OESA-2021-1145

See a problem?
Please try reporting it to the source first.
Source
https://www.openeuler.org/en/security/security-bulletins/detail/?id=openEuler-SA-2021-1145
Import Source
https://repo.openeuler.org/security/data/osv/OESA-2021-1145.json
JSON Data
https://api.test.osv.dev/v1/vulns/OESA-2021-1145
Upstream
Published
2021-04-07T11:02:49Z
Modified
2025-08-12T05:06:45.756612Z
Summary
rubygem-rails security update
Details

Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.

Security Fix(es):

A deserialization of untrusted data vulnernerability exists in rails < 5.2.4.3, rails < 6.0.3.1 that can allow an attacker to unmarshal user-provided objects in MemCacheStore and RedisCacheStore potentially resulting in an RCE.(CVE-2020-8165)

A client side enforcement of server side security vulnerability exists in rails < 5.2.4.2 and rails < 6.0.3.1 ActiveStorages S3 adapter that allows the Content-Length of a direct file upload to be modified by an end user bypassing upload limits.(CVE-2020-8162)

Database specific 
{
    "severity": "Critical"
}
References

Affected packages

openEuler:20.03-LTS-SP1 / rubygem-rails

Package

Name
rubygem-rails
Purl
pkg:rpm/openEuler/rubygem-rails&distro=openEuler-20.03-LTS-SP1

Affected ranges

Type
ECOSYSTEM
Events
Introduced
0Unknown introduced version / All previous versions are affected
Fixed
5.2.4.4-1.oe1

Ecosystem specific 

{
    "src": [
        "rubygem-rails-5.2.4.4-1.oe1.src.rpm"
    ],
    "noarch": [
        "rubygem-rails-5.2.4.4-1.oe1.noarch.rpm",
        "rubygem-rails-doc-5.2.4.4-1.oe1.noarch.rpm"
    ]
}