{"id":"CVE-2016-2098","aliases":["DEBIAN-CVE-2016-2098","DLA-604-1","DSA-3509-1","EUVD-2017-0185","GHSA-78rc-8c29-p45g","RHSA-2016:0454","RHSA-2016:0455","RHSA-2016:0456","SUSE-SU-2016:0854-1","SUSE-SU-2016:0867-1","SUSE-SU-2016:0967-1","SUSE-SU-2016:1146-1","SUSE-SU-2017:2716-1","openSUSE-SU-2024:10057-1","openSUSE-SU-2024:10332-1"],"status":"published","title":"actionpack allows remote code execution via application's unrestricted use of render method","description":"Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.","severity":{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-08","score":0.81445,"percentile":0.99642,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":true,"fix_available":true},"cwes":["CWE-20"],"published":"2016-03-09T00:00:00Z","modified":"2026-10-24T10:30:46Z","exploits":[{"source":"metasploit","id":"exploit/multi/http/rails_actionpack_inline_exec","title":"Ruby on Rails ActionPack Inline ERB Code Execution","type":"exploit","platform":"Ruby","date":"2016-03-01","verified":true,"url":"https://www.rapid7.com/db/modules/exploit/multi/http/rails_actionpack_inline_exec"},{"source":"pocgithub","id":"hderms/dh-CVE_2016_2098","title":"hderms/dh-CVE_2016_2098","date":"2016-03-01","url":"https://github.com/hderms/dh-CVE_2016_2098"},{"source":"pocgithub","id":"CyberDefenseInstitute/PoC_CVE-2016-2098_Rails42","title":"CyberDefenseInstitute/PoC_CVE-2016-2098_Rails42","date":"2016-06-07","url":"https://github.com/CyberDefenseInstitute/PoC_CVE-2016-2098_Rails42"},{"source":"exploitdb","id":"EDB-40086","title":"Ruby on Rails ActionPack Inline ERB - Code Execution (Metasploit)","type":"remote","platform":"ruby","date":"2016-07-11","verified":true,"url":"https://www.exploit-db.com/exploits/40086"},{"source":"pocgithub","id":"Alejandro-MartinG/rails-PoC-CVE-2016-2098","title":"Alejandro-MartinG/rails-PoC-CVE-2016-2098","date":"2017-01-25","url":"https://github.com/Alejandro-MartinG/rails-PoC-CVE-2016-2098"},{"source":"pocgithub","id":"0x00-0x00/CVE-2016-2098","title":"0x00-0x00/CVE-2016-2098","date":"2018-02-09","url":"https://github.com/0x00-0x00/CVE-2016-2098"},{"source":"pocgithub","id":"its-arun/CVE-2016-2098","title":"its-arun/CVE-2016-2098","date":"2018-06-19","url":"https://github.com/its-arun/CVE-2016-2098"},{"source":"pocgithub","id":"3rg1s/CVE-2016-2098","title":"3rg1s/CVE-2016-2098","date":"2019-10-30","url":"https://github.com/3rg1s/CVE-2016-2098"},{"source":"pocgithub","id":"DanielHemmati/CVE-2016-2098-my-first-exploit","title":"DanielHemmati/CVE-2016-2098-my-first-exploit","date":"2020-07-27","url":"https://github.com/DanielHemmati/CVE-2016-2098-my-first-exploit"},{"source":"pocgithub","id":"Debalinax64/CVE-2016-2098","title":"Debalinax64/CVE-2016-2098","date":"2021-04-07","url":"https://github.com/Debalinax64/CVE-2016-2098"},{"source":"pocgithub","id":"j4k0m/CVE-2016-2098","title":"j4k0m/CVE-2016-2098","date":"2021-08-31","url":"https://github.com/j4k0m/CVE-2016-2098"},{"source":"pocgithub","id":"Shakun8/CVE-2016-2098","title":"Shakun8/CVE-2016-2098","date":"2022-09-24","url":"https://github.com/Shakun8/CVE-2016-2098"},{"source":"pocgithub","id":"JoseLRC97/Ruby-on-Rails-ActionPack-Inline-ERB-Remote-Code-Execution","title":"JoseLRC97/Ruby-on-Rails-ActionPack-Inline-ERB-Remote-Code-Execution","date":"2024-04-18","url":"https://github.com/JoseLRC97/Ruby-on-Rails-ActionPack-Inline-ERB-Remote-Code-Execution"},{"source":"pocgithub","id":"sealldeveloper/CVE-2016-2098-PoC","title":"sealldeveloper/CVE-2016-2098-PoC","date":"2025-04-25","url":"https://github.com/sealldeveloper/CVE-2016-2098-PoC"}],"fixes":[{"ecosystem":"RubyGems","package":"actionpack","fixed_in":["3.2.22.2","4.1.14.2","4.2.5.2"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"rails","fixed_in":["2:4.2.5.2-1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rails","fixed_in":["2:4.2.5.2-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rails","fixed_in":["2:4.2.5.2-1"],"sources":["osv"]},{"ecosystem":"SUSE:OpenStack Cloud 6","package":"rubygem-actionview-4_2","fixed_in":["4.2.2-8.1"],"sources":["osv"]},{"ecosystem":"SUSE:Enterprise Storage 2.1","package":"rubygem-actionview-4_2","fixed_in":["4.2.2-8.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"rubygem-actionview-4_2","fixed_in":["5.0.0.1-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"last_affected":"3.2.22.1"},{"fixed":"3.2.22.2"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"last_affected":"4.1.14.1"},{"fixed":"4.1.14.2"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"last_affected":"4.2.5.1"},{"fixed":"4.2.5.2"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.5.2-1"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.5.2-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.2.5.2-1"}]}]},{"source":"osv","ecosystem":"Debian:7","package":"ruby-actionpack-3.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.6-6+deb7u3"}]}],"versions":["3.2.6-6","3.2.6-6+deb7u1","3.2.6-6+deb7u2"],"bundled":6},{"source":"osv","ecosystem":"Debian:8","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:4.1.8-1+deb8u2"}]}],"versions":["2:4.1.8-1","2:4.1.8-1+deb8u1"],"bundled":2},{"source":"osv","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"3.0.0"},{"fixed":"3.2.22.2"}]}],"versions":["3.0.0","3.0.1","3.0.10","3.0.10.rc1","3.0.11","3.0.12","3.0.12.rc1","3.0.13","3.0.13.rc1","3.0.14","3.0.15","3.0.16","3.0.17","3.0.18","3.0.19","3.0.2","3.0.20","3.0.3","3.0.4","3.0.4.rc1","3.0.5","3.0.5.rc1","3.0.6","3.0.6.rc1","3.0.6.rc2","3.0.7","3.0.7.rc1","3.0.7.rc2","3.0.8","3.0.8.rc1","3.0.8.rc2","3.0.8.rc4","3.0.9","3.0.9.rc1","3.0.9.rc3","3.0.9.rc4","3.0.9.rc5","3.1.0","3.1.0.beta1","3.1.0.rc1","3.1.0.rc2","3.1.0.rc3","3.1.0.rc4","3.1.0.rc5","3.1.0.rc6","3.1.0.rc8","3.1.1","3.1.1.rc1","3.1.1.rc2","3.1.1.rc3","3.1.10","3.1.11","3.1.12","3.1.2","3.1.2.rc1","3.1.2.rc2","3.1.3","3.1.4","3.1.4.rc1","3.1.5","3.1.5.rc1","3.1.6","3.1.7","3.1.8","3.1.9","3.2.0","3.2.0.rc1","3.2.0.rc2","3.2.1","3.2.10","3.2.11","3.2.12","3.2.13","3.2.13.rc1","3.2.13.rc2","3.2.14","3.2.14.rc1","3.2.14.rc2","3.2.15","3.2.15.rc1","3.2.15.rc2","3.2.15.rc3","3.2.16","3.2.17","3.2.18","3.2.19","3.2.2","3.2.2.rc1","3.2.20","3.2.21","3.2.22","3.2.22.1","3.2.3","3.2.3.rc1","3.2.3.rc2","3.2.4","3.2.4.rc1","3.2.5","3.2.6","3.2.7","3.2.7.rc1","3.2.8","3.2.8.rc1","3.2.8.rc2","3.2.9","3.2.9.rc1","3.2.9.rc2","3.2.9.rc3"]},{"source":"osv","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.0.0"},{"fixed":"4.1.14.2"}]}],"versions":["4.0.0","4.0.1","4.0.1.rc1","4.0.1.rc2","4.0.1.rc3","4.0.1.rc4","4.0.10","4.0.10.rc1","4.0.10.rc2","4.0.11","4.0.11.1","4.0.12","4.0.13","4.0.13.rc1","4.0.2","4.0.3","4.0.4","4.0.4.rc1","4.0.5","4.0.6","4.0.6.rc1","4.0.6.rc2","4.0.6.rc3","4.0.7","4.0.8","4.0.9","4.1.0","4.1.0.beta1","4.1.0.beta2","4.1.0.rc1","4.1.0.rc2","4.1.1","4.1.10","4.1.10.rc1","4.1.10.rc2","4.1.10.rc3","4.1.10.rc4","4.1.11","4.1.12","4.1.12.rc1","4.1.13","4.1.13.rc1","4.1.14","4.1.14.1","4.1.14.rc1","4.1.14.rc2","4.1.2","4.1.2.rc1","4.1.2.rc2","4.1.2.rc3","4.1.3","4.1.4","4.1.5","4.1.6","4.1.6.rc1","4.1.6.rc2","4.1.7","4.1.7.1","4.1.8","4.1.9","4.1.9.rc1"]},{"source":"osv","ecosystem":"RubyGems","package":"actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"4.2.0"},{"fixed":"4.2.5.2"}]}],"versions":["4.2.0","4.2.1","4.2.1.rc1","4.2.1.rc2","4.2.1.rc3","4.2.1.rc4","4.2.2","4.2.3","4.2.3.rc1","4.2.4","4.2.4.rc1","4.2.5","4.2.5.1","4.2.5.rc1","4.2.5.rc2"]},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ror40-rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ror40-rubygem-actionpack-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-7.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ror40-rubygem-activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-6.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ror40-rubygem-activerecord-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-6.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ror40-rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-4.el6"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ror40-rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ror40-rubygem-actionpack-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-7.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ror40-rubygem-activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-6.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ror40-rubygem-activerecord-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-6.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ror40-rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.0.2-4.el7"}]}],"bundled":7},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ruby193-rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-16.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ruby193-rubygem-actionpack-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-16.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ruby193-rubygem-activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-11.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ruby193-rubygem-activerecord-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-11.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"ruby193-rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-6.el6"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ruby193-rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-16.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ruby193-rubygem-actionpack-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-16.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ruby193-rubygem-activerecord","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ruby193-rubygem-activerecord-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-11.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"ruby193-rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:3.2.8-6.el7"}]}],"bundled":6},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ror41-rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.1.5-4.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ror41-rubygem-actionpack-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.1.5-4.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ror41-rubygem-actionview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.5-5.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el6","package":"rh-ror41-rubygem-actionview-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.5-5.el6"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror41-rubygem-actionpack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.1.5-4.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror41-rubygem-actionpack-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1:4.1.5-4.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror41-rubygem-actionview","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.5-5.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"Red Hat:rhel_software_collections:2::el7","package":"rh-ror41-rubygem-actionview-doc","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.1.5-5.el7"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 5","package":"rubygem-actionview-4_1","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.1.9-12.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"rubygem-actionview-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.2-8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 2.1","package":"rubygem-actionview-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.2-8.1"}]}]},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Software Development Kit 11 SP4","package":"rubygem-actionpack-3_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-0.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Lifecycle Management Server 1.3","package":"rubygem-actionpack-3_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-0.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Studio Onsite 1.3","package":"rubygem-actionpack-3_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-0.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:WebYast 1.3","package":"rubygem-actionpack-3_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"3.2.12-0.26.1"}]}],"bundled":2},{"source":"osv","ecosystem":"SUSE:Linux Enterprise Module for Containers 12","package":"portus","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2.0.3-2.4"}]}],"bundled":10},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"rubygem-actionmailer-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"rubygem-actionpack-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"rubygem-actionview-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"rubygem-activejob-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"rubygem-activemodel-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-6.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"rubygem-activerecord-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-6.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"rubygem-activesupport-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"rubygem-rails-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-8.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 6","package":"rubygem-railties-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-actionmailer-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-actionpack-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-actionview-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-activejob-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-activemodel-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-6.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-activerecord-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-6.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-activesupport-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-rails-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-8.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:OpenStack Cloud 7","package":"rubygem-railties-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"rubygem-actionmailer-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"rubygem-actionpack-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"rubygem-actionview-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"rubygem-activejob-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"rubygem-activemodel-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-6.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"rubygem-activerecord-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-6.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"rubygem-activesupport-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"rubygem-rails-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-8.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 3","package":"rubygem-railties-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"rubygem-actionmailer-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"rubygem-actionpack-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"rubygem-actionview-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-9.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"rubygem-activejob-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"rubygem-activemodel-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-6.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"rubygem-activerecord-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-6.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"rubygem-activesupport-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-7.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"rubygem-rails-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"rubygem-rails-html-sanitizer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"1.0.3-8.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"SUSE:Enterprise Storage 4","package":"rubygem-railties-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.2.9-3.3.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-actionview-4_2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.0.0.1-1.1"}]}]}],"products":[{"vendor":"debian","product":"debian_linux"},{"vendor":"rubyonrails","product":"rails"},{"vendor":"rubyonrails","product":"ruby_on_rails"}],"references":[{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00086.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00006.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://www.debian.org/security/2016/dsa-3509","tags":["vendor-advisory","x_refsource_DEBIAN","x_transferred","advisory","web"]},{"url":"http://www.securityfocus.com/bid/83725","tags":["vdb-entry","x_refsource_BID","x_transferred","web"]},{"url":"http://www.securitytracker.com/id/1035122","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred","web"]},{"url":"https://www.exploit-db.com/exploits/40086/","tags":["exploit","x_refsource_EXPLOIT-DB","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00083.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00057.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-04/msg00053.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2016-03/msg00080.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ","tags":["mailing-list","x_refsource_MLIST","x_transferred","web"]},{"url":"http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released/","tags":["x_refsource_CONFIRM","x_transferred","Patch","Vendor Advisory","fix"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2098","tags":["advisory"]},{"url":"https://web.archive.org/web/20200228015318/http://www.securityfocus.com/bid/83725","tags":["web"]},{"url":"https://web.archive.org/web/20210612214217/https://groups.google.com/forum/message/raw?msg=rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ","tags":["web"]},{"url":"https://web.archive.org/web/20211205173437/https://securitytracker.com/id/1035122","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2016-2098.yml","tags":["web"]},{"url":"https://groups.google.com/forum/#!topic/rubyonrails-security/ly-IH-fxr_Q","tags":["web"]},{"url":"https://github.com/advisories/GHSA-78rc-8c29-p45g"},{"url":"https://security-tracker.debian.org/tracker/CVE-2016-2098","tags":["advisory"]},{"url":"https://github.com/rails/rails","tags":["package"]},{"url":"https://www.exploit-db.com/exploits/40086","tags":["web"]},{"url":"http://weblog.rubyonrails.org/2016/2/29/Rails-4-2-5-2-4-1-14-2-3-2-22-2-have-been-released","tags":["web"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0454","tags":["advisory"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1301933","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1301946","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1301957","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1301963","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1301981","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1310043","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1310054","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0454.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7576","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7576","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7576","tags":["advisory"]},{"url":"http://weblog.rubyonrails.org/2016/1/25/Rails-5-0-0-beta1-1-4-2-5-1-4-1-14-1-3-2-22-1-and-rails-html-sanitizer-1-0-3-have-been-released/","tags":["article"]},{"url":"https://groups.google.com/forum/#!msg/rubyonrails-security/ANv0HDHEC3k/mt7wNGxbFQAJ","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7577","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7577","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7577","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!msg/rubyonrails-security/cawsWcQ6c8g/tegZtYdbFQAJ","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2015-7581","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2015-7581","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2015-7581","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!msg/rubyonrails-security/dthJ5wL69JE/YzPnFelbFQAJ","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-0751","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-0751","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0751","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!msg/rubyonrails-security/9oLY_FCzvoc/w9oI9XxbFQAJ","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-0752","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-0752","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-0752","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!msg/rubyonrails-security/335P1DcLG00/OfB9_LhbFQAJ","tags":["article"]},{"url":"https://nvisium.com/blog/2016/01/26/rails-dynamic-render-to-rce-cve-2016-0752/","tags":["article"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-2097","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2097","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-2097","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!msg/rubyonrails-security/ddY6HgqB2z4/we0RasMZIAAJ","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2016-2098","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-2098","tags":["advisory"]},{"url":"https://groups.google.com/forum/#!msg/rubyonrails-security/ly-IH-fxr_Q/WLoOhcMZIAAJ","tags":["article"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0455","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0455.json","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2016:0456","tags":["advisory"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2016/rhsa-2016_0456.json","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160854-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/968849","tags":["report"]},{"url":"https://bugzilla.suse.com/968850","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2097","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-2098","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160867-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20160967-1/","tags":["advisory"]},{"url":"https://www.suse.com/support/update/announcement/2016/suse-su-20161146-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/963326","tags":["report"]},{"url":"https://bugzilla.suse.com/963327","tags":["report"]},{"url":"https://bugzilla.suse.com/963328","tags":["report"]},{"url":"https://bugzilla.suse.com/963563","tags":["report"]},{"url":"https://bugzilla.suse.com/963604","tags":["report"]},{"url":"https://bugzilla.suse.com/963608","tags":["report"]},{"url":"https://bugzilla.suse.com/963617","tags":["report"]},{"url":"https://bugzilla.suse.com/963625","tags":["report"]},{"url":"https://bugzilla.suse.com/963627","tags":["report"]},{"url":"https://bugzilla.suse.com/969943","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7576","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7577","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7578","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7579","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7580","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2015-7581","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0751","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0752","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-0753","tags":["web"]},{"url":"https://www.suse.com/support/update/announcement/2017/suse-su-20172716-1/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1055962","tags":["report"]},{"url":"https://bugzilla.suse.com/993302","tags":["report"]},{"url":"https://bugzilla.suse.com/993313","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6316","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2016-6317","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2014-4671","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7818","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2014-7829","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2016-2098","description":"Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.","status":"published","published":"2016-04-07T23:00:00Z","modified":"2024-08-05T23:17:50.698Z","updated_at":"2026-11-02T14:33:33.07583Z"}],"euvd":[{"id":"EUVD-2017-0185","description":"Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.","status":"published","published":"2016-04-07T23:00:00Z","modified":"2024-08-05T23:17:50Z","updated_at":"2026-11-03T02:22:54.125931Z"}],"ghsa":[{"id":"GHSA-78rc-8c29-p45g","title":"actionpack allows remote code execution via application's unrestricted use of render method","description":"Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.","status":"published","published":"2017-10-24T18:33:35Z","modified":"2023-07-03T18:58:44Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:36:55.91458Z"}],"nvd":[{"id":"CVE-2016-2098","description":"Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.","status":"published","published":"2016-04-07T23:59:06.643Z","modified":"2026-06-17T00:43:25.76Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high","assessor":"primary"},{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T14:03:22.479119Z"}],"osv":[{"id":"CVE-2016-2098","description":"Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.","status":"published","published":"2016-04-07T23:59:06.643Z","modified":"2026-10-24T10:30:46.327180445Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:44:02.114472Z"},{"id":"DEBIAN-CVE-2016-2098","description":"Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.","status":"published","published":"2016-04-07T23:59:06.643Z","modified":"2026-09-22T07:01:48.674829172Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"updated_at":"2026-11-02T15:45:27.323751Z"},{"id":"GHSA-78rc-8c29-p45g","title":"actionpack allows remote code execution via application's unrestricted use of render method","description":"Action Pack in Ruby on Rails before 3.2.22.2, 4.x before 4.1.14.2, and 4.2.x before 4.2.5.2 allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.","status":"published","published":"2017-10-24T18:33:35Z","modified":"2024-02-20T05:23:27.150669Z","cvss":[{"version":"3.0","score":7.3,"vector":"CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L","level":"high"}],"cwes":["CWE-20"],"updated_at":"2026-11-02T15:46:40.657155Z"},{"id":"DLA-604-1","title":"ruby-actionpack-3.2 - security update","status":"published","published":"2016-08-28T00:00:00Z","modified":"2026-03-09T02:09:15.25132Z","updated_at":"2026-11-02T15:46:13.207219Z"},{"id":"DSA-3509-1","title":"rails - security update","status":"published","published":"2016-03-09T00:00:00Z","modified":"2026-03-09T01:21:33.84872Z","updated_at":"2026-11-02T15:46:16.199525Z"},{"id":"openSUSE-SU-2024:10057-1","title":"ruby2.2-rubygem-actionview-4_2-4.2.7.1-1.1 on GA media","description":"These are all security issues fixed in the ruby2.2-rubygem-actionview-4_2-4.2.7.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:31:50.004288Z","updated_at":"2026-11-02T16:58:33.135986Z"},{"id":"openSUSE-SU-2024:10332-1","title":"ruby2.2-rubygem-actionpack-4_2-4.2.7.1-1.1 on GA media","description":"These are all security issues fixed in the ruby2.2-rubygem-actionpack-4_2-4.2.7.1-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:09:01.974876Z","updated_at":"2026-11-02T16:58:34.487567Z"},{"id":"RHSA-2016:0454","title":"Red Hat Security Advisory: ror40 security update","status":"published","published":"2024-09-13T12:26:58Z","modified":"2026-06-29T10:11:55Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0455","title":"Red Hat Security Advisory: ruby193 security update","status":"published","published":"2024-09-13T12:27:04Z","modified":"2026-06-29T10:11:56Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"RHSA-2016:0456","title":"Red Hat Security Advisory: rh-ror41 security update","status":"published","published":"2024-09-13T11:31:14Z","modified":"2026-06-29T10:11:56Z","updated_at":"2026-11-02T15:53:03.734507Z"},{"id":"SUSE-SU-2016:0854-1","title":"Security update for rubygem-actionview-4_1","description":"\nThis update for rubygem-actionview-4_1 fixes the following issues:\n\n- CVE-2016-2097: rubygem-actionview: Possible Information\n  Leak Vulnerability in Action View. (bsc#968850)\n\n- CVE-2016-2098: rubygem-actionpack: Possible remote\n  code execution vulnerability in Action Pack (bsc#968849)\n","status":"published","published":"2016-03-22T13:34:50Z","modified":"2026-02-04T02:13:07.22051Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0867-1","title":"Security update for rubygem-actionview-4_2","description":"\nThis update for rubygem-actionview-4_2 fixes the following issues:\n\n- CVE-2016-2098: rubygem-actionpack: Possible remote\n  code execution vulnerability in Action Pack (bsc#968849)\n","status":"published","published":"2016-03-23T14:29:01Z","modified":"2026-02-04T03:05:58.459462Z","updated_at":"2026-11-02T15:53:43.030986Z"},{"id":"SUSE-SU-2016:0967-1","title":"Security update for rubygem-actionpack-3_2","description":"\nThis update for rubygem-actionpack-3_2 fixes the following issues:\n\n- CVE-2016-2097: rubygem-actionview: Possible Information\n  Leak Vulnerability in Action View. (bsc#968850)\n\n- CVE-2016-2098: rubygem-actionpack: Possible remote\n  code execution vulnerability in Action Pack (bsc#968849)\n","status":"published","published":"2016-04-07T07:10:35Z","modified":"2026-02-04T03:54:49.49043Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2016:1146-1","title":"Security update for portus","description":"\nPortus was updated to version 2.0.3, which brings several fixes and enhancements:\n\n- Fixed crono job when a repository could not be found.\n- Fixed compatibility issues with Docker 1.10 and Distribution 2.3.\n- Handle multiple scopes in token requests.\n- Add optional fields to token response.\n- Fixed notification events for Distribution v2.3.\n- Paginate through the catalog properly.\n- Do not remove all the repositories if fetching one fails.\n- Fixed SMTP setup.\n- Don't let crono overflow the 'log' column on the DB.\n- Show the actual LDAP error on invalid login.\n- Fixed the location of crono logs.\n- Always use relative paths.\n- Set RUBYLIB when using portusctl.\n- Don't count hidden teams on the admin panel.\n- Warn developers on unsupported docker-compose versions.\n- Directly invalidate LDAP logins without name and password.\n- Don't show the 'I forgot my password' link on LDAP.\n\nThe following Rubygems bundled within Portus have been updated to fix security\nissues:\n\n- CVE-2016-2098: rubygem-actionpack (bsc#969943).\n- CVE-2015-7578: rails-html-sanitizer (bsc#963326).\n- CVE-2015-7579: rails-html-sanitizer (bsc#963327).\n- CVE-2015-7580: rails-html-sanitizer (bsc#963328).\n- CVE-2015-7576: rubygem-actionpack, rubygem-activesupport (bsc#963563).\n- CVE-2015-7577: rubygem-activerecord (bsc#963604).\n- CVE-2016-0751: rugygem-actionpack (bsc#963627).\n- CVE-2016-0752: rubygem-actionpack, rubygem-actionview (bsc#963608).\n- CVE-2016-0753: rubygem-activemodel, rubygem-activesupport, rubygem-activerecord (bsc#963617).\n- CVE-2015-7581: rubygem-actionpack (bsc#963625).\n","status":"published","published":"2016-04-25T14:28:51Z","modified":"2026-02-04T03:47:46.041833Z","updated_at":"2026-11-02T15:53:43.438985Z"},{"id":"SUSE-SU-2017:2716-1","title":"Security update for the Ruby on Rails stack","description":"This update brings version 4.2.9 of the Ruby on Rails stack to provide the latest fixes and\nimprovements from upstream.\n\nThe following security issues have been fixed by upstream:\n\nrubygem-actionpack-4_2\n\n- CVE-2016-2098: Action Pack in Ruby on Rails allowed remote attackers to execute arbitrary Ruby code by leveraging\n  an application's unrestricted use of the render method (bsc#968849).\n\nrubygem-activerecord-4_2\n\n- CVE-2016-6317: Action Record did not properly consider differences in parameter handling between the Active Record\n  component and the JSON implementation, which allowed remote attackers to bypass intended database-query restrictions\n  and perform NULL checks or trigger missing WHERE clauses via a crafted request (bsc#993313).\n\nrubygem-actionview-4_2\n\n- CVE-2016-6316: Cross-site scripting (XSS) vulnerability in Action View might have allowed remote attackers to inject\n  arbitrary web script or HTML via text declared as 'HTML safe' and used as attribute values in tag handlers\n  (bsc#993302).\n\nAdditionally, the following packages have been updated to version 4.2.9:\n\n- rubygem-rails-4_2\n- rubygem-railties-4_2\n- rubygem-activesupport-4_2\n- rubygem-activerecord-4_2\n- rubygem-activejob-4_2\n- rubygem-actionview-4_2\n- rubygem-actionpack-4_2\n- rubygem-actionmailer-4_2","status":"published","published":"2017-10-12T12:43:34Z","modified":"2026-02-04T02:58:19.631348Z","updated_at":"2026-11-02T15:53:44.209561Z"}]}}