1
Show 5 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
SLES for SAP 15 rmt-server 2.6.5-3.34.1 SUSE-SU-2020:3147-1
SLE HPC 15 rmt-server 2.6.5-3.34.1 SUSE-SU-2020:3147-1
SUSE OpenStack Cloud Crowbar 9 rubygem-activesupport-4_2 4.2.9-7.9.1 SUSE-SU-2020:2929-1
SUSE OpenStack Cloud Crowbar 8 rubygem-activesupport-4_2 4.2.9-7.9.1 SUSE-SU-2020:2929-1
SUSE OpenStack Cloud 7 rubygem-activesupport-4_2 4.2.9-7.9.1 SUSE-SU-2020:2929-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed rmt-server 2.6.13-1.1 openSUSE-SU-2024:10589-1
openSUSE Tumbleweed rubygem-activesupport-6.0 6.0.4.4-1.1 openSUSE-SU-2024:11828-1
openSUSE Leap 15.2 rmt-server 2.6.5-lp152.2.3.1 openSUSE-SU-2020:1993-1
openSUSE Leap 15.2 rubygem-activesupport-5_1 5.1.4-lp152.4.3.1 openSUSE-SU-2020:1679-1
openSUSE Leap 15.1 rmt-server 2.6.5-lp151.2.18.2 openSUSE-SU-2020:2000-1
openSUSE Leap 15.1 rubygem-activesupport-5_1 5.1.4-lp151.3.3.1 openSUSE-SU-2020:1677-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 7 repositories

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems activesupport >= 5.0.0, < 5.2.4.3 5.2.4.3 GHSA-2p68-f74v-9wc6
RubyGems activesupport >= 6.0.0, < 6.0.3.1 6.0.3.1 GHSA-2p68-f74v-9wc6

Advisories 16

References