VulnerableCode Package Details - pkg:rpm/redhat/ruby193-rubygem-activesupport@1:3.2.8-6?arch=el6

Search for packages

Vulnerability	Summary	Fixed by
VCID-9hq5-3usy-5fhq Aliases: CVE-2016-0751 GHSA-ffpv-c4hm-3x6v	Possible Object Leak and Denial of Service attack A carefully crafted `Accept` header can cause a global cache of mime types to grow indefinitely which can lead to a possible denial of service attack in Action Pack.	There are no reported fixed by versions.
VCID-bjwf-uhyk-63aj Aliases: CVE-2015-7576 GHSA-p692-7mm3-3fxg	Timing attack vulnerability in basic authentication Due to the way that Action Controller compares user names and passwords in basic authentication authorization code, it is possible for an attacker to analyze the time taken by a response and intuit the password. You can tell you application is vulnerable to this attack by looking for `http_basic_authenticate_with` method calls in your application.	There are no reported fixed by versions.
VCID-s5ah-tf63-a7cw Aliases: CVE-2016-2098 GHSA-78rc-8c29-p45g	Improper Input Validation The Rails gem allows remote attackers to execute arbitrary Ruby code by leveraging an application's unrestricted use of the render method.	There are no reported fixed by versions.
VCID-thx6-usb2-kkgc Aliases: CVE-2015-7577 GHSA-xrr6-3pc4-m447	Nested attributes rejection proc bypass When using the nested attributes feature in Active Record you can prevent the destruction of associated records by passing the `allow_destroy: false` option to the `accepts_nested_attributes_for` method. The `allow_destroy` flag prevents the `:reject_if` proc from being called because it assumes that the record will be destroyed anyway. However, this is not true if `:allow_destroy` is false so this leads to changes that would have been rejected being applied to the record. Attackers could set attributes to invalid values or clear all the attributes.	There are no reported fixed by versions.
VCID-v3r3-bwp5-a3bn Aliases: CVE-2016-0752 GHSA-xrr4-p6fq-hjg7	Path Traversal The Rails gem allows remote attackers to read arbitrary files by leveraging an application's unrestricted use of the render method and providing a `..` in a pathname.	There are no reported fixed by versions.
VCID-z1jv-4ga2-7kd1 Aliases: CVE-2016-2097 GHSA-vx9j-46rh-fqr8	Possible Information Leak Vulnerability Applications that pass unverified user input to the `render` method in a controller may be vulnerable to an information leak vulnerability. Impacted code will look something like this: ``` def index; render params[:id]; end ``` Carefully crafted requests can cause the above code to render files from unexpected places like outside the application's view directory, and can possibly escalate this to a remote code execution attack.	There are no reported fixed by versions.

Vulnerability

Summary

Fixed by

VCID-9hq5-3usy-5fhq
Aliases:
CVE-2016-0751
GHSA-ffpv-c4hm-3x6v

Possible Object Leak and Denial of Service attack A carefully crafted `Accept` header can cause a global cache of mime types to grow indefinitely which can lead to a possible denial of service attack in Action Pack.