CVE-2023-38037
Active Support Possibly Discloses Locally Encrypted Files
ActiveSupport::EncryptedFile writes contents that will be encrypted to a
temporary file. The temporary file's permissions are defaulted to the user's
current umask settings, meaning that it's possible for other users on the
same system to read the contents of the temporary file.
Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Attack profile
How easy it is to exploit
- Attack vector
- Local
- Complexity
- High
- Privileges needed
- Low
- User interaction
- Required
What an attacker can affect
- Confidentiality
- High
- Integrity
- Low
- Availability
- Low
Exploit likelihood
What each source reports
CVE List Score used
ActiveSupport::EncryptedFile writes contents that will be encrypted to a
temporary file. The temporary file's permissions are defaulted to the user's
current umask settings, meaning that it's possible for other users on the
same system to read the contents of the temporary file.
Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.
All users running an affected release should either upgrade or use one of the workarounds immediately.
- Record
CVE-2023-38037- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L - Weakness
- CWE-732
- Updated
- 2026-11-02
EUVDEUVD-2023-2274
ActiveSupport::EncryptedFile writes contents that will be encrypted to a
temporary file. The temporary file's permissions are defaulted to the user's
current umask settings, meaning that it's possible for other users on the
same system to read the contents of the temporary file.
Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.
All users running an affected release should either upgrade or use one of the workarounds immediately.
- Record
EUVD-2023-2274- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L - Updated
- 2026-11-02
GitHub AdvisoriesGHSA-cr5q-6q9f-rq6q
Active Support Possibly Discloses Locally Encrypted Files
There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037.
Versions Affected: >= 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5
Impact
ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file’s permissions are defaulted to the user’s current umask settings, meaning that it’s possible for other users on the same system to read the contents of the temporary file.
Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The fixed releases are available at the normal locations.
Workarounds
To work around this issue, you can set your umask to be more restrictive like this:
$ umask 0077
- Record
GHSA-cr5q-6q9f-rq6q- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L - Weakness
- CWE-377, CWE-732
- Updated
- 2026-11-02
NVD
ActiveSupport::EncryptedFile writes contents that will be encrypted to a
temporary file. The temporary file's permissions are defaulted to the user's
current umask settings, meaning that it's possible for other users on the
same system to read the contents of the temporary file.
Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.
All users running an affected release should either upgrade or use one of the workarounds immediately.
- Record
CVE-2023-38037- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L - Weakness
- CWE-732
- Updated
- 2026-11-02
OSVDEBIAN-CVE-2023-38037
ActiveSupport::EncryptedFile writes contents that will be encrypted to a
temporary file. The temporary file's permissions are defaulted to the user's
current umask settings, meaning that it's possible for other users on the
same system to read the contents of the temporary file.
Attackers that have access to the file system could possibly read the contents
of this temporary file while a user is editing it.
All users running an affected release should either upgrade or use one of the
workarounds immediately.
- Record
DEBIAN-CVE-2023-38037- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L - Updated
- 2026-11-02
OSVGHSA-cr5q-6q9f-rq6q
Active Support Possibly Discloses Locally Encrypted Files
There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037.
Versions Affected: >= 5.2.0 Not affected: < 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5
Impact
ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file’s permissions are defaulted to the user’s current umask settings, meaning that it’s possible for other users on the same system to read the contents of the temporary file.
Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.
All users running an affected release should either upgrade or use one of the workarounds immediately.
Releases
The fixed releases are available at the normal locations.
Workarounds
To work around this issue, you can set your umask to be more restrictive like this:
$ umask 0077
- Record
GHSA-cr5q-6q9f-rq6q- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L - Weakness
- CWE-377, CWE-732
- Updated
- 2026-11-02
Show 15 moreShow less
OSVOESA-2023-1627
rubygem-railties security update
Rails internals: application bootup, plugins, generators, and rake tasks. Railties is responsible to glue all frameworks together. Overall, it: * handles all the bootstrapping process for a Rails application; * manages rails command line interface; * provides Rails generators core;
Security Fix(es):
(CVE-2023-38037)
- Record
OESA-2023-1627- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVOESA-2023-1633
rubygem-activesupport security update
A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.
Security Fix(es):
An insecure temporary file vulnerability was found in activesupport rubygem. Contents that will be encrypted are written to a temporary file that has the user’s current umask settings, possibly leading to information disclosure by other users on the same system.(CVE-2023-38037)
- Record
OESA-2023-1633- CVSS 3.1
- 3.3 Low
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N - Updated
- 2026-11-02
OSVRHSA-2024:2010
Red Hat Security Advisory: Satellite 6.15.0 release
- Record
RHSA-2024:2010- CVSS 3.1
- 7.6 High
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L - Updated
- 2026-11-02
OSVUBUNTU-CVE-2023-38037
ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file's permissions are defaulted to the user's current umask settings, meaning that it's possible for other users on the same system to read the contents of the temporary file. Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it. All users running an affected release should either upgrade or use one of the workarounds immediately.
- Record
UBUNTU-CVE-2023-38037- CVSS 3.0
- 5.5 Medium
CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L - Updated
- 2026-11-02
OSV No score
ActiveSupport::EncryptedFile writes contents that will be encrypted to a
temporary file. The temporary file's permissions are defaulted to the user's
current umask settings, meaning that it's possible for other users on the
same system to read the contents of the temporary file.
Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.
All users running an affected release should either upgrade or use one of the workarounds immediately.
- Record
CVE-2023-38037- Updated
- 2026-11-02
OSVopenSUSE-SU-2023:0350-1 No score
Security update for rubygem-activesupport-5.2
This update for rubygem-activesupport-5.2 fixes the following issue:
- CVE-2023-38037: fixed a File Disclosure of Locally Encrypted Files (bsc#1214807)
- Record
openSUSE-SU-2023:0350-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13397-1 No score
ruby3.2-rubygem-activesupport-7.0-7.0.8-1.1 on GA media
These are all security issues fixed in the ruby3.2-rubygem-activesupport-7.0-7.0.8-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13397-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13432-1 No score
ruby3.2-rubygem-activerecord-7.0-7.0.8-1.1 on GA media
These are all security issues fixed in the ruby3.2-rubygem-activerecord-7.0-7.0.8-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13432-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:13433-1 No score
ruby3.2-rubygem-rails-7.0-7.0.8-1.1 on GA media
These are all security issues fixed in the ruby3.2-rubygem-rails-7.0-7.0.8-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:13433-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14069-1 No score
ruby3.3-rubygem-activerecord-7.0-7.0.8.4-1.1 on GA media
These are all security issues fixed in the ruby3.3-rubygem-activerecord-7.0-7.0.8.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14069-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14071-1 No score
ruby3.3-rubygem-activesupport-7.0-7.0.8.4-1.1 on GA media
These are all security issues fixed in the ruby3.3-rubygem-activesupport-7.0-7.0.8.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14071-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2024:14074-1 No score
ruby3.3-rubygem-rails-7.0-7.0.8.4-1.1 on GA media
These are all security issues fixed in the ruby3.3-rubygem-rails-7.0-7.0.8.4-1.1 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2024:14074-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15112-1 No score
ruby3.4-rubygem-activerecord-7.0-7.0.8.6-1.3 on GA media
These are all security issues fixed in the ruby3.4-rubygem-activerecord-7.0-7.0.8.6-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15112-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15114-1 No score
ruby3.4-rubygem-activesupport-7.0-7.0.8.6-1.3 on GA media
These are all security issues fixed in the ruby3.4-rubygem-activesupport-7.0-7.0.8.6-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15114-1- Updated
- 2026-11-02
OSVopenSUSE-SU-2025:15124-1 No score
ruby3.4-rubygem-rails-7.0-7.0.8.6-1.3 on GA media
These are all security issues fixed in the ruby3.4-rubygem-rails-7.0-7.0.8.6-1.3 package on the GA media of openSUSE Tumbleweed.
- Record
openSUSE-SU-2025:15124-1- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
activesupportRubyGems |
5.2.0 up to 6.1.7.5 | 6.1.7.5 |
activesupportRubyGems |
7.0.0 up to 7.0.7.1 | 7.0.7.1 |
railsDebian:12 |
before 2:6.1.7.10+dfsg-1~deb12u1, plus listed versions 2:6.1.7.3+dfsg-12:6.1.7.3+dfsg-102:6.1.7.3+dfsg-112:6.1.7.3+dfsg-122:6.1.7.3+dfsg-13 Show 10 moreShow less2:6.1.7.3+dfsg-22:6.1.7.3+dfsg-2~deb12u12:6.1.7.3+dfsg-32:6.1.7.3+dfsg-42:6.1.7.3+dfsg-52:6.1.7.3+dfsg-62:6.1.7.3+dfsg-72:6.1.7.3+dfsg-7~exp12:6.1.7.3+dfsg-82:6.1.7.3+dfsg-9 |
2:6.1.7.10+dfsg-1~deb12u1 |
railsDebian:13 |
before 2:7.2.2.1+dfsg-1 | 2:7.2.2.1+dfsg-1 |
railsDebian:14 |
before 2:7.2.2.1+dfsg-1 | 2:7.2.2.1+dfsg-1 |
railsDebian:11 From an advisory covering 8 CVEs |
before 2:6.0.3.7+dfsg-2+deb11u3, plus listed versions 2:6.0.3.7+dfsg-22:6.0.3.7+dfsg-2+deb11u12:6.0.3.7+dfsg-2+deb11u2 |
2:6.0.3.7+dfsg-2+deb11u3 |
railsDebian:12 From an advisory covering 9 CVEs |
before 2:6.1.7.10+dfsg-1~deb12u1, plus listed versions 2:6.1.7.3+dfsg-12:6.1.7.3+dfsg-102:6.1.7.3+dfsg-112:6.1.7.3+dfsg-122:6.1.7.3+dfsg-13 Show 10 moreShow less2:6.1.7.3+dfsg-22:6.1.7.3+dfsg-2~deb12u12:6.1.7.3+dfsg-32:6.1.7.3+dfsg-42:6.1.7.3+dfsg-52:6.1.7.3+dfsg-62:6.1.7.3+dfsg-72:6.1.7.3+dfsg-7~exp12:6.1.7.3+dfsg-82:6.1.7.3+dfsg-9 |
2:6.1.7.10+dfsg-1~deb12u1 |
activesupportRubyGems |
5.2.0 up to 6.1.7.5, plus listed versions 5.2.15.2.1.15.2.1.rc15.2.25.2.2.1 Show 45 moreShow less5.2.2.rc15.2.35.2.3.rc15.2.45.2.4.15.2.4.25.2.4.35.2.4.45.2.4.55.2.4.65.2.4.rc15.2.55.2.65.2.6.15.2.6.25.2.6.35.2.75.2.7.15.2.85.2.8.16.0.06.0.0.beta16.0.0.beta26.0.0.beta36.0.0.rc16.0.0.rc26.0.16.0.1.rc16.0.26.0.2.16.0.2.26.0.2.rc16.0.2.rc26.0.36.0.3.16.0.3.26.0.3.36.0.3.46.0.3.56.0.3.66.0.3.76.0.3.rc16.0.46.0.4.16.0.4.2 |
6.1.7.5 |
activesupportRubyGems |
7.0.0 up to 7.0.7.1, plus listed versions 7.0.17.0.27.0.2.17.0.2.27.0.2.3 Show 11 moreShow less7.0.2.47.0.37.0.3.17.0.47.0.4.17.0.4.27.0.4.37.0.57.0.5.17.0.67.0.7 |
7.0.7.1 |
rubygem-railtiesopenEuler:20.03-LTS-SP1 |
before 5.2.4.4-5.oe1 | 5.2.4.4-5.oe1 |
Show 87 moreShow less
| Package | Affected | Fixed |
|---|---|---|
rubygem-railtiesopenEuler:20.03-LTS-SP3 |
before 5.2.4.4-5.oe1 | 5.2.4.4-5.oe1 |
rubygem-railtiesopenEuler:22.03-LTS |
before 6.1.4.1-2.oe2203sp2 | 6.1.4.1-2.oe2203sp2 |
rubygem-railtiesopenEuler:22.03-LTS-SP1 |
before 6.1.4.1-2.oe2203sp1 | 6.1.4.1-2.oe2203sp1 |
rubygem-railtiesopenEuler:22.03-LTS-SP2 |
before 6.1.4.1-2.oe2203sp2 | 6.1.4.1-2.oe2203sp2 |
rubygem-activesupportopenEuler:20.03-LTS-SP1 |
before 5.2.4.4-3.oe1 | 5.2.4.4-3.oe1 |
rubygem-activesupportopenEuler:20.03-LTS-SP3 |
before 5.2.4.4-3.oe1 | 5.2.4.4-3.oe1 |
rubygem-activesupportopenEuler:22.03-LTS |
before 6.1.4.1-5.oe2203sp2 | 6.1.4.1-5.oe2203sp2 |
rubygem-activesupportopenEuler:22.03-LTS-SP1 |
before 6.1.4.1-6.oe2203sp1 | 6.1.4.1-6.oe2203sp1 |
rubygem-activesupportopenEuler:22.03-LTS-SP2 |
before 6.1.4.1-5.oe2203sp2 | 6.1.4.1-5.oe2203sp2 |
python-pygmentsRed Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs |
before 0:2.17.0-1.el8pc | 0:2.17.0-1.el8pc |
python3.11-pygmentsRed Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs |
before 0:2.17.0-1.el8pc | 0:2.17.0-1.el8pc |
python-pygmentsRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:2.17.0-1.el8pc | 0:2.17.0-1.el8pc |
python3.11-pygmentsRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:2.17.0-1.el8pc | 0:2.17.0-1.el8pc |
foremanRed Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.1.6-1.el8sat | 0:3.9.1.6-1.el8sat |
foreman-debugRed Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.1.6-1.el8sat | 0:3.9.1.6-1.el8sat |
foremanRed Hat:satellite_utils:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.1.6-1.el8sat | 0:3.9.1.6-1.el8sat |
foreman-cliRed Hat:satellite_utils:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.1.6-1.el8sat | 0:3.9.1.6-1.el8sat |
foremanRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.1.6-1.el8sat | 0:3.9.1.6-1.el8sat |
foreman-cliRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.1.6-1.el8sat | 0:3.9.1.6-1.el8sat |
foreman-debugRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.1.6-1.el8sat | 0:3.9.1.6-1.el8sat |
foreman-dynflow-sidekiqRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.1.6-1.el8sat | 0:3.9.1.6-1.el8sat |
foreman-ec2Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.1.6-1.el8sat | 0:3.9.1.6-1.el8sat |
foreman-journaldRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.1.6-1.el8sat | 0:3.9.1.6-1.el8sat |
foreman-libvirtRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.1.6-1.el8sat | 0:3.9.1.6-1.el8sat |
foreman-openstackRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.1.6-1.el8sat | 0:3.9.1.6-1.el8sat |
foreman-ovirtRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.1.6-1.el8sat | 0:3.9.1.6-1.el8sat |
foreman-pcpRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.1.6-1.el8sat | 0:3.9.1.6-1.el8sat |
foreman-postgresqlRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.1.6-1.el8sat | 0:3.9.1.6-1.el8sat |
foreman-redisRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.1.6-1.el8sat | 0:3.9.1.6-1.el8sat |
foreman-serviceRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.1.6-1.el8sat | 0:3.9.1.6-1.el8sat |
foreman-telemetryRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.1.6-1.el8sat | 0:3.9.1.6-1.el8sat |
foreman-vmwareRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.1.6-1.el8sat | 0:3.9.1.6-1.el8sat |
python-galaxy-importerRed Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs |
before 0:0.4.19-2.el8pc | 0:0.4.19-2.el8pc |
python3.11-galaxy-importerRed Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs |
before 0:0.4.19-2.el8pc | 0:0.4.19-2.el8pc |
python-galaxy-importerRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:0.4.19-2.el8pc | 0:0.4.19-2.el8pc |
python3.11-galaxy-importerRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:0.4.19-2.el8pc | 0:0.4.19-2.el8pc |
puppetserverRed Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs |
before 0:7.14.0-1.el8sat | 0:7.14.0-1.el8sat |
puppetserverRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:7.14.0-1.el8sat | 0:7.14.0-1.el8sat |
python-aiohttpRed Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.2-1.el8pc | 0:3.9.2-1.el8pc |
python-aiohttp-debugsourceRed Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.2-1.el8pc | 0:3.9.2-1.el8pc |
python3.11-aiohttpRed Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.2-1.el8pc | 0:3.9.2-1.el8pc |
python3.11-aiohttp-debuginfoRed Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.2-1.el8pc | 0:3.9.2-1.el8pc |
python-aiohttpRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.2-1.el8pc | 0:3.9.2-1.el8pc |
python-aiohttp-debugsourceRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.2-1.el8pc | 0:3.9.2-1.el8pc |
python3.11-aiohttpRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.2-1.el8pc | 0:3.9.2-1.el8pc |
python3.11-aiohttp-debuginfoRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.9.2-1.el8pc | 0:3.9.2-1.el8pc |
rubygem-activesupportRed Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs |
before 0:6.1.7.6-1.el8sat | 0:6.1.7.6-1.el8sat |
rubygem-activesupportRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:6.1.7.6-1.el8sat | 0:6.1.7.6-1.el8sat |
python-djangoRed Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs |
before 0:4.2.9-1.el8pc | 0:4.2.9-1.el8pc |
python3.11-djangoRed Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs |
before 0:4.2.9-1.el8pc | 0:4.2.9-1.el8pc |
python-djangoRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:4.2.9-1.el8pc | 0:4.2.9-1.el8pc |
python3.11-djangoRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:4.2.9-1.el8pc | 0:4.2.9-1.el8pc |
python-pycryptodomexRed Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.20.0-1.el8pc | 0:3.20.0-1.el8pc |
python-pycryptodomex-debugsourceRed Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.20.0-1.el8pc | 0:3.20.0-1.el8pc |
python3.11-pycryptodomexRed Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.20.0-1.el8pc | 0:3.20.0-1.el8pc |
python3.11-pycryptodomex-debuginfoRed Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.20.0-1.el8pc | 0:3.20.0-1.el8pc |
python-pycryptodomexRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.20.0-1.el8pc | 0:3.20.0-1.el8pc |
python-pycryptodomex-debugsourceRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.20.0-1.el8pc | 0:3.20.0-1.el8pc |
python3.11-pycryptodomexRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.20.0-1.el8pc | 0:3.20.0-1.el8pc |
python3.11-pycryptodomex-debuginfoRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.20.0-1.el8pc | 0:3.20.0-1.el8pc |
rubygem-pumaRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:6.4.2-1.el8sat | 0:6.4.2-1.el8sat |
rubygem-puma-debuginfoRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:6.4.2-1.el8sat | 0:6.4.2-1.el8sat |
rubygem-puma-debugsourceRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:6.4.2-1.el8sat | 0:6.4.2-1.el8sat |
rubygem-auditedRed Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:5.4.2-1.el8sat | 0:5.4.2-1.el8sat |
python-jinja2Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.1.3-1.el8pc | 0:3.1.3-1.el8pc |
python3.11-jinja2Red Hat:satellite_capsule:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.1.3-1.el8pc | 0:3.1.3-1.el8pc |
python-jinja2Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.1.3-1.el8pc | 0:3.1.3-1.el8pc |
python3.11-jinja2Red Hat:satellite:6.15::el8 From an advisory covering 18 CVEs |
before 0:3.1.3-1.el8pc | 0:3.1.3-1.el8pc |
railsUbuntu:Pro:16.04:LTS |
All versions, plus listed versions 2:4.1.10-12:4.2.5-12:4.2.5.1-12:4.2.5.2-22:4.2.6-12:4.2.6-1ubuntu0.1~esm12:4.2.6-1ubuntu0.1~esm2 |
None known |
railsUbuntu:Pro:18.04:LTS |
All versions, plus listed versions 2:4.2.9-22:4.2.9-42:4.2.10-0ubuntu42:4.2.10-0ubuntu4+esm12:4.2.10-0ubuntu4+esm2 |
None known |
railsUbuntu:Pro:20.04:LTS |
All versions, plus listed versions 2:5.2.2.1+dfsg-1ubuntu12:5.2.3+dfsg-32:5.2.3+dfsg-3ubuntu0.1~esm1 |
None known |
railsUbuntu:Pro:22.04:LTS |
All versions, plus listed versions 2:6.0.3.7+dfsg-22:6.1.4.1+dfsg-8ubuntu22:6.1.4.1+dfsg-8ubuntu2+esm1 |
None known |
railsUbuntu:24.04:LTS |
All versions, plus listed versions 2:6.1.7.3+dfsg-2build12:6.1.7.3+dfsg-3 |
None known |
railsUbuntu:25.10 |
All versions, plus listed versions 2:6.1.7.3+dfsg-72:7.2.2.1+dfsg-7 |
None known |
railsUbuntu:26.10 |
All versions, plus listed versions 2:7.2.3+dfsg-22:7.2.3.2+dfsg-2 |
None known |
railsUbuntu:26.04:LTS |
All versions, plus listed versions 2:7.2.2.1+dfsg-72:7.2.2.2+dfsg-22:7.2.3+dfsg-2 |
None known |
rubygem-activesupport-5.2SUSE:Package Hub 15 SP5 |
before 5.2.3-bp155.3.5.1 | 5.2.3-bp155.3.5.1 |
rubygem-activesupport-5.2openSUSE:Leap 15.5 |
before 5.2.3-bp155.3.5.1 | 5.2.3-bp155.3.5.1 |
ruby3.2-rubygem-activesupport-7.0openSUSE:Tumbleweed |
before 7.0.8-1.1 | 7.0.8-1.1 |
ruby3.2-rubygem-activerecord-7.0openSUSE:Tumbleweed |
before 7.0.8-1.1 | 7.0.8-1.1 |
ruby3.2-rubygem-rails-7.0openSUSE:Tumbleweed |
before 7.0.8-1.1 | 7.0.8-1.1 |
rubygem-activerecord-7.0openSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 7.0.8.4-1.1 | 7.0.8.4-1.1 |
rubygem-activesupport-7.0openSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 7.0.8.4-1.1 | 7.0.8.4-1.1 |
rubygem-rails-7.0openSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 7.0.8.4-1.1 | 7.0.8.4-1.1 |
rubygem-activerecord-7.0openSUSE:Tumbleweed From an advisory covering 4 CVEs |
before 7.0.8.6-1.3 | 7.0.8.6-1.3 |
rubygem-activesupport-7.0openSUSE:Tumbleweed From an advisory covering 3 CVEs |
before 7.0.8.6-1.3 | 7.0.8.6-1.3 |
rubygem-rails-7.0openSUSE:Tumbleweed From an advisory covering 8 CVEs |
before 7.0.8.6-1.3 | 7.0.8.6-1.3 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| first indexed | CVE List, EUVD, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2023-38037 is a medium vulnerability (CVSS 5.5) in Rails Activesupport, published August 23, 2023. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 0.27%, the 19th percentile. Fixed in activesupport 6.1.7.5.
References
discuss.rubyonrails.org/t/cve-2023-38037-possible-file-disclosure-of-locally-encrypted-files/83544
security.netapp.com/advisory/ntap-20250214-0010
github.com/rails/rails/commit/a21d6edf35a60383dfa6c4da49e4b1aef5f00731
nvd.nist.gov/vuln/detail/CVE-2023-38037
Show 194 moreShow less
security-tracker.debian.org/tracker/CVE-2023-38037
openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1627
access.redhat.com/errata/RHSA-2024:2010
bugzilla.redhat.com/show_bug.cgi?id=2251014
security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2010.json
cve.org/CVERecord?id=CVE-2022-40896
rfc-editor.org/rfc/rfc9110
djangoproject.com/weblog/2023/sep/04/security-releases
pypi.org/project/pycryptodomex
ubuntu.com/security/CVE-2023-38037
lists.opensuse.org/archives/list/[email protected]/thread/OBVOVSGAX2OPRG2RF5ECRNES7R32LDVM
bugzilla.suse.com/1214807
suse.com/security/cve/CVE-2023-38037
Left out here: 36 versions and 155 references. The JSON record has them.