Most recent entries from all

BREW-travis-CVE-2023-28120 — Possible XSS Security Vulnerability in SafeBuffer#bytesplice

Affected: Homebrew: travis

There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input. This vulnerability has been assigned the CVE identifier CVE-2023-28120.

Versions Affected: All. Not affected: None Fixed Versions: 7.0.4.3, 6.1.7.3

# Impact

ActiveSupport uses the SafeBuffer string subclass to tag strings as html_safe after they have been sanitized. When these strings are mutated, the tag is should be removed to mark them as no longer being html_safe.

Ruby 3.2 introduced a new bytesplice method which ActiveSupport did not yet understand to be a mutation. Users on older versions of Ruby are likely unaffected.

All users running an affected release and using bytesplice should either upgrade or use one of the workarounds immediately.

# Workarounds

Avoid calling bytesplice on a SafeBuffer (html_safe) string with untrusted user input.

certfr-2025-avi-0969 — De multiples vulnérabilités ont été découvertes dans les produits VMware. Elles permettent à un attaquant de provoquer…

certfr-2025-avi-0969

EUVD-2026-209945

fkie_cve-2023-28120

There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.

GHSA-pj73-v5mw-pm9j — Possible XSS Security Vulnerability in SafeBuffer#bytesplice

Affected: RubyGems: activesupport

There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input. This vulnerability has been assigned the CVE identifier CVE-2023-28120.

Versions Affected: All. Not affected: None Fixed Versions: 7.0.4.3, 6.1.7.3

# Impact

Ruby 3.2 introduced a new bytesplice method which ActiveSupport did not yet understand to be a mutation. Users on older versions of Ruby are likely unaffected.

All users running an affected release and using bytesplice should either upgrade or use one of the workarounds immediately.

# Workarounds

Avoid calling bytesplice on a SafeBuffer (html_safe) string with untrusted user input.

gsd-2023-28120

OESA-2024-1797 — rubygem-activesupport security update

Affected: openEuler:20.03-LTS-SP4: rubygem-activesupport

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing. Security Fix(es): A Cross-Site-Scripting vulnerability was found in rubygem ActiveSupport. If the new bytesplice method is called on a SafeBuffer with untrusted user input, malicious code could be executed.(CVE-2023-28120)

openSUSE-SU-2024:12804-1 — ruby3.1-rubygem-activesupport-7.0-7.0.4.3-1.1 on GA media

ruby3.1-rubygem-activesupport-7.0-7.0.4.3-1.1 on GA media

RHSA-2023:1953 — Red Hat Security Advisory: Logging Subsystem 5.6.5 - Red Hat OpenShift security update

rubygem-rack: denial of service in header parsing rubygem-activesupport: Possible XSS in SafeBuffer#bytesplice

SUSE-SU-2023:2280-1 — Security update for rmt-server

Security update for rmt-server

UBUNTU-CVE-2023-28120

Affected: Ubuntu:Pro:16.04:LTS: rails, Ubuntu:Pro:18.04:LTS: rails, Ubuntu:Pro:20.04:LTS: rails, Ubuntu:Pro:22.04:LTS: rails, Ubuntu:24.04:LTS: rails, Ubuntu:25.10: rails, Ubuntu:26.04:LTS: rails

There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.

WID-SEC-W-2023-0632 — Ruby on Rails: Mehrere Schwachstellen

Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um einen Cross-Site Scripting Angriff durchzuführen, unbekannte Auswirkungen zu verursachen oder einen Denial of Service Zustand herbeizuführen.