-
-
Notifications
You must be signed in to change notification settings - Fork 218
/
CVE-2011-2932.yml
39 lines (39 loc) · 1.78 KB
/
CVE-2011-2932.yml
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
---
gem: activesupport
framework: rails
cve: 2011-2932
ghsa: 9fh3-vh3h-q4g3
url: http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
title: UTF-8 escaping vulnerability in rails/activesupport
date: 2017-10-24
description: |
Cross-site scripting (XSS) vulnerability in
activesupport/lib/active_support/core_ext/string/output_safety.rb
in Ruby on Rails 2.x before 2.3.13, 3.0.x before 3.0.10, and
3.1.x before 3.1.0.rc5 allows remote attackers to inject arbitrary
web script or HTML via a malformed Unicode string, related to
a "UTF-8 escaping vulnerability."
cvss_v2: 4.3
patched_versions:
- "~> 2.3.13"
- "~> 3.0.10"
- "~> 3.1.0.rc5"
- ">= 3.1.0"
related:
url:
- https://nvd.nist.gov/vuln/detail/CVE-2011-2932
- http://weblog.rubyonrails.org/2011/8/16/ann-rails-3-1-0-rc6
- https://groups.google.com/g/rubyonrails-security/c/Vr_7WSOrEZU/m/IZ_bc5d00vEJ
- https://github.com/rails/rails/commit/bfc432574d0b141fd7fe759edfe9b6771dd306bd
- https://bugzilla.redhat.com/show_bug.cgi?id=731435
- https://github.com/advisories/GHSA-9fh3-vh3h-q4g3
- http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065114.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065189.html
- http://lists.fedoraproject.org/pipermail/package-announce/2011-September/065212.html
- http://www.openwall.com/lists/oss-security/2011/08/17/1
- http://www.openwall.com/lists/oss-security/2011/08/19/11
- http://www.openwall.com/lists/oss-security/2011/08/20/1
- http://www.openwall.com/lists/oss-security/2011/08/22/13
- http://www.openwall.com/lists/oss-security/2011/08/22/14
- http://www.openwall.com/lists/oss-security/2011/08/22/5
- https://web.archive.org/web/20111225083933/http://secunia.com/advisories/45917