Issued:
2016-09-13
Updated:
2016-09-13

RHSA-2016:1858 - Security Advisory

Synopsis

Moderate: ruby193-rubygem-actionpack security update

Type/Severity

Security Advisory: Moderate

Topic

An update for ruby193-rubygem-actionpack is now available for Red Hat Software Collections.

Red Hat Product Security has rated this update as having a security impact of Moderate. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available for each vulnerability from the CVE link(s) in the References section.

Description

Ruby on Rails is a model-view-controller (MVC) framework for web application development. Action Pack implements the controller and the view components.

Security Fix(es):

  • It was discovered that Action View tag helpers did not escape quotes when using strings declared as HTML safe as attribute values. A remote attacker could use this flaw to conduct a cross-site scripting (XSS) attack. (CVE-2016-6316)

Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Andrew Carpenter (Critical Juncture) as the original reporter.

Solution

For details on how to apply this update, which includes the changes described in this advisory, refer to:

https://access.redhat.com/articles/11258

All running applications using ruby193-rubygem-actionpack must be restarted for this update to take effect.

Affected Products

  • Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.5 x86_64
  • Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.4 x86_64
  • Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.3 x86_64
  • Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.2 x86_64
  • Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.1 x86_64
  • Red Hat Software Collections (for RHEL Server) 1 for RHEL 7 x86_64
  • Red Hat Software Collections (for RHEL Server) 1 for RHEL 6.7 x86_64
  • Red Hat Software Collections (for RHEL Server) 1 for RHEL 6.6 x86_64
  • Red Hat Software Collections (for RHEL Server) 1 for RHEL 6 x86_64
  • Red Hat Software Collections (for RHEL Workstation) 1 for RHEL 7 x86_64
  • Red Hat Software Collections (for RHEL Workstation) 1 for RHEL 6 x86_64

Fixes

  • BZ - 1365008 - CVE-2016-6316 rubygem-actionview: cross-site scripting flaw in Action View

CVEs

References

Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.5

SRPM
ruby193-rubygem-actionpack-3.2.8-20.el7.src.rpm SHA-256: a8b39394b68ff0a3942cd04a6b70d3421cc8b4768a0c8d5f3cad40a2a71a5ade
x86_64
ruby193-rubygem-actionpack-3.2.8-20.el7.noarch.rpm SHA-256: 4501a7865c8be1fca021211a6b48728f6b4381718945ae1109a393ffa2b3d5b4
ruby193-rubygem-actionpack-doc-3.2.8-20.el7.noarch.rpm SHA-256: 9e4f45e4e07ad1642a992b1849def900723343e18d0276822466f420716732f0

Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.4

SRPM
ruby193-rubygem-actionpack-3.2.8-20.el7.src.rpm SHA-256: a8b39394b68ff0a3942cd04a6b70d3421cc8b4768a0c8d5f3cad40a2a71a5ade
x86_64
ruby193-rubygem-actionpack-3.2.8-20.el7.noarch.rpm SHA-256: 4501a7865c8be1fca021211a6b48728f6b4381718945ae1109a393ffa2b3d5b4
ruby193-rubygem-actionpack-doc-3.2.8-20.el7.noarch.rpm SHA-256: 9e4f45e4e07ad1642a992b1849def900723343e18d0276822466f420716732f0

Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.3

SRPM
ruby193-rubygem-actionpack-3.2.8-20.el7.src.rpm SHA-256: a8b39394b68ff0a3942cd04a6b70d3421cc8b4768a0c8d5f3cad40a2a71a5ade
x86_64
ruby193-rubygem-actionpack-3.2.8-20.el7.noarch.rpm SHA-256: 4501a7865c8be1fca021211a6b48728f6b4381718945ae1109a393ffa2b3d5b4
ruby193-rubygem-actionpack-doc-3.2.8-20.el7.noarch.rpm SHA-256: 9e4f45e4e07ad1642a992b1849def900723343e18d0276822466f420716732f0

Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.2

SRPM
ruby193-rubygem-actionpack-3.2.8-20.el7.src.rpm SHA-256: a8b39394b68ff0a3942cd04a6b70d3421cc8b4768a0c8d5f3cad40a2a71a5ade
x86_64
ruby193-rubygem-actionpack-3.2.8-20.el7.noarch.rpm SHA-256: 4501a7865c8be1fca021211a6b48728f6b4381718945ae1109a393ffa2b3d5b4
ruby193-rubygem-actionpack-doc-3.2.8-20.el7.noarch.rpm SHA-256: 9e4f45e4e07ad1642a992b1849def900723343e18d0276822466f420716732f0

Red Hat Software Collections (for RHEL Server) 1 for RHEL 7.1

SRPM
ruby193-rubygem-actionpack-3.2.8-20.el7.src.rpm SHA-256: a8b39394b68ff0a3942cd04a6b70d3421cc8b4768a0c8d5f3cad40a2a71a5ade
x86_64
ruby193-rubygem-actionpack-3.2.8-20.el7.noarch.rpm SHA-256: 4501a7865c8be1fca021211a6b48728f6b4381718945ae1109a393ffa2b3d5b4
ruby193-rubygem-actionpack-doc-3.2.8-20.el7.noarch.rpm SHA-256: 9e4f45e4e07ad1642a992b1849def900723343e18d0276822466f420716732f0

Red Hat Software Collections (for RHEL Server) 1 for RHEL 7

SRPM
ruby193-rubygem-actionpack-3.2.8-20.el7.src.rpm SHA-256: a8b39394b68ff0a3942cd04a6b70d3421cc8b4768a0c8d5f3cad40a2a71a5ade
x86_64
ruby193-rubygem-actionpack-3.2.8-20.el7.noarch.rpm SHA-256: 4501a7865c8be1fca021211a6b48728f6b4381718945ae1109a393ffa2b3d5b4
ruby193-rubygem-actionpack-doc-3.2.8-20.el7.noarch.rpm SHA-256: 9e4f45e4e07ad1642a992b1849def900723343e18d0276822466f420716732f0

Red Hat Software Collections (for RHEL Server) 1 for RHEL 6.7

SRPM
ruby193-rubygem-actionpack-3.2.8-20.el6.src.rpm SHA-256: 6351aec2367d020265b3e7064bbf35b74c504661290774e1f469d77395ba4478
x86_64
ruby193-rubygem-actionpack-3.2.8-20.el6.noarch.rpm SHA-256: d7e390332708491e0b8750f8d4a5952b8f0762203fe4da87f22cee878ffb9de1
ruby193-rubygem-actionpack-doc-3.2.8-20.el6.noarch.rpm SHA-256: 92d76b515c4f4c36f374cc0daaa787c14b3349451f6824adb867fe69726d31be

Red Hat Software Collections (for RHEL Server) 1 for RHEL 6.6

SRPM
ruby193-rubygem-actionpack-3.2.8-20.el6.src.rpm SHA-256: 6351aec2367d020265b3e7064bbf35b74c504661290774e1f469d77395ba4478
x86_64
ruby193-rubygem-actionpack-3.2.8-20.el6.noarch.rpm SHA-256: d7e390332708491e0b8750f8d4a5952b8f0762203fe4da87f22cee878ffb9de1
ruby193-rubygem-actionpack-doc-3.2.8-20.el6.noarch.rpm SHA-256: 92d76b515c4f4c36f374cc0daaa787c14b3349451f6824adb867fe69726d31be

Red Hat Software Collections (for RHEL Server) 1 for RHEL 6

SRPM
ruby193-rubygem-actionpack-3.2.8-20.el6.src.rpm SHA-256: 6351aec2367d020265b3e7064bbf35b74c504661290774e1f469d77395ba4478
x86_64
ruby193-rubygem-actionpack-3.2.8-20.el6.noarch.rpm SHA-256: d7e390332708491e0b8750f8d4a5952b8f0762203fe4da87f22cee878ffb9de1
ruby193-rubygem-actionpack-doc-3.2.8-20.el6.noarch.rpm SHA-256: 92d76b515c4f4c36f374cc0daaa787c14b3349451f6824adb867fe69726d31be

Red Hat Software Collections (for RHEL Workstation) 1 for RHEL 7

SRPM
ruby193-rubygem-actionpack-3.2.8-20.el7.src.rpm SHA-256: a8b39394b68ff0a3942cd04a6b70d3421cc8b4768a0c8d5f3cad40a2a71a5ade
x86_64
ruby193-rubygem-actionpack-3.2.8-20.el7.noarch.rpm SHA-256: 4501a7865c8be1fca021211a6b48728f6b4381718945ae1109a393ffa2b3d5b4
ruby193-rubygem-actionpack-doc-3.2.8-20.el7.noarch.rpm SHA-256: 9e4f45e4e07ad1642a992b1849def900723343e18d0276822466f420716732f0

Red Hat Software Collections (for RHEL Workstation) 1 for RHEL 6

SRPM
ruby193-rubygem-actionpack-3.2.8-20.el6.src.rpm SHA-256: 6351aec2367d020265b3e7064bbf35b74c504661290774e1f469d77395ba4478
x86_64
ruby193-rubygem-actionpack-3.2.8-20.el6.noarch.rpm SHA-256: d7e390332708491e0b8750f8d4a5952b8f0762203fe4da87f22cee878ffb9de1
ruby193-rubygem-actionpack-doc-3.2.8-20.el6.noarch.rpm SHA-256: 92d76b515c4f4c36f374cc0daaa787c14b3349451f6824adb867fe69726d31be

The Red Hat security contact is secalert@redhat.com. More contact details at https://access.redhat.com/security/team/contact/.