Vulnerability-Lookup

Search criteria

Vendor

Product

Assigner (CNA or root)

Sources

Sort by

Order

CVSS min

CVSS max

Apply ordering (override relevance)

CERTFR-2026-AVI-0948

Vulnerability from certfr_avis - Published: 2026-07-30 - Updated: 2026-07-30

Une vulnérabilité a été découverte dans Ruby on Rails activestorage. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance et une atteinte à la confidentialité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Ruby on Rails	activestorage	activestorage versions antérieures à 7.2.3.2
Ruby on Rails	activestorage	activestorage versions 8.1.x antérieures à 8.1.3.1
Ruby on Rails	activestorage	activestorage versions 8.0.x antérieures à 8.0.5.1

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby on Rails 91432

2026-07-29

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "activestorage versions ant\u00e9rieures \u00e0 7.2.3.2",
      "product": {
        "name": "activestorage",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "activestorage versions 8.1.x ant\u00e9rieures \u00e0 8.1.3.1",
      "product": {
        "name": "activestorage",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "activestorage versions 8.0.x ant\u00e9rieures \u00e0 8.0.5.1",
      "product": {
        "name": "activestorage",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-66066",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-66066"
    }
  ],
  "initial_release_date": "2026-07-30T00:00:00",
  "last_revision_date": "2026-07-30T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0948",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-07-30T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Ruby on Rails activestorage. Elle permet \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.",
  "title": "Vuln\u00e9rabilit\u00e9 dans Ruby on Rails activestorage",
  "vendor_advisories": [
    {
      "published_at": "2026-07-29",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 91432",
      "url": "https://discuss.rubyonrails.org/t/cve-2026-66066-possible-arbitrary-file-read-and-remote-code-execution-in-active-storage-variant-processing/91432"
    }
  ]
}

CERTFR-2026-AVI-0891

Vulnerability from certfr_avis - Published: 2026-07-16 - Updated: 2026-07-16

Une vulnérabilité a été découverte dans Ruby on Rails. Elle permet à un attaquant de provoquer une injection de code indirecte à distance (XSS).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Ruby on Rails	Ruby on Rails	Ruby on Rails versions antérieures à 1.7.1

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby on Rails 91359

2026-07-16

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby on Rails versions ant\u00e9rieures \u00e0 1.7.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [],
  "initial_release_date": "2026-07-16T00:00:00",
  "last_revision_date": "2026-07-16T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0891",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-07-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Ruby on Rails. Elle permet \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Vuln\u00e9rabilit\u00e9 dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": "2026-07-16",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 91359",
      "url": "https://discuss.rubyonrails.org/t/ghsa-cj75-f6xr-r4g7-possible-xss-vulnerability-with-certain-configurations-of-rails-html-sanitizer/91359"
    }
  ]
}

CERTFR-2026-AVI-0349

Vulnerability from certfr_avis - Published: 2026-03-24 - Updated: 2026-03-24

De multiples vulnérabilités ont été découvertes dans les produits Ruby on Rails. Certaines d'entre elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service à distance et une atteinte à l'intégrité des données.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Ruby on Rails	activestorage	activestorage versions 8.0.x antérieures à 8.0.4.1
Ruby on Rails	activesupport	activesupport versions antérieures à 7.2.3.1
Ruby on Rails	actionview	actionview versions 8.0.x antérieures à 8.0.4.1
Ruby on Rails	actionpack	actionpack versions 8.1.x antérieures à 8.1.2.1
Ruby on Rails	activesupport	activesupport versions 8.1.x antérieures à 8.1.2.1
Ruby on Rails	actionview	actionview versions 8.1.x antérieures à 8.1.2.1
Ruby on Rails	actionview	actionview versions antérieures à 7.2.3.1
Ruby on Rails	activestorage	activestorage versions antérieures à 7.2.3.1
Ruby on Rails	activesupport	activesupport versions 8.0.x antérieures à 8.0.4.1
Ruby on Rails	activestorage	activestorage versions 8.1.x antérieures à 8.1.2.1

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby on Rails 90912	2026-03-23	vendor-advisory
Bulletin de sécurité Ruby on Rails 90911	2026-03-23	vendor-advisory
Bulletin de sécurité Ruby on Rails 90910	2026-03-23	vendor-advisory
Bulletin de sécurité Ruby on Rails 90913	2026-03-23	vendor-advisory
Bulletin de sécurité Ruby on Rails 90906	2026-03-23	vendor-advisory
Bulletin de sécurité Ruby on Rails 90908	2026-03-23	vendor-advisory
Bulletin de sécurité Ruby on Rails 90903	2026-03-23	vendor-advisory
Bulletin de sécurité Ruby on Rails 90904	2026-03-23	vendor-advisory
Bulletin de sécurité Ruby on Rails 90909	2026-03-23	vendor-advisory
Bulletin de sécurité Ruby on Rails 90907	2026-03-23	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "activestorage versions 8.0.x ant\u00e9rieures \u00e0 8.0.4.1",
      "product": {
        "name": "activestorage",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "activesupport versions ant\u00e9rieures \u00e0 7.2.3.1",
      "product": {
        "name": "activesupport",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "actionview versions 8.0.x ant\u00e9rieures \u00e0 8.0.4.1",
      "product": {
        "name": "actionview",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "actionpack versions 8.1.x ant\u00e9rieures \u00e0 8.1.2.1",
      "product": {
        "name": "actionpack",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "activesupport versions 8.1.x ant\u00e9rieures \u00e0 8.1.2.1",
      "product": {
        "name": "activesupport",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "actionview versions 8.1.x ant\u00e9rieures \u00e0 8.1.2.1",
      "product": {
        "name": "actionview",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "actionview versions ant\u00e9rieures \u00e0 7.2.3.1",
      "product": {
        "name": "actionview",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "activestorage versions ant\u00e9rieures \u00e0 7.2.3.1",
      "product": {
        "name": "activestorage",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "activesupport versions 8.0.x ant\u00e9rieures \u00e0 8.0.4.1",
      "product": {
        "name": "activesupport",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "activestorage versions 8.1.x ant\u00e9rieures \u00e0 8.1.2.1",
      "product": {
        "name": "activestorage",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2026-33202",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33202"
    },
    {
      "name": "CVE-2026-33168",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33168"
    },
    {
      "name": "CVE-2026-33658",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33658"
    },
    {
      "name": "CVE-2026-33169",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33169"
    },
    {
      "name": "CVE-2026-33195",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33195"
    },
    {
      "name": "CVE-2026-33173",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33173"
    },
    {
      "name": "CVE-2026-33176",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33176"
    },
    {
      "name": "CVE-2026-33174",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33174"
    },
    {
      "name": "CVE-2026-33167",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33167"
    },
    {
      "name": "CVE-2026-33170",
      "url": "https://www.cve.org/CVERecord?id=CVE-2026-33170"
    }
  ],
  "initial_release_date": "2026-03-24T00:00:00",
  "last_revision_date": "2026-03-24T00:00:00",
  "links": [],
  "reference": "CERTFR-2026-AVI-0349",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2026-03-24T00:00:00.000000"
    },
    {
      "description": "Correction des r\u00e9f\u00e9rences CVE",
      "revision_date": "2026-03-24T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans les produits Ruby on Rails. Certaines d\u0027entre elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance, un d\u00e9ni de service \u00e0 distance et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": "2026-03-23",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 90912",
      "url": "https://discuss.rubyonrails.org/t/cve-2026-33168-possible-xss-vulnerability-in-action-view-tag-helpers/90912"
    },
    {
      "published_at": "2026-03-23",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 90911",
      "url": "https://discuss.rubyonrails.org/t/cve-2026-33169-possible-redos-vulnerability-in-number-to-delimited-in-active-support/90911"
    },
    {
      "published_at": "2026-03-23",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 90910",
      "url": "https://discuss.rubyonrails.org/t/cve-2026-33170-possible-xss-vulnerability-in-safebuffer-in-active-support/90910"
    },
    {
      "published_at": "2026-03-23",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 90913",
      "url": "https://discuss.rubyonrails.org/t/cve-2026-33167-possible-xss-vulnerability-in-action-pack-debug-exceptions/90913"
    },
    {
      "published_at": "2026-03-23",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 90906",
      "url": "https://discuss.rubyonrails.org/t/cve-2026-33658-possible-dos-vulnerability-in-active-storage-proxy-mode-via-multi-range-requests/90906"
    },
    {
      "published_at": "2026-03-23",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 90908",
      "url": "https://discuss.rubyonrails.org/t/cve-2026-33174-possible-dos-vulnerability-in-active-storage-proxy-mode-via-range-requests/90908"
    },
    {
      "published_at": "2026-03-23",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 90903",
      "url": "https://discuss.rubyonrails.org/t/cve-2026-33202-possible-glob-injection-in-active-storage-diskservice/90903"
    },
    {
      "published_at": "2026-03-23",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 90904",
      "url": "https://discuss.rubyonrails.org/t/cve-2026-33195-possible-path-traversal-in-active-storage-diskservice/90904"
    },
    {
      "published_at": "2026-03-23",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 90909",
      "url": "https://discuss.rubyonrails.org/t/cve-2026-33173-insufficient-filtering-of-metadata-in-active-storage-direct-uploads/90909"
    },
    {
      "published_at": "2026-03-23",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 90907",
      "url": "https://discuss.rubyonrails.org/t/cve-2026-33176-possible-dos-vulnerability-in-active-support-number-helpers/90907"
    }
  ]
}

CERTFR-2025-AVI-0692

Vulnerability from certfr_avis - Published: 2025-08-14 - Updated: 2025-08-14

De multiples vulnérabilités ont été découvertes dans Ruby on Rails. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Ruby on Rails	activerecord	activerecord versions 7.2.x antérieures à 7.2.2.2
Ruby on Rails	activestorage	activestorage versions 8.x antérieures à 8.0.2.1
Ruby on Rails	activestorage	activestorage versions antérieures à 7.1.5.2
Ruby on Rails	activerecord	activerecord versions antérieures à 7.1.5.2
Ruby on Rails	activestorage	activestorage versions 7.2.x antérieures à 7.2.2.2
Ruby on Rails	activerecord	activerecord versions 8.x antérieures à 8.0.2.1

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby on Rails 89670	2025-08-13	vendor-advisory
Bulletin de sécurité Ruby on Rails 89669	2025-08-13	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "activerecord versions 7.2.x ant\u00e9rieures \u00e0 7.2.2.2",
      "product": {
        "name": "activerecord",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "activestorage versions 8.x ant\u00e9rieures \u00e0 8.0.2.1",
      "product": {
        "name": "activestorage",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "activestorage versions ant\u00e9rieures \u00e0 7.1.5.2",
      "product": {
        "name": "activestorage",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "activerecord versions ant\u00e9rieures \u00e0 7.1.5.2",
      "product": {
        "name": "activerecord",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "activestorage versions 7.2.x ant\u00e9rieures \u00e0 7.2.2.2",
      "product": {
        "name": "activestorage",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "activerecord versions 8.x ant\u00e9rieures \u00e0 8.0.2.1",
      "product": {
        "name": "activerecord",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2025-24293",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-24293"
    },
    {
      "name": "CVE-2025-55193",
      "url": "https://www.cve.org/CVERecord?id=CVE-2025-55193"
    }
  ],
  "initial_release_date": "2025-08-14T00:00:00",
  "last_revision_date": "2025-08-14T00:00:00",
  "links": [],
  "reference": "CERTFR-2025-AVI-0692",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2025-08-14T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Ruby on Rails. Elles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": "2025-08-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 89670",
      "url": "https://discuss.rubyonrails.org/t/cve-2025-24293-active-storage-allowed-transformation-methods-potentially-unsafe/89670"
    },
    {
      "published_at": "2025-08-13",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 89669",
      "url": "https://discuss.rubyonrails.org/t/cve-2025-55193-ansi-escape-injection-in-active-record-logging/89669"
    }
  ]
}

CERTFR-2024-AVI-1060

Vulnerability from certfr_avis - Published: 2024-12-11 - Updated: 2024-12-11

De multiples vulnérabilités ont été découvertes dans Ruby on Rails. Elles permettent à un attaquant de provoquer une injection de code indirecte à distance (XSS) et un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Ruby on Rails	actionpack	actionpack versions 7.1.x antérieures à 7.1.5.1
Ruby on Rails	actionpack	actionpack versions 5.2.x à 7.0.x antérieures à 7.0.8.7
Ruby on Rails	actionpack	actionpack versions 8.0.0.x antérieures à 8.0.0.1
Ruby on Rails	actionpack	actionpack versions 7.2.x antérieures à 7.2.2.1

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby on Rails 88178

2024-12-10

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "actionpack versions 7.1.x ant\u00e9rieures \u00e0 7.1.5.1",
      "product": {
        "name": "actionpack",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "actionpack versions 5.2.x \u00e0 7.0.x ant\u00e9rieures \u00e0 7.0.8.7",
      "product": {
        "name": "actionpack",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "actionpack versions 8.0.0.x ant\u00e9rieures \u00e0 8.0.0.1",
      "product": {
        "name": "actionpack",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "actionpack versions 7.2.x ant\u00e9rieures \u00e0 7.2.2.1",
      "product": {
        "name": "actionpack",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-54133",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-54133"
    }
  ],
  "initial_release_date": "2024-12-11T00:00:00",
  "last_revision_date": "2024-12-11T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-1060",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-12-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Ruby on Rails. Elles permettent \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0 distance (XSS) et un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": "2024-12-10",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 88178",
      "url": "https://discuss.rubyonrails.org/t/cve-2024-54133-possible-content-security-policy-bypass-in-action-dispatch/88178"
    }
  ]
}

CERTFR-2024-AVI-1034

Vulnerability from certfr_avis - Published: 2024-12-03 - Updated: 2024-12-03

De multiples vulnérabilités ont été découvertes dans Ruby on Rails. Elles permettent à un attaquant de provoquer une injection de code indirecte à distance (XSS).

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

	Vendor	Product	Description
	Ruby on Rails	rails-html-sanitizer	rails-html-sanitizer versions v1.6.x antérieures à v1.6.1

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby on Rails 88092

2024-12-02

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "rails-html-sanitizer versions v1.6.x ant\u00e9rieures \u00e0 v1.6.1",
      "product": {
        "name": "rails-html-sanitizer",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-53989",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-53989"
    },
    {
      "name": "CVE-2024-53988",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-53988"
    },
    {
      "name": "CVE-2024-53985",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-53985"
    },
    {
      "name": "CVE-2024-53987",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-53987"
    },
    {
      "name": "CVE-2024-53986",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-53986"
    }
  ],
  "initial_release_date": "2024-12-03T00:00:00",
  "last_revision_date": "2024-12-03T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-1034",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-12-03T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Ruby on Rails. Elles permettent \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0 distance (XSS).",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": "2024-12-02",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 88092",
      "url": "https://discuss.rubyonrails.org/t/rails-html-sanitizer-v1-6-1-addresses-multiple-cves/88092"
    }
  ]
}

CERTFR-2024-AVI-0889

Vulnerability from certfr_avis - Published: 2024-10-16 - Updated: 2024-10-16

De multiples vulnérabilités ont été découvertes dans Ruby on Rails. Elles permettent à un attaquant de provoquer un déni de service à distance.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 7.2.x antérieures à 7.2.1.1
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 7.0.x antérieures à 7.0.8.5
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 7.1.x antérieures à 7.1.4.1
Ruby on Rails	Ruby on Rails	Ruby on Rails versions antérieures à 6.1.7.9

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby on Rails 87695	2024-10-15	vendor-advisory
Bulletin de sécurité Ruby on Rails 87696	2024-10-15	vendor-advisory
Bulletin de sécurité Ruby on Rails 87698	2024-10-15	vendor-advisory
Bulletin de sécurité Ruby on Rails 87699	2024-10-15	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby on Rails versions 7.2.x ant\u00e9rieures \u00e0 7.2.1.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions 7.0.x ant\u00e9rieures \u00e0 7.0.8.5",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions 7.1.x ant\u00e9rieures \u00e0 7.1.4.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions ant\u00e9rieures \u00e0 6.1.7.9",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-47888",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47888"
    },
    {
      "name": "CVE-2024-47887",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47887"
    },
    {
      "name": "CVE-2024-28103",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-28103"
    },
    {
      "name": "CVE-2024-41128",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-41128"
    },
    {
      "name": "CVE-2024-32464",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-32464"
    },
    {
      "name": "CVE-2024-47889",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-47889"
    }
  ],
  "initial_release_date": "2024-10-16T00:00:00",
  "last_revision_date": "2024-10-16T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0889",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-10-16T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Ruby on Rails. Elles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": "2024-10-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 87695",
      "url": "https://discuss.rubyonrails.org/t/cve-2024-47889-possible-redos-vulnerability-in-block-format-in-action-mailer/87695"
    },
    {
      "published_at": "2024-10-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 87696",
      "url": "https://discuss.rubyonrails.org/t/cve-2024-47888-possible-redos-vulnerability-in-plain-text-for-blockquote-node-in-action-text/87696"
    },
    {
      "published_at": "2024-10-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 87698",
      "url": "https://discuss.rubyonrails.org/t/cve-2024-47887-possible-redos-vulnerability-in-http-token-authentication-in-action-controller/87698"
    },
    {
      "published_at": "2024-10-15",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 87699",
      "url": "https://discuss.rubyonrails.org/t/cve-2024-41128-possible-redos-vulnerability-in-query-parameter-filtering-in-action-dispatch/87699"
    }
  ]
}

CERTFR-2024-AVI-0463

Vulnerability from certfr_avis - Published: 2024-06-05 - Updated: 2024-06-05

De multiples vulnérabilités ont été découvertes dans Ruby on Rails. Elles permettent à un attaquant de provoquer une injection de code indirecte à distance (XSS), un contournement de la politique de sécurité.

Solutions

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

Impacted products

Vendor	Product	Description
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 7.0.x antérieures à 7.0.8.4
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 6.1.x antérieures à 6.1.7.8
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 7.1.x antérieures à 7.1.3.4

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby on Rails 85948	2024-06-04	vendor-advisory
Bulletin de sécurité Ruby on Rails 85949	2024-06-04	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby on Rails versions 7.0.x ant\u00e9rieures \u00e0 7.0.8.4",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions 6.1.x ant\u00e9rieures \u00e0 6.1.7.8",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions 7.1.x ant\u00e9rieures \u00e0 7.1.3.4",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "content": "## Solutions\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des correctifs (cf. section Documentation).",
  "cves": [
    {
      "name": "CVE-2024-28103",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-28103"
    },
    {
      "name": "CVE-2024-32464",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-32464"
    }
  ],
  "initial_release_date": "2024-06-05T00:00:00",
  "last_revision_date": "2024-06-05T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0463",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-06-05T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Ruby on Rails. Elles permettent \u00e0 un attaquant de provoquer une injection de code indirecte \u00e0 distance (XSS), un contournement de la politique de s\u00e9curit\u00e9.",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": "2024-06-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 85948",
      "url": "https://discuss.rubyonrails.org/t/cve-2024-28103-permissions-policy-is-only-served-on-html-content-type/85948"
    },
    {
      "published_at": "2024-06-04",
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 85949",
      "url": "https://discuss.rubyonrails.org/t/cve-2024-32464-actiontext-contentattachments-can-contain-unsanitized-html/85949"
    }
  ]
}

CERTFR-2024-AVI-0160

Vulnerability from certfr_avis - Published: 2024-02-23 - Updated: 2024-02-23

De multiples vulnérabilités ont été découvertes dans Ruby on Rails. Elles permettent à un attaquant de provoquer un déni de service à distance, une atteinte à la confidentialité des données et une injection de code indirecte à distance (XSS).

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 7.1.x antérieures à 7.1.3.1
Ruby on Rails	N/A	Rack versions 3.0.x antérieures à 3.0.9.1
Ruby on Rails	Ruby on Rails	Ruby on Rails versions antérieures à 6.1.7.7
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 7.0.x antérieures à 7.0.8.1
Ruby on Rails	N/A	Rack versions antérieures à 2.2.8.1

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby on Rails 84946 du 21 février 2024	None	vendor-advisory
Bulletin de sécurité Ruby on Rails 84941 du 21 février 2024	None	vendor-advisory
Bulletin de sécurité Ruby on Rails 84944 du 21 février 2024	None	vendor-advisory
Bulletin de sécurité Ruby on Rails 84942 du 21 février 2024	None	vendor-advisory
Bulletin de sécurité Ruby on Rails 84945 du 21 février 2024	None	vendor-advisory
Bulletin de sécurité Ruby on Rails 84947 du 21 février 2024	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby on Rails versions 7.1.x ant\u00e9rieures \u00e0 7.1.3.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Rack versions 3.0.x ant\u00e9rieures \u00e0 3.0.9.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions ant\u00e9rieures \u00e0 6.1.7.7",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions 7.0.x ant\u00e9rieures \u00e0 7.0.8.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Rack versions ant\u00e9rieures \u00e0 2.2.8.1",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2024-25126",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-25126"
    },
    {
      "name": "CVE-2024-26143",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26143"
    },
    {
      "name": "CVE-2024-26146",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26146"
    },
    {
      "name": "CVE-2024-26141",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26141"
    },
    {
      "name": "CVE-2024-26142",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26142"
    },
    {
      "name": "CVE-2024-26144",
      "url": "https://www.cve.org/CVERecord?id=CVE-2024-26144"
    }
  ],
  "initial_release_date": "2024-02-23T00:00:00",
  "last_revision_date": "2024-02-23T00:00:00",
  "links": [],
  "reference": "CERTFR-2024-AVI-0160",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2024-02-23T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Ruby on Rails.\nElles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0\ndistance, une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une injection\nde code indirecte \u00e0 distance (XSS).\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 84946 du 21 f\u00e9vrier 2024",
      "url": "https://discuss.rubyonrails.org/t/possible-redos-vulnerability-in-accept-header-parsing-in-action-dispatch/84946"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 84941 du 21 f\u00e9vrier 2024",
      "url": "https://discuss.rubyonrails.org/t/denial-of-service-vulnerability-in-rack-content-type-parsing/84941"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 84944 du 21 f\u00e9vrier 2024",
      "url": "https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 84942 du 21 f\u00e9vrier 2024",
      "url": "https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 84945 du 21 f\u00e9vrier 2024",
      "url": "https://discuss.rubyonrails.org/t/possible-sensitive-session-information-leak-in-active-storage/84945"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 84947 du 21 f\u00e9vrier 2024",
      "url": "https://discuss.rubyonrails.org/t/possible-xss-vulnerability-in-action-controller/84947"
    }
  ]
}

CERTFR-2022-AVI-639

Vulnerability from certfr_avis - Published: 2022-07-15 - Updated: 2022-07-15

Une vulnérabilité a été découverte dans Ruby on Rails. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 7.0.x antérieures à 7.0.3.1
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 6.1.x antérieures à 6.1.6.1
Ruby on Rails	Ruby on Rails	Ruby on Rails versions antérieures à 5.2.8.1
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 6.0.x antérieures à 6.0.5.1

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby on Rails MmFO3LYQE8U du 12 juillet 2022

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby on Rails versions 7.0.x ant\u00e9rieures \u00e0 7.0.3.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions 6.1.x ant\u00e9rieures \u00e0 6.1.6.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions ant\u00e9rieures \u00e0 5.2.8.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions 6.0.x ant\u00e9rieures \u00e0 6.0.5.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-32224",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-32224"
    }
  ],
  "initial_release_date": "2022-07-15T00:00:00",
  "last_revision_date": "2022-07-15T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-639",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-07-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Ruby on Rails. Elle permet \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails MmFO3LYQE8U du 12 juillet 2022",
      "url": "https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U"
    }
  ]
}

CERTFR-2022-AVI-506

Vulnerability from certfr_avis - Published: 2022-05-30 - Updated: 2022-05-30

De multiples vulnérabilités ont été découvertes dans Ruby on Rails . Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un déni de service à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 2.1.x antérieures à 2.1.4.1
Ruby on Rails	Ruby on Rails	Ruby on Rails versions antérieures à 2.0.9.1
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 2.2.x antérieures à 2.2.3.1

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby on Rails CVE-2022-30123 du 27 mai 2022	None	vendor-advisory
Bulletin de sécurité Ruby on Rails CVE-2022-30122 du 27 mai 2022	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby on Rails versions 2.1.x ant\u00e9rieures \u00e0 2.1.4.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions ant\u00e9rieures \u00e0 2.0.9.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions 2.2.x ant\u00e9rieures \u00e0 2.2.3.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-30123",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-30123"
    },
    {
      "name": "CVE-2022-30122",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-30122"
    }
  ],
  "initial_release_date": "2022-05-30T00:00:00",
  "last_revision_date": "2022-05-30T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-506",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-05-30T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Ruby on Rails .\nElles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire \u00e0 distance et un d\u00e9ni de service \u00e0 distance.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails CVE-2022-30123 du 27 mai 2022",
      "url": "https://groups.google.com/g/rubyonrails-security/c/PqEYO9ARpq0"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails CVE-2022-30122 du 27 mai 2022",
      "url": "https://groups.google.com/g/rubyonrails-security/c/J4PJo_cB-4c"
    }
  ]
}

CERTFR-2022-AVI-389

Vulnerability from certfr_avis - Published: 2022-04-27 - Updated: 2022-04-27

De multiples vulnérabilités ont été découvertes dans Ruby on Rails. Elles permettent à un attaquant de provoquer une injection de code indirecte à distance (XSS).

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 6.0.x antérieures à 6.0.4.8
Ruby on Rails	Ruby on Rails	Ruby on Rails versions antérieures à 5.2.7.1
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 7.0.x antérieures à 7.0.2.4
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 6.1.x antérieures à 6.1.5.1

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby on Rails CVE-2022-22577 du 26 avril 2022	None	vendor-advisory
Bulletin de sécurité Ruby on Rails CVE-2022-27777 du 26 avril 2022	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby on Rails versions 6.0.x ant\u00e9rieures \u00e0 6.0.4.8",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions ant\u00e9rieures \u00e0 5.2.7.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions 7.0.x ant\u00e9rieures \u00e0 7.0.2.4",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions 6.1.x ant\u00e9rieures \u00e0 6.1.5.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2022-22577",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-22577"
    },
    {
      "name": "CVE-2022-27777",
      "url": "https://www.cve.org/CVERecord?id=CVE-2022-27777"
    }
  ],
  "initial_release_date": "2022-04-27T00:00:00",
  "last_revision_date": "2022-04-27T00:00:00",
  "links": [],
  "reference": "CERTFR-2022-AVI-389",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2022-04-27T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Ruby on Rails.\nElles permettent \u00e0 un attaquant de provoquer une injection de code\nindirecte \u00e0 distance (XSS).\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails CVE-2022-22577 du 26 avril 2022",
      "url": "https://groups.google.com/g/rubyonrails-security/c/RmWxKvSNgRg"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails CVE-2022-27777 du 26 avril 2022",
      "url": "https://groups.google.com/g/rubyonrails-security/c/Yg2tEh2UUqc"
    }
  ]
}

CERTFR-2021-AVI-646

Vulnerability from certfr_avis - Published: 2021-08-20 - Updated: 2021-08-20

Une vulnérabilité a été découverte dans Ruby on Rails. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Ruby on Rails	Ruby on Rails	Ruby on Rails versions 6.1.x antérieures à 6.1.4.1
	Ruby on Rails	Ruby on Rails	Ruby on Rails versions 6.0.x antérieures à 6.0.4.1

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby on Rails du 19 août 2021

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby on Rails versions 6.1.x ant\u00e9rieures \u00e0 6.1.4.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions 6.0.x ant\u00e9rieures \u00e0 6.0.4.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-22942",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22942"
    }
  ],
  "initial_release_date": "2021-08-20T00:00:00",
  "last_revision_date": "2021-08-20T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-AVI-646",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-08-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Ruby on Rails. Elle permet \u00e0 un\nattaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails du 19 ao\u00fbt 2021",
      "url": "https://groups.google.com/g/rubyonrails-security/c/wB5tRn7h36c"
    }
  ]
}

CERTFR-2021-AVI-352

Vulnerability from certfr_avis - Published: 2021-05-06 - Updated: 2021-05-06

De multiples vulnérabilités ont été découvertes dans Ruby-on-rails. Elles permettent à un attaquant de provoquer un déni de service, un contournement de la politique de sécurité et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Ruby on Rails	Ruby on Rails	Ruby on Rails versions antérieures à 6.1.3.2

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby NiQl-48cXYI du 6 mai 2021	None	vendor-advisory
Bulletin de sécurité Ruby Pf1TjkOBdyQ du 6 mai 2021	None	vendor-advisory
Bulletin de sécurité Ruby 8TxqXEtgSF0 du 6 mai 2021	None	vendor-advisory
Bulletin de sécurité Ruby _5ID_ld9u1c du 6 mai 2021	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby on Rails versions ant\u00e9rieures \u00e0 6.1.3.2",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-22904",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22904"
    },
    {
      "name": "CVE-2021-22885",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22885"
    },
    {
      "name": "CVE-2021-22902",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22902"
    },
    {
      "name": "CVE-2021-22903",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22903"
    }
  ],
  "initial_release_date": "2021-05-06T00:00:00",
  "last_revision_date": "2021-05-06T00:00:00",
  "links": [],
  "reference": "CERTFR-2021-AVI-352",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-05-06T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Ruby-on-rails.\nElles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service, un\ncontournement de la politique de s\u00e9curit\u00e9 et une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby NiQl-48cXYI du 6 mai 2021",
      "url": "https://groups.google.com/g/rubyonrails-security/c/NiQl-48cXYI"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby Pf1TjkOBdyQ du 6 mai 2021",
      "url": "https://groups.google.com/g/rubyonrails-security/c/Pf1TjkOBdyQ"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby 8TxqXEtgSF0 du 6 mai 2021",
      "url": "https://groups.google.com/g/rubyonrails-security/c/8TxqXEtgSF0"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby _5ID_ld9u1c du 6 mai 2021",
      "url": "https://groups.google.com/g/rubyonrails-security/c/_5ID_ld9u1c"
    }
  ]
}

CERTFR-2021-AVI-115

Vulnerability from certfr_avis - Published: 2021-02-11 - Updated: 2021-02-11

De multiples vulnérabilités ont été découvertes dans Ruby on Rails. Elles permettent à un attaquant de provoquer un déni de service à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 4.2.0 à 5.2.x antérieures à 5.2.4.5
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 6.0 antérieures à 6.0.3.5
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 6.1 antérieures à 6.1.2.1

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby on Rails du 11 février 2021	None	vendor-advisory
Bulletin de sécurité Ruby on Rails du 11 février 2021	-	other
Bulletin de sécurité Ruby on Rails du 11 février 2021	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby on Rails versions 4.2.0 \u00e0 5.2.x ant\u00e9rieures \u00e0 5.2.4.5",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions 6.0 ant\u00e9rieures \u00e0 6.0.3.5",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions 6.1 ant\u00e9rieures \u00e0 6.1.2.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2021-22880",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22880"
    },
    {
      "name": "CVE-2021-22881",
      "url": "https://www.cve.org/CVERecord?id=CVE-2021-22881"
    }
  ],
  "initial_release_date": "2021-02-11T00:00:00",
  "last_revision_date": "2021-02-11T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails du 11 f\u00e9vrier 2021",
      "url": "https://groups.google.com/g/rubyonrails-security/c/zN_3qA26l6E"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails du 11 f\u00e9vrier 2021",
      "url": "https://groups.google.com/g/rubyonrails-security/c/ZzUqCh9vyhI"
    }
  ],
  "reference": "CERTFR-2021-AVI-115",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2021-02-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Ruby on Rails.\nElles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0\ndistance et un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails du 11 f\u00e9vrier 2021",
      "url": null
    }
  ]
}

CERTFR-2020-AVI-380

Vulnerability from certfr_avis - Published: 2020-06-19 - Updated: 2020-06-19

Une vulnérabilité a été découverte dans Ruby on Rails. Elle permet à un attaquant de provoquer un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Ruby on Rails	Ruby on Rails	Ruby on Rails versions 6.x antérieures à 6.0.3.2

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby on Rails du 17 juin 2020

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby on Rails versions 6.x ant\u00e9rieures \u00e0 6.0.3.2",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-8185",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-8185"
    }
  ],
  "initial_release_date": "2020-06-19T00:00:00",
  "last_revision_date": "2020-06-19T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-380",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-06-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Ruby on Rails. Elle permet \u00e0 un\nattaquant de provoquer un contournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails du 17 juin 2020",
      "url": "https://groups.google.com/forum/#!topic/rubyonrails-security/pAe9EV8gbM0"
    }
  ]
}

CERTFR-2020-AVI-301

Vulnerability from certfr_avis - Published: 2020-05-19 - Updated: 2020-05-19

De multiples vulnérabilités ont été découvertes dans Ruby on Rails. Elles permettent à un attaquant de provoquer un problème de sécurité non spécifié par l'éditeur, un contournement de la politique de sécurité et une injection de requêtes illégitimes par rebond (CSRF).

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Ruby on Rails	Ruby on Rails	Ruby on Rails versions 6.x antérieures à 6.0.3.1
	Ruby on Rails	Ruby on Rails	Ruby on Rails versions 5.x antérieures à 5.2.4.3

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby on Rails CVE-2020-8167 du 18 mai 2020	None	vendor-advisory
Bulletin de sécurité Ruby on Rails CVE-2020-8164 du 18 mai 2020	None	vendor-advisory
Bulletin de sécurité Ruby on Rails CVE-2020-8162 du 18 mai 2020	None	vendor-advisory
Bulletin de sécurité Ruby on Rails CVE-2020-8166 du 18 mai 2020	None	vendor-advisory
Bulletin de sécurité Ruby on Rails CVE-2020-8165 du 18 mai 2020	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby on Rails versions 6.x ant\u00e9rieures \u00e0 6.0.3.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions 5.x ant\u00e9rieures \u00e0 5.2.4.3",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-8166",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-8166"
    },
    {
      "name": "CVE-2020-8165",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-8165"
    },
    {
      "name": "CVE-2020-8164",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-8164"
    },
    {
      "name": "CVE-2020-8162",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-8162"
    },
    {
      "name": "CVE-2020-8167",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-8167"
    }
  ],
  "initial_release_date": "2020-05-19T00:00:00",
  "last_revision_date": "2020-05-19T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-301",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-05-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Non sp\u00e9cifi\u00e9 par l\u0027\u00e9diteur"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Ruby on Rails.\nElles permettent \u00e0 un attaquant de provoquer un probl\u00e8me de s\u00e9curit\u00e9 non\nsp\u00e9cifi\u00e9 par l\u0027\u00e9diteur, un contournement de la politique de s\u00e9curit\u00e9 et\nune injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF).\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails CVE-2020-8167 du 18 mai 2020",
      "url": "https://groups.google.com/forum/#!topic/rubyonrails-security/x9DixQDG9a0"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails CVE-2020-8164 du 18 mai 2020",
      "url": "https://groups.google.com/forum/#!topic/rubyonrails-security/f6ioe4sdpbY"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails CVE-2020-8162 du 18 mai 2020",
      "url": "https://groups.google.com/forum/#!topic/rubyonrails-security/PjU3946mreQ"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails CVE-2020-8166 du 18 mai 2020",
      "url": "https://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails CVE-2020-8165 du 18 mai 2020",
      "url": "https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c"
    }
  ]
}

CERTFR-2020-AVI-297

Vulnerability from certfr_avis - Published: 2020-05-18 - Updated: 2020-05-18

Une vulnérabilité a été découverte dans Ruby on Rails. Elle permet à un attaquant de provoquer une exécution de code arbitraire à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Ruby on Rails	Ruby on Rails	Ruby on Rails versions antérieures à 4.2.11.3

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby on Rails du 15 mai 2020	None	vendor-advisory
Bulletin de sécurité Ruby on Rails du 16 mai 2020	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby on Rails versions ant\u00e9rieures \u00e0 4.2.11.3",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-8163",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-8163"
    }
  ],
  "initial_release_date": "2020-05-18T00:00:00",
  "last_revision_date": "2020-05-18T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-297",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-05-18T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Ruby on Rails. Elle permet \u00e0 un\nattaquant de provoquer une ex\u00e9cution de code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails du 15 mai 2020",
      "url": "https://groups.google.com/forum/#!topic/rubyonrails-security/hWuKcHyoKh0"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails du 16 mai 2020",
      "url": "https://weblog.rubyonrails.org/releases/"
    }
  ]
}

CERTFR-2020-AVI-270

Vulnerability from certfr_avis - Published: 2020-05-06 - Updated: 2020-05-06

Une vulnérabilité a été découverte dans Ruby on Rails . Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Ruby on Rails	Ruby on Rails	Ruby on Rails versions antérieures à 5.1.1

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby on Rails du 05 mai 2020

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby on Rails versions ant\u00e9rieures \u00e0 5.1.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-8151",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-8151"
    }
  ],
  "initial_release_date": "2020-05-06T00:00:00",
  "last_revision_date": "2020-05-06T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-270",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-05-06T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Ruby on Rails . Elle permet \u00e0 un\nattaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails du 05 mai 2020",
      "url": "https://groups.google.com/forum/#!topic/rubyonrails-security/pktoF4VmiM8"
    }
  ]
}

CERTFR-2020-AVI-165

Vulnerability from certfr_avis - Published: 2020-03-20 - Updated: 2020-03-20

Une vulnérabilité a été découverte dans Ruby on Rails. Elle permet à un attaquant de provoquer une injection de code indirecte à distance (XSS).

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Ruby on Rails	Ruby on Rails	Ruby on Rails 6.x versions antérieures à 6.0.2.2
	Ruby on Rails	Ruby on Rails	Ruby on Rails 5.2.x versions antérieures à 5.2.4

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby on Rails 55reWMM_Pg8 du 19 mars 2020

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby on Rails 6.x versions ant\u00e9rieures \u00e0 6.0.2.2",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails 5.2.x versions ant\u00e9rieures \u00e0 5.2.4",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2020-5627",
      "url": "https://www.cve.org/CVERecord?id=CVE-2020-5627"
    }
  ],
  "initial_release_date": "2020-03-20T00:00:00",
  "last_revision_date": "2020-03-20T00:00:00",
  "links": [],
  "reference": "CERTFR-2020-AVI-165",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2020-03-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Ruby on Rails. Elle permet \u00e0 un\nattaquant de provoquer une injection de code indirecte \u00e0 distance (XSS).\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails 55reWMM_Pg8 du 19 mars 2020",
      "url": "https://groups.google.com/forum/#!topic/rubyonrails-security/55reWMM_Pg8"
    }
  ]
}

CERTFR-2019-AVI-111

Vulnerability from certfr_avis - Published: 2019-03-14 - Updated: 2019-03-26

De multiples vulnérabilités ont été découvertes dans Ruby On Rails. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance, un déni de service et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Ruby on Rails	Ruby on Rails	Ruby On Rails versions 5.0.x antérieures à 5.0.7.2
Ruby on Rails	Ruby on Rails	Ruby On Rails versions 4.2.x antérieures à 4.2.11.1
Ruby on Rails	Ruby on Rails	Ruby On Rails versions 5.2.x antérieures à 5.2.2.1
Ruby on Rails	Ruby on Rails	Ruby On Rails versions 5.1.x antérieures à 5.1.6.2
Ruby on Rails	Ruby on Rails	Ruby On Rails versions 6.0.0.x antérieures à 6.0.0.beta3

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby On Rails CVE-2019-5418 Amendment du 22 mars 2019	None	vendor-advisory
Bulletin de sécurité Ruby On Rails CVE-2019-5418 du 13 mars 2019	None	vendor-advisory
Bulletin de sécurité Ruby On Rails CVE-2019-5419 du 13 mars 2019	None	vendor-advisory
Bulletin de sécurité Ruby On Rails CVE-2019-5420 du 13 mars 2019	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby On Rails versions 5.0.x ant\u00e9rieures \u00e0 5.0.7.2",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby On Rails versions 4.2.x ant\u00e9rieures \u00e0 4.2.11.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby On Rails versions 5.2.x ant\u00e9rieures \u00e0 5.2.2.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby On Rails versions 5.1.x ant\u00e9rieures \u00e0 5.1.6.2",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby On Rails versions 6.0.0.x ant\u00e9rieures \u00e0 6.0.0.beta3",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2019-5419",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-5419"
    },
    {
      "name": "CVE-2019-5418",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-5418"
    },
    {
      "name": "CVE-2019-5420",
      "url": "https://www.cve.org/CVERecord?id=CVE-2019-5420"
    }
  ],
  "initial_release_date": "2019-03-14T00:00:00",
  "last_revision_date": "2019-03-26T00:00:00",
  "links": [],
  "reference": "CERTFR-2019-AVI-111",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2019-03-14T00:00:00.000000"
    },
    {
      "description": "Ajout d\u0027un bulletin de s\u00e9curit\u00e9",
      "revision_date": "2019-03-26T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "D\u00e9ni de service"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Ruby On Rails.\nElles permettent \u00e0 un attaquant de provoquer une ex\u00e9cution de code\narbitraire \u00e0 distance, un d\u00e9ni de service et une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Ruby On Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby On Rails CVE-2019-5418 Amendment du 22 mars 2019",
      "url": "https://groups.google.com/forum/#!topic/rubyonrails-security/zRNVOUhKHrg"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby On Rails CVE-2019-5418 du 13 mars 2019",
      "url": "https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby On Rails CVE-2019-5419 du 13 mars 2019",
      "url": "https://groups.google.com/forum/#!topic/rubyonrails-security/GN7w9fFAQeI"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby On Rails CVE-2019-5420 du 13 mars 2019",
      "url": "https://groups.google.com/forum/#!topic/rubyonrails-security/IsQKvDqZdKw"
    }
  ]
}

CERTFR-2018-AVI-532

Vulnerability from certfr_avis - Published: 2018-11-06 - Updated: 2018-11-06

De multiples vulnérabilités ont été découvertes dans Ruby On Rails. Elles permettent à un attaquant de provoquer un déni de service à distance et une injection de code indirecte à distance (XSS).

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Ruby on Rails	Ruby on Rails	Ruby On Rails toutes versions inférieures à 2.0.6 et 1.6.11

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby On Rails CVE-2018-16470 du 5 novembre 2018	None	vendor-advisory
Bulletin de sécurité Ruby On Rails CVE-2018-16471 du 5 novembre 2018	None	vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby On Rails toutes versions inf\u00e9rieures \u00e0 2.0.6 et 1.6.11",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2018-16470",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-16470"
    },
    {
      "name": "CVE-2018-16471",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-16471"
    }
  ],
  "initial_release_date": "2018-11-06T00:00:00",
  "last_revision_date": "2018-11-06T00:00:00",
  "links": [],
  "reference": "CERTFR-2018-AVI-532",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2018-11-06T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance (XSS)"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 d\u00e9couvertes dans Ruby On Rails.\nElles permettent \u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0\ndistance et une injection de code indirecte \u00e0 distance (XSS).\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Ruby On Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby On Rails CVE-2018-16470 du 5 novembre 2018",
      "url": "https://groups.google.com/forum/#!topic/rubyonrails-security/U_x-YkfuVTg"
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby On Rails CVE-2018-16471 du 5 novembre 2018",
      "url": "https://groups.google.com/forum/#!topic/rubyonrails-security/GKsAFT924Ag"
    }
  ]
}

CERTFR-2018-AVI-297

Vulnerability from certfr_avis - Published: 2018-06-20 - Updated: 2018-06-20

Une vulnérabilité a été découverte dans Ruby On Rails. Elle permet à un attaquant de provoquer une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Ruby on Rails	Ruby on Rails	Ruby On Rails versions 4.0.0.beta7 et antérieures
Ruby on Rails	Ruby on Rails	Ruby On Rails versions 2.12.4 et antérieures
Ruby on Rails	Ruby on Rails	Ruby On Rails versions 3.7.1 et antérieures

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby On Rails [CVE-2018-3760] du 19 juin 2018

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby On Rails versions 4.0.0.beta7 et ant\u00e9rieures",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby On Rails versions 2.12.4 et ant\u00e9rieures",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby On Rails versions 3.7.1 et ant\u00e9rieures",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2018-3760",
      "url": "https://www.cve.org/CVERecord?id=CVE-2018-3760"
    }
  ],
  "initial_release_date": "2018-06-20T00:00:00",
  "last_revision_date": "2018-06-20T00:00:00",
  "links": [],
  "reference": "CERTFR-2018-AVI-297",
  "revisions": [
    {
      "description": "Version initiale",
      "revision_date": "2018-06-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 d\u00e9couverte dans Ruby On Rails. Elle permet \u00e0 un\nattaquant de provoquer une atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Ruby On Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby On Rails [CVE-2018-3760] du 19 juin 2018",
      "url": "https://groups.google.com/forum/#!topic/rubyonrails-security/ft_J--l55fM"
    }
  ]
}

CERTFR-2016-AVI-075

Vulnerability from certfr_avis - Published: 2016-03-01 - Updated: 2016-03-01

De multiples vulnérabilités ont été corrigées dans Ruby On Rails. Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et une atteinte à la confidentialité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 4.1.x antérieures à 4.1.14.2
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 4.0.x
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 4.2.x antérieures à 4.2.5.2
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 3.2.X antérieures à 3.2.22.2

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby On Rails [CVE-2016-2098] du 29 février 2016	None	vendor-advisory
Bulletin de sécurité Ruby On Rails [CVE-2016-2097] du 29 février 2016	None	vendor-advisory
Bulletin de sécurité Ruby On Rails [CVE-2016-2098] du 29 février 2016 _Q/WLoOhcMZIAAJ#!msg/rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ	-	other
Bulletin de sécurité Ruby On Rails [CVE-2016-2097] du 29 février 2016 /we0RasMZIAAJ#!msg/rubyonrails-security/ddY6HgqB2z4/we0RasMZIAAJ	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby on Rails versions 4.1.x ant\u00e9rieures \u00e0 4.1.14.2",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions 4.0.x",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions 4.2.x ant\u00e9rieures \u00e0 4.2.5.2",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions 3.2.X ant\u00e9rieures \u00e0 3.2.22.2",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2016-2098",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-2098"
    },
    {
      "name": "CVE-2016-2097",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-2097"
    }
  ],
  "initial_release_date": "2016-03-01T00:00:00",
  "last_revision_date": "2016-03-01T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby On Rails [CVE-2016-2098] du 29    f\u00e9vrier 2016      _Q/WLoOhcMZIAAJ#!msg/rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ",
      "url": "https://groups.google.com/forum/?_escaped_fragment_=msg/rubyonrails-security/ly-IH-fxr"
    },
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby On Rails [CVE-2016-2097] du 29    f\u00e9vrier 2016      /we0RasMZIAAJ#!msg/rubyonrails-security/ddY6HgqB2z4/we0RasMZIAAJ",
      "url": "https://groups.google.com/forum/?_escaped_fragment_=msg/rubyonrails-security/ddY6HgqB2z4"
    }
  ],
  "reference": "CERTFR-2016-AVI-075",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2016-03-01T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eRuby On Rails\u003c/span\u003e. Elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance et une atteinte \u00e0\nla confidentialit\u00e9 des donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Ruby On Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby On Rails [CVE-2016-2098] du 29 f\u00e9vrier 2016",
      "url": null
    },
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby On Rails [CVE-2016-2097] du 29 f\u00e9vrier 2016",
      "url": null
    }
  ]
}

CERTFR-2016-AVI-037

Vulnerability from certfr_avis - Published: 2016-01-26 - Updated: 2016-01-26

De multiples vulnérabilités ont été corrigées dans Ruby On Rails. Certaines d'entre elles permettent à un attaquant de provoquer un déni de service à distance, un contournement de la politique de sécurité et une atteinte à l'intégrité des données.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 4.1.x antérieures à 4.1.14.1
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 4.2.x antérieures à 4.2.5.1
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 5.0.x antérieures à 5.0.0.beta1.1
Ruby on Rails	Ruby on Rails	Ruby on Rails versions 3.2.x antérieures à 3.2.22.1

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby On Rails du 25 janvier 2016	None	vendor-advisory
Ruby On Rails groups.google.com	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby on Rails versions 4.1.x ant\u00e9rieures \u00e0 4.1.14.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions 4.2.x ant\u00e9rieures \u00e0 4.2.5.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions 5.0.x ant\u00e9rieures \u00e0 5.0.0.beta1.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions 3.2.x ant\u00e9rieures \u00e0 3.2.22.1",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2016-0752",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-0752"
    },
    {
      "name": "CVE-2016-0753",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-0753"
    },
    {
      "name": "CVE-2015-7578",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-7578"
    },
    {
      "name": "CVE-2015-7581",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-7581"
    },
    {
      "name": "CVE-2015-7579",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-7579"
    },
    {
      "name": "CVE-2016-0751",
      "url": "https://www.cve.org/CVERecord?id=CVE-2016-0751"
    },
    {
      "name": "CVE-2015-7576",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-7576"
    },
    {
      "name": "CVE-2015-7577",
      "url": "https://www.cve.org/CVERecord?id=CVE-2015-7577"
    }
  ],
  "initial_release_date": "2016-01-26T00:00:00",
  "last_revision_date": "2016-01-26T00:00:00",
  "links": [
    {
      "title": "Ruby On Rails groups.google.com",
      "url": "https://groups.google.com/forum/?_escaped_fragment_=forum/rubyonrails-security#!forum/rubyonrails-security"
    }
  ],
  "reference": "CERTFR-2016-AVI-037",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2016-01-26T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de requ\u00eates ill\u00e9gitimes par rebond (CSRF)"
    },
    {
      "description": "Atteinte \u00e0 l\u0027int\u00e9grit\u00e9 des donn\u00e9es"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    },
    {
      "description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eRuby On Rails\u003c/span\u003e. Certaines d\u0027entre elles permettent\n\u00e0 un attaquant de provoquer un d\u00e9ni de service \u00e0 distance, un\ncontournement de la politique de s\u00e9curit\u00e9 et une atteinte \u00e0 l\u0027int\u00e9grit\u00e9\ndes donn\u00e9es.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Ruby On Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby On Rails du 25 janvier 2016",
      "url": "http://weblog.rubyonrails.org/"
    }
  ]
}

CERTFR-2014-AVI-077

Vulnerability from certfr_avis - Published: 2014-02-19 - Updated: 2014-02-19

De multiples vulnérabilités ont été corrigées dans Ruby On Rails. Elles permettent à un attaquant de provoquer un déni de service à distance et une injection de code indirecte à distance (XSS).

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Ruby on Rails	Ruby on Rails	Ruby On Rails versions antérieures à 4.0.3
Ruby on Rails	Ruby on Rails	Ruby On Rails versions antérieures à 4.1.0beta2
Ruby on Rails	Ruby on Rails	Ruby On Rails versions antérieures à 3.2.17

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby On Rails du 18 février 2014

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby On Rails versions ant\u00e9rieures \u00e0 4.0.3",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby On Rails versions ant\u00e9rieures \u00e0 4.1.0beta2",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby On Rails versions ant\u00e9rieures \u00e0 3.2.17",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2014-0082",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-0082"
    },
    {
      "name": "CVE-2014-0080",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-0080"
    },
    {
      "name": "CVE-2014-0081",
      "url": "https://www.cve.org/CVERecord?id=CVE-2014-0081"
    }
  ],
  "initial_release_date": "2014-02-19T00:00:00",
  "last_revision_date": "2014-02-19T00:00:00",
  "links": [],
  "reference": "CERTFR-2014-AVI-077",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2014-02-19T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eRuby On Rails\u003c/span\u003e. Elles permettent \u00e0 un attaquant de\nprovoquer un d\u00e9ni de service \u00e0 distance et une injection de code\nindirecte \u00e0 distance (XSS).\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Ruby On Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby On Rails du 18 f\u00e9vrier 2014",
      "url": "http://weblog.rubyonrails.org/2014/2/18/Rails_3_2_17_4_0_3_and_4_1_0_beta2_have_been_released/"
    }
  ]
}

CERTA-2013-AVI-193

Vulnerability from certfr_avis - Published: 2013-03-20 - Updated: 2013-03-20

De multiples vulnérabilités ont été corrigées dans Ruby on Rails. Elles permettent à un attaquant de provoquer un déni de service à distance et une injection de code indirecte à distance (XSS).

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Ruby on Rails	Ruby on Rails	versions antérieures à Ruby on Rails 3.1.12 (pour la branche 3.1)
Ruby on Rails	Ruby on Rails	versions antérieures à Ruby on Rails 2.3.18
Ruby on Rails	Ruby on Rails	Versions antérieures à Ruby on Rails 3.2.13 (pour la branche 3.2)

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby on Rails du 18 mars 2013

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "versions ant\u00e9rieures \u00e0 Ruby on Rails 3.1.12 (pour la branche 3.1)",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "versions ant\u00e9rieures \u00e0 Ruby on Rails 2.3.18",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Versions ant\u00e9rieures \u00e0 Ruby on Rails 3.2.13 (pour la branche 3.2)",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2013-1856",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-1856"
    },
    {
      "name": "CVE-2013-1855",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-1855"
    },
    {
      "name": "CVE-2013-1854",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-1854"
    },
    {
      "name": "CVE-2013-1857",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-1857"
    }
  ],
  "initial_release_date": "2013-03-20T00:00:00",
  "last_revision_date": "2013-03-20T00:00:00",
  "links": [],
  "reference": "CERTA-2013-AVI-193",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2013-03-20T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "D\u00e9ni de service \u00e0 distance"
    },
    {
      "description": "Injection de code indirecte \u00e0 distance"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eRuby on Rails\u003c/span\u003e. Elles permettent \u00e0 un attaquant de\nprovoquer un d\u00e9ni de service \u00e0 distance et une injection de code\nindirecte \u00e0 distance (XSS).\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails du 18 mars 2013",
      "url": "http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/"
    }
  ]
}

CERTA-2013-AVI-133

Vulnerability from certfr_avis - Published: 2013-02-15 - Updated: 2013-02-15

De multiples vulnérabilités ont été corrigées dans Ruby on Rails . Elles permettent à un attaquant de provoquer une exécution de code arbitraire à distance et un contournement de la politique de sécurité.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Ruby on Rails	Ruby on Rails	Ruby on Rails versions antérieures à 2.3.17
Ruby on Rails	Ruby on Rails	Ruby on Rails versions antérieures à 3.1.11
Ruby on Rails	Ruby on Rails	Ruby on Rails versions antérieures à 3.2.12

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby on Rails du 11 février 2013

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Ruby on Rails versions ant\u00e9rieures \u00e0 2.3.17",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions ant\u00e9rieures \u00e0 3.1.11",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Ruby on Rails versions ant\u00e9rieures \u00e0 3.2.12",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2013-0277",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0277"
    },
    {
      "name": "CVE-2013-0276",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0276"
    },
    {
      "name": "CVE-2013-0269",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0269"
    }
  ],
  "initial_release_date": "2013-02-15T00:00:00",
  "last_revision_date": "2013-02-15T00:00:00",
  "links": [],
  "reference": "CERTA-2013-AVI-133",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2013-02-15T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    },
    {
      "description": "Contournement de la politique de s\u00e9curit\u00e9"
    }
  ],
  "summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eRuby on Rails\u003c/span\u003e . Elles permettent \u00e0 un attaquant de\nprovoquer une ex\u00e9cution de code arbitraire \u00e0 distance et un\ncontournement de la politique de s\u00e9curit\u00e9.\n",
  "title": "Multiples vuln\u00e9rabilit\u00e9s dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails du 11 f\u00e9vrier 2013",
      "url": "http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/"
    }
  ]
}

CERTA-2013-AVI-074

Vulnerability from certfr_avis - Published: 2013-01-30 - Updated: 2013-01-30

Une vulnérabilité a été corrigée dans Ruby On Rails. Elle concerne la partie JSON et peut mener un utilisateur malintentionné à exécuter du code arbitraire à distance.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

	Vendor	Product	Description
	Ruby on Rails	Ruby on Rails	Versions antérieures à Ruby On Rails 3.0.20 (pour la branche 3.0)
	Ruby on Rails	Ruby on Rails	versions antérieures à Ruby On Rails 2.3.16

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby On Rails du 28 janvier 2013	None	vendor-advisory
Bulletin de sécurité Ruby on Rails du 28 janvier 2013 :	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Versions ant\u00e9rieures \u00e0 Ruby On Rails 3.0.20 (pour la branche 3.0)",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "versions ant\u00e9rieures \u00e0 Ruby On Rails 2.3.16",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2013-0333",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0333"
    }
  ],
  "initial_release_date": "2013-01-30T00:00:00",
  "last_revision_date": "2013-01-30T00:00:00",
  "links": [
    {
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails du 28 janvier 2013 :",
      "url": "http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/"
    }
  ],
  "reference": "CERTA-2013-AVI-074",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2013-01-30T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Une vuln\u00e9rabilit\u00e9 a \u00e9t\u00e9 corrig\u00e9e dans \u003cspan class=\"textit\"\u003eRuby On\nRails\u003c/span\u003e. Elle concerne la partie JSON et peut mener un utilisateur\nmalintentionn\u00e9 \u00e0 ex\u00e9cuter du code arbitraire \u00e0 distance.\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans Ruby On Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby On Rails du 28 janvier 2013",
      "url": null
    }
  ]
}

CERTA-2013-AVI-024

Vulnerability from certfr_avis - Published: 2013-01-11 - Updated: 2013-01-11

Deux vulnérabilités ont été corrigées dans Ruby on Rails Elles concernent des exécutions de codes arbitraires à distance et sont considérées comme « extrêmement critiques » par l'éditeur.

Solution

Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).

None

Impacted products

Vendor	Product	Description
Ruby on Rails	Ruby on Rails	Versions antérieures à Ruby on Rails 3.2.11
Ruby on Rails	Ruby on Rails	Versions antérieures à Ruby on Rails 3.0.19
Ruby on Rails	Ruby on Rails	Versions antérieures à Ruby on Rails 2.3.15
Ruby on Rails	Ruby on Rails	Versions antérieures à Ruby on Rails 3.1.10

References

Title

Publication Time

Tags

Bulletin de sécurité Ruby on Rails du 08 janvier 2013

None

vendor-advisory

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Versions ant\u00e9rieures \u00e0 Ruby on Rails 3.2.11",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Versions ant\u00e9rieures \u00e0 Ruby on Rails 3.0.19",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Versions ant\u00e9rieures \u00e0 Ruby on Rails 2.3.15",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    },
    {
      "description": "Versions ant\u00e9rieures \u00e0 Ruby on Rails 3.1.10",
      "product": {
        "name": "Ruby on Rails",
        "vendor": {
          "name": "Ruby on Rails",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": null,
  "content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
  "cves": [
    {
      "name": "CVE-2013-0156",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0156"
    },
    {
      "name": "CVE-2013-0155",
      "url": "https://www.cve.org/CVERecord?id=CVE-2013-0155"
    }
  ],
  "initial_release_date": "2013-01-11T00:00:00",
  "last_revision_date": "2013-01-11T00:00:00",
  "links": [],
  "reference": "CERTA-2013-AVI-024",
  "revisions": [
    {
      "description": "version initiale.",
      "revision_date": "2013-01-11T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "Deux vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan class=\"textit\"\u003eRuby on\nRails\u003c/span\u003e Elles concernent des ex\u00e9cutions de codes arbitraires \u00e0\ndistance et sont consid\u00e9r\u00e9es comme \u00ab extr\u00eamement critiques \u00bb par\nl\u0027\u00e9diteur.\n",
  "title": "Vuln\u00e9rabilit\u00e9s dans Ruby on Rails",
  "vendor_advisories": [
    {
      "published_at": null,
      "title": "Bulletin de s\u00e9curit\u00e9 Ruby on Rails du 08 janvier 2013",
      "url": "http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-10-3-0-19-and-2-3-15-have-been-released/"
    }
  ]
}

Find a vulnerability

Search criteria

39 vulnerabilities by Ruby on Rails

Solutions

Solutions

Solutions

Solutions

Solutions

Solutions

Solutions

Solutions

Solution

Solution

Solution

Solution

Solution

Solution

Solution

Solution

Solution

Solution

Solution

Solution

Solution

Solution

Solution

Solution

Solution

Solution

Solution

Solution

Solution

Solution