{"schemaVersion":3,"id":"USN-7497-1","aliases":[],"status":"published","duplicateOf":null,"title":null,"description":"ruby-carrierwave vulnerabilities\n\nRikita Ishikawa discovered that CarrierWave did not correctly sanitize\ncertain inputs. An attacker could possibly use this issue to execute\narbitrary code. This issue only affected Ubuntu 18.04 LTS and\nUbuntu 20.04 LTS. (CVE-2021-21305)\n\nNorihide Saito discovered that CarrierWave did not correctly sanitize\ncertain inputs. An attacker could possibly use this issue to execute a\ncross-site scripting (XSS) attack. (CVE-2023-49090)","dates":{"published":"2025-05-07T01:25:52.000Z","modified":"2026-04-27T17:58:21.383Z","reserved":null,"kevAdded":[],"kevDue":[]},"cvss":{"headline":{"score":null,"severity":"unknown","version":null,"versionLabel":null,"source":null,"vector":null,"computed":false,"selection":"none"},"metrics":[]},"epss":{"probability":null,"percentile":null,"severity":"unknown","asOf":null,"change":{"pp":null,"baselineDate":null,"baselineScore":null},"history":[],"last30":[]},"kev":{"state":"not-listed","entries":[],"listedCount":0,"totalCatalogs":3,"catalogs":[{"source":"cisa","label":"CISA","listed":false,"entry":null},{"source":"enisa","label":"ENISA","listed":false,"entry":null},{"source":"circl","label":"CIRCL","listed":false,"entry":null}]},"ransomware":{"state":"none-recorded","sources":[]},"exploits":[],"exploitCount":0,"weaknesses":[],"affected":[{"vendor":"ubuntu","product":"ruby-carrierwave","name":"ruby-carrierwave","label":"ruby-carrierwave","ecosystem":"Ubuntu","cpePart":null,"purl":"pkg:deb/ubuntu/ruby-carrierwave","purlType":"deb","versions":[{"text":"< 1.2.2-1ubuntu0.1~esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 1.3.1-2ubuntu0.1~esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 1.3.2-2ubuntu0.22.04.1~esm1","noFixRecorded":false,"fixedIn":null},{"text":"< 1.3.2-2ubuntu0.24.04.1~esm1","noFixRecorded":false,"fixedIn":null}],"versionsText":"< 1.2.2-1ubuntu0.1~esm1 | < 1.3.1-2ubuntu0.1~esm1 | < 1.3.2-2ubuntu0.22.04.1~esm1 | < 1.3.2-2ubuntu0.24.04.1~esm1","eol":null,"hubHref":null}],"affectedCount":1,"eol":{"hasEol":false,"count":0},"references":[{"url":"https://ubuntu.com/security/notices/USN-7497-1","label":"ubuntu.com/security/notices/USN-7497-1","hostname":"ubuntu.com","tags":["Advisory"]},{"url":"https://ubuntu.com/security/CVE-2021-21305","label":"ubuntu.com/security/CVE-2021-21305","hostname":"ubuntu.com","tags":["REPORT"]},{"url":"https://ubuntu.com/security/CVE-2023-49090","label":"ubuntu.com/security/CVE-2023-49090","hostname":"ubuntu.com","tags":["REPORT"]}],"lineage":{"upstream":["CVE-2021-21305","CVE-2023-49090"],"downstream":[],"duplicates":[],"related":["CVE-2021-21305","CVE-2023-49090"]},"timeline":[{"kind":"published","date":"2025-05-07T01:25:52.000Z","label":"Published","detail":"Vulnerability first disclosed.","source":null},{"kind":"modified","date":"2026-04-27T17:58:21.383Z","label":"Last modified","detail":"Vulnerability information updated.","source":null}],"risk":{"score":0,"level":"minimal","profile":"Default","thresholds":{"critical":75,"high":50,"medium":25,"low":10}},"meta":{"dataAsOf":"2026-10-21T16:03:48.607Z","stale":false,"partial":false}}