{"id":"CVE-2023-38037","aliases":["DEBIAN-CVE-2023-38037","DLA-4383-1","DSA-5881-1","EUVD-2023-2274","GHSA-cr5q-6q9f-rq6q","OESA-2023-1627","OESA-2023-1633","RHSA-2024:2010","UBUNTU-CVE-2023-38037","openSUSE-SU-2023:0350-1","openSUSE-SU-2024:13397-1","openSUSE-SU-2024:13432-1","openSUSE-SU-2024:13433-1","openSUSE-SU-2024:14069-1","openSUSE-SU-2024:14071-1","openSUSE-SU-2024:14074-1","openSUSE-SU-2025:15112-1","openSUSE-SU-2025:15114-1","openSUSE-SU-2025:15124-1"],"status":"published","title":"Active Support Possibly Discloses Locally Encrypted Files","description":"ActiveSupport::EncryptedFile writes contents that will be encrypted to a\r\ntemporary file.  The temporary file's permissions are defaulted to the user's\r\ncurrent `umask` settings, meaning that it's possible for other users on the\r\nsame system to read the contents of the temporary file.\r\n\r\nAttackers that have access to the file system could possibly read the contents\r\nof this temporary file while a user is editing it.\r\n\r\nAll users running an affected release should either upgrade or use one of the\r\nworkarounds immediately.","severity":{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L","level":"medium","assessor":"cna","from":"cve"},"epss":{"day":"2026-11-12","score":0.00274,"percentile":0.20061,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-377","CWE-732"],"published":"2023-08-23T20:36:24Z","modified":"2026-10-26T18:02:40Z","fixes":[{"ecosystem":"RubyGems","package":"activesupport","fixed_in":["6.1.7.5","7.0.7.1"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"rails","fixed_in":["2:6.1.7.10+dfsg-1~deb12u1"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"rails","fixed_in":["2:7.2.2.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"rails","fixed_in":["2:7.2.2.1+dfsg-1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"rubygem-railties","fixed_in":["5.2.4.4-5.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"rubygem-railties","fixed_in":["5.2.4.4-5.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"rubygem-railties","fixed_in":["6.1.4.1-2.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"rubygem-railties","fixed_in":["6.1.4.1-2.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"rubygem-railties","fixed_in":["6.1.4.1-2.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP1","package":"rubygem-activesupport","fixed_in":["5.2.4.4-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:20.03-LTS-SP3","package":"rubygem-activesupport","fixed_in":["5.2.4.4-3.oe1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS","package":"rubygem-activesupport","fixed_in":["6.1.4.1-5.oe2203sp2"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP1","package":"rubygem-activesupport","fixed_in":["6.1.4.1-6.oe2203sp1"],"sources":["osv"]},{"ecosystem":"openEuler:22.03-LTS-SP2","package":"rubygem-activesupport","fixed_in":["6.1.4.1-5.oe2203sp2"],"sources":["osv"]},{"ecosystem":"SUSE:Package Hub 15 SP5","package":"rubygem-activesupport-5.2","fixed_in":["5.2.3-bp155.3.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Leap 15.5","package":"rubygem-activesupport-5.2","fixed_in":["5.2.3-bp155.3.5.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-activesupport-7.0","fixed_in":["7.0.8-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-activerecord-7.0","fixed_in":["7.0.8-1.1"],"sources":["osv"]},{"ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-rails-7.0","fixed_in":["7.0.8-1.1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"6.1.7.5"}]}]},{"source":"ghsa","ecosystem":"RubyGems","package":"activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.7.1"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.1.7.10+dfsg-1~deb12u1"}]}],"versions":["2:6.1.7.3+dfsg-1","2:6.1.7.3+dfsg-10","2:6.1.7.3+dfsg-11","2:6.1.7.3+dfsg-12","2:6.1.7.3+dfsg-13","2:6.1.7.3+dfsg-2","2:6.1.7.3+dfsg-2~deb12u1","2:6.1.7.3+dfsg-3","2:6.1.7.3+dfsg-4","2:6.1.7.3+dfsg-5","2:6.1.7.3+dfsg-6","2:6.1.7.3+dfsg-7","2:6.1.7.3+dfsg-7~exp1","2:6.1.7.3+dfsg-8","2:6.1.7.3+dfsg-9"]},{"source":"osv","ecosystem":"Debian:13","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.2.2.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:7.2.2.1+dfsg-1"}]}]},{"source":"osv","ecosystem":"Debian:11","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.0.3.7+dfsg-2+deb11u3"}]}],"versions":["2:6.0.3.7+dfsg-2","2:6.0.3.7+dfsg-2+deb11u1","2:6.0.3.7+dfsg-2+deb11u2"],"bundled":8},{"source":"osv","ecosystem":"Debian:12","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"2:6.1.7.10+dfsg-1~deb12u1"}]}],"versions":["2:6.1.7.3+dfsg-1","2:6.1.7.3+dfsg-10","2:6.1.7.3+dfsg-11","2:6.1.7.3+dfsg-12","2:6.1.7.3+dfsg-13","2:6.1.7.3+dfsg-2","2:6.1.7.3+dfsg-2~deb12u1","2:6.1.7.3+dfsg-3","2:6.1.7.3+dfsg-4","2:6.1.7.3+dfsg-5","2:6.1.7.3+dfsg-6","2:6.1.7.3+dfsg-7","2:6.1.7.3+dfsg-7~exp1","2:6.1.7.3+dfsg-8","2:6.1.7.3+dfsg-9"],"bundled":9},{"source":"osv","ecosystem":"RubyGems","package":"activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"5.2.0"},{"fixed":"6.1.7.5"}]}],"versions":["5.2.0","5.2.1","5.2.1.1","5.2.1.rc1","5.2.2","5.2.2.1","5.2.2.rc1","5.2.3","5.2.3.rc1","5.2.4","5.2.4.1","5.2.4.2","5.2.4.3","5.2.4.4","5.2.4.5","5.2.4.6","5.2.4.rc1","5.2.5","5.2.6","5.2.6.1","5.2.6.2","5.2.6.3","5.2.7","5.2.7.1","5.2.8","5.2.8.1","6.0.0","6.0.0.beta1","6.0.0.beta2","6.0.0.beta3","6.0.0.rc1","6.0.0.rc2","6.0.1","6.0.1.rc1","6.0.2","6.0.2.1","6.0.2.2","6.0.2.rc1","6.0.2.rc2","6.0.3","6.0.3.1","6.0.3.2","6.0.3.3","6.0.3.4","6.0.3.5","6.0.3.6","6.0.3.7","6.0.3.rc1","6.0.4","6.0.4.1","6.0.4.2","6.0.4.3","6.0.4.4","6.0.4.5","6.0.4.6","6.0.4.7","6.0.4.8","6.0.5","6.0.5.1","6.0.6","6.0.6.1","6.1.0","6.1.0.rc1","6.1.0.rc2","6.1.1","6.1.2","6.1.2.1","6.1.3","6.1.3.1","6.1.3.2","6.1.4","6.1.4.1","6.1.4.2","6.1.4.3","6.1.4.4","6.1.4.5","6.1.4.6","6.1.4.7","6.1.5","6.1.5.1","6.1.6","6.1.6.1","6.1.7","6.1.7.1","6.1.7.2","6.1.7.3","6.1.7.4"]},{"source":"osv","ecosystem":"RubyGems","package":"activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"7.0.0"},{"fixed":"7.0.7.1"}]}],"versions":["7.0.0","7.0.1","7.0.2","7.0.2.1","7.0.2.2","7.0.2.3","7.0.2.4","7.0.3","7.0.3.1","7.0.4","7.0.4.1","7.0.4.2","7.0.4.3","7.0.5","7.0.5.1","7.0.6","7.0.7"]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"rubygem-railties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4.4-5.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"rubygem-railties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4.4-5.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"rubygem-railties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4.1-2.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"rubygem-railties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4.1-2.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"rubygem-railties","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4.1-2.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP1","package":"rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4.4-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:20.03-LTS-SP3","package":"rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.4.4-3.oe1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS","package":"rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4.1-5.oe2203sp2"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP1","package":"rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4.1-6.oe2203sp1"}]}]},{"source":"osv","ecosystem":"openEuler:22.03-LTS-SP2","package":"rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"6.1.4.1-5.oe2203sp2"}]}]},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python-pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python3.11-pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python-pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python3.11-pygments","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:2.17.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.15::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_utils:6.15::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-cli","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-debug","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-dynflow-sidekiq","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-ec2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-journald","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-libvirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-openstack","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-ovirt","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-pcp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-postgresql","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-redis","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-service","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-telemetry","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"foreman-vmware","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.1.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python-galaxy-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.19-2.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python3.11-galaxy-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.19-2.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python-galaxy-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.19-2.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python3.11-galaxy-importer","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:0.4.19-2.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"puppetserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.14.0-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"puppetserver","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:7.14.0-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python-aiohttp-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python3.11-aiohttp","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python3.11-aiohttp-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.9.2-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"rubygem-activesupport","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.1.7.6-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.9-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.9-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.9-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python3.11-django","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:4.2.9-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python-pycryptodomex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python-pycryptodomex-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python3.11-pycryptodomex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python3.11-pycryptodomex-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python-pycryptodomex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python-pycryptodomex-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python3.11-pycryptodomex","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python3.11-pycryptodomex-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.20.0-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"rubygem-puma","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"rubygem-puma-debuginfo","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"rubygem-puma-debugsource","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:6.4.2-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"rubygem-audited","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:5.4.2-1.el8sat"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite_capsule:6.15::el8","package":"python3.11-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Red Hat:satellite:6.15::el8","package":"python3.11-jinja2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0:3.1.3-1.el8pc"}]}],"bundled":18},{"source":"osv","ecosystem":"Ubuntu:Pro:16.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.1.10-1","2:4.2.5-1","2:4.2.5.1-1","2:4.2.5.2-2","2:4.2.6-1","2:4.2.6-1ubuntu0.1~esm1","2:4.2.6-1ubuntu0.1~esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:18.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:4.2.9-2","2:4.2.9-4","2:4.2.10-0ubuntu4","2:4.2.10-0ubuntu4+esm1","2:4.2.10-0ubuntu4+esm2"]},{"source":"osv","ecosystem":"Ubuntu:Pro:20.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:5.2.2.1+dfsg-1ubuntu1","2:5.2.3+dfsg-3","2:5.2.3+dfsg-3ubuntu0.1~esm1"]},{"source":"osv","ecosystem":"Ubuntu:Pro:22.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.0.3.7+dfsg-2","2:6.1.4.1+dfsg-8ubuntu2","2:6.1.4.1+dfsg-8ubuntu2+esm1"]},{"source":"osv","ecosystem":"Ubuntu:24.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.1.7.3+dfsg-2build1","2:6.1.7.3+dfsg-3"]},{"source":"osv","ecosystem":"Ubuntu:25.10","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:6.1.7.3+dfsg-7","2:7.2.2.1+dfsg-7"]},{"source":"osv","ecosystem":"Ubuntu:26.10","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:7.2.3+dfsg-2","2:7.2.3.2+dfsg-2"]},{"source":"osv","ecosystem":"Ubuntu:26.04:LTS","package":"rails","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"}]}],"versions":["2:7.2.2.1+dfsg-7","2:7.2.2.2+dfsg-2","2:7.2.3+dfsg-2"]},{"source":"osv","ecosystem":"SUSE:Package Hub 15 SP5","package":"rubygem-activesupport-5.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.3-bp155.3.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Leap 15.5","package":"rubygem-activesupport-5.2","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"5.2.3-bp155.3.5.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-activesupport-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-activerecord-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"ruby3.2-rubygem-rails-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8-1.1"}]}]},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-activerecord-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8.4-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-activesupport-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8.4-1.1"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rails-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8.4-1.1"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-activerecord-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8.6-1.3"}]}],"bundled":4},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-activesupport-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8.6-1.3"}]}],"bundled":3},{"source":"osv","ecosystem":"openSUSE:Tumbleweed","package":"rubygem-rails-7.0","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"7.0.8.6-1.3"}]}],"bundled":8}],"products":[{"vendor":"rails","product":"activesupport"}],"references":[{"url":"https://discuss.rubyonrails.org/t/cve-2023-38037-possible-file-disclosure-of-locally-encrypted-files/83544","tags":["web"]},{"url":"https://security.netapp.com/advisory/ntap-20250214-0010/","tags":["advisory"]},{"url":"https://github.com/rails/rails/commit/a21d6edf35a60383dfa6c4da49e4b1aef5f00731","tags":["web","report"]},{"url":"https://github.com/rails/rails/releases/tag/v7.0.7.1","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2023-38037.yml","tags":["web","article","report"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-38037","tags":["advisory"]},{"url":"https://security.netapp.com/advisory/ntap-20250214-0010","tags":["web"]},{"url":"https://github.com/advisories/GHSA-cr5q-6q9f-rq6q","tags":["report"]},{"url":"https://security-tracker.debian.org/tracker/CVE-2023-38037","tags":["advisory"]},{"url":"https://github.com/rails/rails","tags":["package"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1627","tags":["advisory"]},{"url":"https://www.openeuler.org/en/security/safety-bulletin/detail.html?id=openEuler-SA-2023-1633","tags":["advisory"]},{"url":"https://access.redhat.com/errata/RHSA-2024:2010","tags":["advisory"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2251014","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2251019","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2251200","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2251643","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2252064","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2252235","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2252248","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2252450","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2252945","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2252968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253191","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253212","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253381","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253519","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253618","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253621","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2253673","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254074","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254178","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254230","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254383","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254408","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254491","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254492","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254612","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254690","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254694","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254712","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2254827","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255026","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255329","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255344","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255346","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255385","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255424","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255426","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255546","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255658","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255900","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255949","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2255969","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2256024","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2256136","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2256154","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2256218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2256411","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2256452","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2256473","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2256604","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2256683","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2256891","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2256927","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2257028","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2257340","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2257854","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2257957","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258016","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258109","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2258876","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2259163","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2261887","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2261909","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2263243","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2263815","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2264342","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2267949","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2269363","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2270295","tags":["report"]},{"url":"https://access.redhat.com/security/updates/classification/#important","tags":["article"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1393613","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1792187","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1884395","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1937203","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1943306","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1964539","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1967073","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1976178","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1976213","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1992495","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1993917","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=1994654","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2015344","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2026701","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2044527","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2048805","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2053416","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2063218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2063717","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2068263","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2068527","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2070487","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2071097","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2081244","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2087537","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2091900","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2096930","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2097084","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2103757","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2104582","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2106256","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2108725","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2109740","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2121957","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2124275","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125367","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125728","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2125809","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2126357","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2126420","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2129296","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2131798","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2138905","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2139834","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2141421","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2143980","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2144615","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2148439","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2148534","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2149288","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2152709","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2153523","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2153548","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2155083","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2155218","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2155444","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2158524","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2158959","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2159706","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2160160","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2162637","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2162882","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164844","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164856","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2164997","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2165012","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2165092","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2166428","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2167493","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168013","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168152","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168173","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168202","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168503","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168728","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2168866","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170016","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170448","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2170727","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172083","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172094","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172379","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172384","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172393","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172394","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2172756","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2173870","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2175132","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2179974","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180568","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2180761","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2181595","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2181991","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2184151","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2188287","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2189318","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2189687","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2192939","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2193010","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2203077","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2208310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2208557","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2208588","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2209968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2212499","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2213163","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2214285","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2214331","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2215050","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2215310","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2216006","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2216017","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2216158","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2216533","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2217397","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218179","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218278","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2218821","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2221673","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222725","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222816","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2222968","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2223567","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224122","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224170","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224185","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2224719","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2225534","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2226714","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2227753","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2229095","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2229810","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2230237","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2230459","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2231814","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2232500","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2232625","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2233162","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2233490","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2234387","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2234467","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236261","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236418","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236502","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236693","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2236806","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2237258","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238325","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238906","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2238952","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2239549","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2239630","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2239634","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2239767","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2240243","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2240956","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2241017","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2241046","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2241934","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242214","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242515","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2242812","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243256","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243344","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2243679","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244122","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244370","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244629","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2244811","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2245050","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2245081","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2245455","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2246121","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2246546","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2247081","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2248864","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2248865","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2249540","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2249736","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2249825","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2249847","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2249904","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2249913","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2250397","tags":["report"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=2249970","tags":["report"]},{"url":"https://security.access.redhat.com/data/csaf/v2/advisories/2024/rhsa-2024_2010.json","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2022-40896","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2022-40896","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2022-40896","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-4320","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-4320","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-4320","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-5189","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-5189","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-5189","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-36479","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-36479","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-36479","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-37276","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-37276","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-37276","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-45c4-8wx5-qw6w","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-38037","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-38037","tags":["advisory","report"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-40167","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-40167","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-40167","tags":["advisory"]},{"url":"https://github.com/eclipse/jetty.project/security/advisories/GHSA-hmr7-m48g-48f6","tags":["article"]},{"url":"https://www.rfc-editor.org/rfc/rfc9110#section-8.6","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-41164","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-41164","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-41164","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2023/sep/04/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-43665","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-43665","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-43665","tags":["advisory"]},{"url":"https://www.djangoproject.com/weblog/2023/oct/04/security-releases/","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-47627","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-47627","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-47627","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-gfw2-4jvh-wgfg","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-49081","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49081","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49081","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-q3qx-c6g2-7pw2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-49082","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-49082","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-49082","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-qvrw-v9rv-5rjx","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2023-52323","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2023-52323","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2023-52323","tags":["advisory"]},{"url":"https://github.com/Legrandin/pycryptodome/blob/master/Changelog.rst","tags":["article"]},{"url":"https://pypi.org/project/pycryptodomex/#history","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-21647","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-21647","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-21647","tags":["advisory"]},{"url":"https://github.com/puma/puma/security/advisories/GHSA-c2f4-cvqm-65w2","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-22047","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-22047","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22047","tags":["advisory"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-22195","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-22195","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-22195","tags":["advisory"]},{"url":"https://github.com/pallets/jinja/releases/tag/3.1.3","tags":["article"]},{"url":"https://github.com/pallets/jinja/security/advisories/GHSA-h5c8-rqwp-cp95","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23334","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23334","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23334","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-5h86-8mv2-jq9f","tags":["article"]},{"url":"https://access.redhat.com/security/cve/CVE-2024-23829","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2024-23829","tags":["advisory"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2024-23829","tags":["advisory"]},{"url":"https://github.com/aio-libs/aiohttp/security/advisories/GHSA-8qpw-xqxj-h4r2","tags":["article"]},{"url":"https://ubuntu.com/security/CVE-2023-38037","tags":["report"]},{"url":"https://github.com/rails/rails/commit/c85cc667ebfd3c270df37c7575d580ea6462e12f","tags":["report"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/OBVOVSGAX2OPRG2RF5ECRNES7R32LDVM/","tags":["advisory"]},{"url":"https://bugzilla.suse.com/1214807","tags":["report"]},{"url":"https://www.suse.com/security/cve/CVE-2023-38037","tags":["web"]},{"url":"","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2022-32224","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2022-44566","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22794","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-22796","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2023-28120","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-26143","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-28103","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-34341","tags":["web"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/HY4OG4XVEU3VJA7BHFONYS4OFAKMFV4J/","tags":["advisory"]},{"url":"https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/thread/3C5WPU2RXUSPKAI3EANLIGCY34ZDBZ4Y/","tags":["advisory"]},{"url":"https://www.suse.com/security/cve/CVE-2024-41128","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47887","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47888","tags":["web"]},{"url":"https://www.suse.com/security/cve/CVE-2024-47889","tags":["web"]}],"sources":{"cve":[{"id":"CVE-2023-38037","description":"ActiveSupport::EncryptedFile writes contents that will be encrypted to a\r\ntemporary file.  The temporary file's permissions are defaulted to the user's\r\ncurrent `umask` settings, meaning that it's possible for other users on the\r\nsame system to read the contents of the temporary file.\r\n\r\nAttackers that have access to the file system could possibly read the contents\r\nof this temporary file while a user is editing it.\r\n\r\nAll users running an affected release should either upgrade or use one of the\r\nworkarounds immediately.","status":"published","published":"2025-01-09T00:33:47.704Z","modified":"2025-02-15T00:10:27.79Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L","level":"medium","assessor":"cna"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:35:29.772612Z"}],"euvd":[{"id":"EUVD-2023-2274","description":"ActiveSupport::EncryptedFile writes contents that will be encrypted to a\r\ntemporary file.  The temporary file's permissions are defaulted to the user's\r\ncurrent `umask` settings, meaning that it's possible for other users on the\r\nsame system to read the contents of the temporary file.\r\n\r\nAttackers that have access to the file system could possibly read the contents\r\nof this temporary file while a user is editing it.\r\n\r\nAll users running an affected release should either upgrade or use one of the\r\nworkarounds immediately.","status":"published","published":"2025-01-09T00:33:47Z","modified":"2025-02-15T00:10:27Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T20:53:29.822486Z"}],"ghsa":[{"id":"GHSA-cr5q-6q9f-rq6q","title":"Active Support Possibly Discloses Locally Encrypted Files","description":"There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037.\n\nVersions Affected: \u003e= 5.2.0 Not affected: \u003c 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5\n\n# Impact\nActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file’s permissions are defaulted to the user’s current umask settings, meaning that it’s possible for other users on the same system to read the contents of the temporary file.\n\nAttackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.\n\nAll users running an affected release should either upgrade or use one of the workarounds immediately.\n\n# Releases\nThe fixed releases are available at the normal locations.\n\n# Workarounds\nTo work around this issue, you can set your umask to be more restrictive like this:\n\n```ruby\n$ umask 0077\n```","status":"published","published":"2023-08-23T20:36:24Z","modified":"2025-02-18T22:32:53Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L","level":"medium"}],"cwes":["CWE-377","CWE-732"],"updated_at":"2026-11-02T14:38:32.275316Z"}],"nvd":[{"id":"CVE-2023-38037","description":"ActiveSupport::EncryptedFile writes contents that will be encrypted to a\r\ntemporary file.  The temporary file's permissions are defaulted to the user's\r\ncurrent `umask` settings, meaning that it's possible for other users on the\r\nsame system to read the contents of the temporary file.\r\n\r\nAttackers that have access to the file system could possibly read the contents\r\nof this temporary file while a user is editing it.\r\n\r\nAll users running an affected release should either upgrade or use one of the\r\nworkarounds immediately.","status":"published","published":"2025-01-09T01:15:07.853Z","modified":"2026-06-17T06:09:17.32Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L","level":"medium","assessor":"secondary"}],"cwes":["CWE-732"],"updated_at":"2026-11-02T14:09:20.080574Z"}],"osv":[{"id":"DEBIAN-CVE-2023-38037","description":"ActiveSupport::EncryptedFile writes contents that will be encrypted to a\r temporary file.  The temporary file's permissions are defaulted to the user's\r current `umask` settings, meaning that it's possible for other users on the\r same system to read the contents of the temporary file.\r \r Attackers that have access to the file system could possibly read the contents\r of this temporary file while a user is editing it.\r \r All users running an affected release should either upgrade or use one of the\r workarounds immediately.","status":"published","published":"2025-01-09T01:15:07.853Z","modified":"2026-10-26T18:02:40.835367143Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T15:45:39.980321Z"},{"id":"GHSA-cr5q-6q9f-rq6q","title":"Active Support Possibly Discloses Locally Encrypted Files","description":"There is a possible file disclosure of locally encrypted files in Active Support. This vulnerability has been assigned the CVE identifier CVE-2023-38037.\n\nVersions Affected: \u003e= 5.2.0 Not affected: \u003c 5.2.0 Fixed Versions: 7.0.7.1, 6.1.7.5\n\n# Impact\nActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file. The temporary file’s permissions are defaulted to the user’s current umask settings, meaning that it’s possible for other users on the same system to read the contents of the temporary file.\n\nAttackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it.\n\nAll users running an affected release should either upgrade or use one of the workarounds immediately.\n\n# Releases\nThe fixed releases are available at the normal locations.\n\n# Workarounds\nTo work around this issue, you can set your umask to be more restrictive like this:\n\n```ruby\n$ umask 0077\n```","status":"published","published":"2023-08-23T20:36:24Z","modified":"2026-09-10T03:49:57.611332921Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L","level":"medium"}],"cwes":["CWE-377","CWE-732"],"updated_at":"2026-11-02T15:46:45.28161Z"},{"id":"OESA-2023-1627","title":"rubygem-railties security update","description":"Rails internals: application bootup, plugins, generators, and rake tasks. Railties is responsible to glue all frameworks together. Overall, it: * handles all the bootstrapping process for a Rails application; * manages rails command line interface; * provides Rails generators core;\r\n\r\nSecurity Fix(es):\r\n\r\n(CVE-2023-38037)","status":"published","published":"2023-09-15T11:06:04Z","modified":"2026-08-18T01:17:00.76457998Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"OESA-2023-1633","title":"rubygem-activesupport security update","description":"A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.\r\n\r\nSecurity Fix(es):\r\n\r\nAn insecure temporary file vulnerability was found in activesupport rubygem. Contents that will be encrypted are written to a temporary file that has the user’s current umask settings, possibly leading to information disclosure by other users on the same system.(CVE-2023-38037)","status":"published","published":"2023-09-15T11:06:05Z","modified":"2026-08-18T01:17:53.614113749Z","cvss":[{"version":"3.1","score":3.3,"vector":"CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:L/I:N/A:N","level":"low"}],"updated_at":"2026-11-02T15:52:40.328856Z"},{"id":"RHSA-2024:2010","title":"Red Hat Security Advisory: Satellite 6.15.0 release","status":"published","published":"2024-09-30T15:58:05Z","modified":"2026-10-13T10:06:37Z","cvss":[{"version":"3.1","score":7.6,"vector":"CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:L/I:H/A:L","level":"high"}],"updated_at":"2026-11-02T15:53:13.30378Z"},{"id":"UBUNTU-CVE-2023-38037","description":"ActiveSupport::EncryptedFile writes contents that will be encrypted to a temporary file.  The temporary file's permissions are defaulted to the user's current `umask` settings, meaning that it's possible for other users on the same system to read the contents of the temporary file. Attackers that have access to the file system could possibly read the contents of this temporary file while a user is editing it. All users running an affected release should either upgrade or use one of the workarounds immediately.","status":"published","published":"2025-01-09T01:15:00Z","modified":"2026-10-17T12:57:20.410451446Z","cvss":[{"version":"3.0","score":5.5,"vector":"CVSS:3.0/AV:L/AC:H/PR:L/UI:R/S:U/C:H/I:L/A:L","level":"medium"}],"updated_at":"2026-11-02T16:54:21.882004Z"},{"id":"CVE-2023-38037","description":"ActiveSupport::EncryptedFile writes contents that will be encrypted to a\r\ntemporary file.  The temporary file's permissions are defaulted to the user's\r\ncurrent `umask` settings, meaning that it's possible for other users on the\r\nsame system to read the contents of the temporary file.\r\n\r\nAttackers that have access to the file system could possibly read the contents\r\nof this temporary file while a user is editing it.\r\n\r\nAll users running an affected release should either upgrade or use one of the\r\nworkarounds immediately.","status":"published","published":"2025-01-09T01:15:07Z","modified":"2026-04-10T04:58:54.669288Z","updated_at":"2026-11-02T15:44:32.922049Z"},{"id":"DLA-4383-1","title":"rails - security update","status":"published","published":"2025-11-25T00:00:00Z","modified":"2025-11-25T20:17:54.333042Z","updated_at":"2026-11-02T15:46:12.7027Z"},{"id":"DSA-5881-1","title":"rails - security update","status":"published","published":"2025-03-17T00:00:00Z","modified":"2026-03-09T02:09:54.381319Z","updated_at":"2026-11-02T15:46:17.892347Z"},{"id":"openSUSE-SU-2023:0350-1","title":"Security update for rubygem-activesupport-5.2","description":"\nThis update for rubygem-activesupport-5.2 fixes the following issue:\n\n- CVE-2023-38037: fixed a File Disclosure of Locally Encrypted Files (bsc#1214807)\n","status":"published","published":"2023-11-03T23:01:11Z","modified":"2026-02-04T04:01:22.713113Z","updated_at":"2026-11-02T16:58:32.653274Z"},{"id":"openSUSE-SU-2024:13397-1","title":"ruby3.2-rubygem-activesupport-7.0-7.0.8-1.1 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-activesupport-7.0-7.0.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:18:33.371801Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13432-1","title":"ruby3.2-rubygem-activerecord-7.0-7.0.8-1.1 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-activerecord-7.0-7.0.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2026-02-04T02:38:48.060209Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:13433-1","title":"ruby3.2-rubygem-rails-7.0-7.0.8-1.1 on GA media","description":"These are all security issues fixed in the ruby3.2-rubygem-rails-7.0-7.0.8-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-15T00:00:00Z","modified":"2025-05-07T18:15:03.344713Z","updated_at":"2026-11-02T16:58:36.327643Z"},{"id":"openSUSE-SU-2024:14069-1","title":"ruby3.3-rubygem-activerecord-7.0-7.0.8.4-1.1 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-activerecord-7.0-7.0.8.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-24T00:00:00Z","modified":"2026-02-04T02:43:37.734729Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14071-1","title":"ruby3.3-rubygem-activesupport-7.0-7.0.8.4-1.1 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-activesupport-7.0-7.0.8.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-24T00:00:00Z","modified":"2026-02-04T04:25:32.172173Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2024:14074-1","title":"ruby3.3-rubygem-rails-7.0-7.0.8.4-1.1 on GA media","description":"These are all security issues fixed in the ruby3.3-rubygem-rails-7.0-7.0.8.4-1.1 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2024-06-24T00:00:00Z","modified":"2026-02-04T02:52:31.850939Z","updated_at":"2026-11-02T16:58:36.662953Z"},{"id":"openSUSE-SU-2025:15112-1","title":"ruby3.4-rubygem-activerecord-7.0-7.0.8.6-1.3 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-activerecord-7.0-7.0.8.6-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-17T00:00:00Z","modified":"2026-02-04T02:31:58.891555Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:15114-1","title":"ruby3.4-rubygem-activesupport-7.0-7.0.8.6-1.3 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-activesupport-7.0-7.0.8.6-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-17T00:00:00Z","modified":"2026-02-04T02:52:54.451407Z","updated_at":"2026-11-02T16:58:37.399567Z"},{"id":"openSUSE-SU-2025:15124-1","title":"ruby3.4-rubygem-rails-7.0-7.0.8.6-1.3 on GA media","description":"These are all security issues fixed in the ruby3.4-rubygem-rails-7.0-7.0.8.6-1.3 package on the GA media of openSUSE Tumbleweed.","status":"published","published":"2025-05-17T00:00:00Z","modified":"2026-02-04T03:52:20.531012Z","updated_at":"2026-11-02T16:58:37.399567Z"}]}}