MGASA-2014-0303: ruby-actionmailer Mageia
Vulnerability summary
MGASA-2014-0303 is a vulnerability in ruby-actionmailer Mageia with no CVSS score yet.
Advisory lineage
Upstream 2 · Downstream 0Timeline
- 26-07-2014PublishedVulnerability first disclosed.
- 16-04-2026Last modifiedVulnerability information updated.
Description
Updated ruby-actionpack packages fix security issues Updated ruby-actionpack and ruby-activerecord packages fix security vulnerabilities: Directory traversal vulnerability in actionpack/lib/abstract_controller/base.rb in the implicit-render implementation in Ruby on Rails before 4.0.5, when certain route globbing configurations are enabled, allows remote attackers to read arbitrary files via a crafted request (CVE-2014-0130). PostgreSQL supports a number of unique data types which are not present in other supported databases. A bug in the SQL quoting code in ActiveRecord in Ruby on Rails before 4.0.7 can allow an attacker to inject arbitrary SQL using carefully crafted values (CVE-2014-3483). The associated Ruby on Rails packages have been updated to version 4.0.8, to address these and other issues.
CVSS metrics
Risk metrics not yet published.
EPSS trend
No EPSS score has been published for this record yet.
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Mageia7 products
- ruby-actionmailer< 4.0.8-1.mga4
- ruby-actionpack< 4.0.8-1.mga4
- ruby-activemodel< 4.0.8-1.mga4
- ruby-activerecord< 4.0.8-1.mga4
- ruby-activesupport< 4.0.8-1.mga4
1 vendor · 7 products