The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8, and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic string method, as demonstrated by the sub method.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - The cross-site scripting (XSS) prevention feature in Ruby on Rails 2.x before 2.3.12, 3.0.x before 3.0.8,
    and 3.1.x before 3.1.0.rc2 does not properly handle mutation of safe buffers, which makes it easier for
    remote attackers to conduct XSS attacks via crafted strings to an application that uses a problematic
    string method, as demonstrated by the sub method. (CVE-2011-2197)

This update fixes :

  - Bug #713692 - CVE-2011-2197 rubygem-activesupport: XSS     due improper management of safe buffers

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
423397	SCA: security update for actionpack, activesupport (GHSA-v9v4-7jp6-8c73)	Tenable Cloud Security	SCA Checks	medium
423397	SCA: security update for actionpack, activesupport (GHSA-v9v4-7jp6-8c73)	Tenable Self-Hosted Container Security	SCA Checks	medium
55556	Fedora 15 : rubygem-actionpack-3.0.5-3.fc15 (2011-8580)	Nessus	Fedora Local Security Checks	medium
55466	Fedora 15 : rubygem-activesupport-3.0.5-3.fc15 (2011-8494)	Nessus	Fedora Local Security Checks	medium

Detections

Analytics

CVE-2011-2197

medium

Tenable Plugins

medium

medium

medium

medium