Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - Multiple cross-site scripting (XSS) vulnerabilities in actionview/lib/action_view/helpers/number_helper.rb
    in Ruby on Rails before 3.2.17, 4.0.x before 4.0.3, and 4.1.x before 4.1.0.beta2 allow remote attackers to
    inject arbitrary web script or HTML via the (1) format, (2) negative_format, or (3) units parameter to the
    (a) number_to_currency, (b) number_to_percentage, or (c) number_to_human helper. (CVE-2014-0081)

rubygem-actionpack-3_2 was updated to fix security issues :

  - fix CVE-2014-0081: XSS Vulnerability in     number_to_currency, number_to_percentage and     number_to_human (bnc#864433) 

  - fix CVE-2014-0082: Denial of Service Vulnerability in     Action View when using render :text (bnc#864431)

Several vulnerabilities were discovered in Action Pack, a component of Ruby on Rails.

  - CVE-2014-0081     actionview/lib/action_view/helpers/number_helper.rb     contains multiple cross-site scripting vulnerabilities

  - CVE-2014-0082     actionpack/lib/action_view/template/text.rb performs     symbol interning on MIME type strings, allowing remote     denial-of-service attacks via increased memory     consumption.

  - CVE-2014-0130     A directory traversal vulnerability in     actionpack/lib/abstract_controller/base.rb allows remote     attackers to read arbitrary files.

The remote CentOS host is missing a security update which has been documented in Red Hat advisory RHSA-2014:0306.

This fixes Ruby on Rails 3.2.17 security issues :

  - CVE-2014-0081

    - CVE-2014-0082

Includes security patches for :

  - CVE-2013-6417 - Incomplete fix to CVE-2013-0155 (Unsafe     Query Generation Risk)

    - CVE-2013-4491 - Reflective XSS Vulnerability in Ruby       on Rails

    - CVE-2013-6415 - XSS Vulnerability in       number_to_currency

    - CVE-2013-6414 - Denial of Service Vulnerability in       Action View

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

This fixes Ruby on Rails 4.0.3 security CVEs :

  - CVE-2014-0080

    - CVE-2014-0081

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Type	Severity
422721	SCA: security update for actionpack, rails (GHSA-m46p-ggm5-5j83)	Tenable Cloud Security	SCA Checks	Local	medium
422721	SCA: security update for actionpack, rails (GHSA-m46p-ggm5-5j83)	Tenable Self-Hosted Container Security	SCA Checks	Local	medium
75268	openSUSE Security Update : rubygem-actionpack-3_2 (openSUSE-SU-2014:0295-1)	Nessus	SuSE Local Security Checks	Local	medium
74043	Debian DSA-2929-1 : ruby-actionpack-3.2 - security update	Nessus	Debian Local Security Checks	Local	medium
73064	CentOS 6 : ruby193-rubygem-actionpack (CESA-2014:0306)	Nessus	CentOS Local Security Checks	Local	medium
72915	Fedora 19 : rubygem-actionpack-3.2.13-5.fc19 (2014-3232)	Nessus	Fedora Local Security Checks	Local	medium
72914	Fedora 20 : rubygem-actionpack-4.0.0-3.fc20 / rubygem-activerecord-4.0.0-2.fc20 (2014-3169)	Nessus	Fedora Local Security Checks	Local	medium

Detections

Analytics

CVE-2014-0081

medium

Tenable Plugins

medium

medium

medium

medium

medium

medium

medium