Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2012-6496 (GCVE-0-2012-6496)
Vulnerability from cvelistv5
Published
2013-01-04 02:00
Modified
2024-08-06 21:28
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T21:28:39.807Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=889649"
},
{
"name": "RHSA-2013:0155",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0155.html"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/"
},
{
"name": "RHSA-2013:0220",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0220.html"
},
{
"name": "GLSA-201401-22",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO",
"x_transferred"
],
"url": "http://security.gentoo.org/glsa/glsa-201401-22.xml"
},
{
"name": "RHSA-2013:0154",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
},
{
"name": "[rubyonrails-security] 20130102 SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664)",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://groups.google.com/group/rubyonrails-security/msg/23daa048baf28b64?dmode=source\u0026output=gplain"
},
{
"name": "57084",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/57084"
},
{
"name": "RHSA-2013:0544",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0544.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2012-12-21T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls."
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2016-12-06T18:57:01",
"orgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"shortName": "mitre"
},
"references": [
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=889649"
},
{
"name": "RHSA-2013:0155",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0155.html"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/"
},
{
"name": "RHSA-2013:0220",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0220.html"
},
{
"name": "GLSA-201401-22",
"tags": [
"vendor-advisory",
"x_refsource_GENTOO"
],
"url": "http://security.gentoo.org/glsa/glsa-201401-22.xml"
},
{
"name": "RHSA-2013:0154",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
},
{
"name": "[rubyonrails-security] 20130102 SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664)",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://groups.google.com/group/rubyonrails-security/msg/23daa048baf28b64?dmode=source\u0026output=gplain"
},
{
"name": "57084",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/57084"
},
{
"name": "RHSA-2013:0544",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0544.html"
}
],
"x_legacyV4Record": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-6496",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=889649",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=889649"
},
{
"name": "RHSA-2013:0155",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0155.html"
},
{
"name": "http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/",
"refsource": "MISC",
"url": "http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/"
},
{
"name": "RHSA-2013:0220",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0220.html"
},
{
"name": "GLSA-201401-22",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-201401-22.xml"
},
{
"name": "RHSA-2013:0154",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
},
{
"name": "[rubyonrails-security] 20130102 SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664)",
"refsource": "MLIST",
"url": "https://groups.google.com/group/rubyonrails-security/msg/23daa048baf28b64?dmode=source\u0026output=gplain"
},
{
"name": "57084",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/57084"
},
{
"name": "RHSA-2013:0544",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0544.html"
}
]
}
}
}
},
"cveMetadata": {
"assignerOrgId": "8254265b-2729-46b6-b9e3-3dfca2d5bfca",
"assignerShortName": "mitre",
"cveId": "CVE-2012-6496",
"datePublished": "2013-01-04T02:00:00",
"dateReserved": "2013-01-03T00:00:00",
"dateUpdated": "2024-08-06T21:28:39.807Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2012-6496\",\"sourceIdentifier\":\"cve@mitre.org\",\"published\":\"2013-01-04T04:46:02.947\",\"lastModified\":\"2025-04-11T00:51:21.963\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de inyecci\u00f3n SQL en el componente Active Record en Ruby on Rails antes de v3.0.18, v3.1.x antes de v3.1.9, y v3.2.x antes de v3.2.10, permite a atacantes remotos ejecutar comandos SQL a trav\u00e9s de una solicitud modificada que aprovecha el comportamiento incorrecto de buscadores din\u00e1micos en aplicaciones que pueden utilizar los tipos de datos inesperados en ciertas llamadas al m\u00e9todo find_by_.\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-89\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DB51F3E9-4899-49A9-9E7B-0DCA92A91DD8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:*\",\"matchCriteriaId\":\"F884F2F4-94F3-46CB-860B-1BCC0EEF408A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"88DFBB48-1C29-4639-9369-F5B413CA2337\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"D37696D7-BEE6-4587-9E33-A7FE24780409\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"E95B5D44-0C8D-47BC-A89D-48A5BDEB84F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"1DFDAF6A-76AA-436F-A4F3-DA69892DE2B8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"D3172982-3FA4-427F-BE3E-2321D804E49D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:*\",\"matchCriteriaId\":\"FD6EC85B-F092-48FF-966A-96B9227C8656\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:*\",\"matchCriteriaId\":\"9000F3C1-57A0-474C-9C82-E58688F29838\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:*\",\"matchCriteriaId\":\"6E55E42E-AB6A-4E47-AC69-DFDAEB0A8735\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A42F4E7A-6F6A-485C-8D30-95F3B0285922\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"30B9C0CB-F6E6-4233-84E4-D6E69104DD73\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"84309CC7-A8B7-4ADB-AEA1-964DA5F7B0E0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"5343241F-274D-45FF-97C7-2BC2E920BAF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FED122B8-AF4C-4C48-B1E5-54F4A7A31A53\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"157ACCAD-0FB8-4CC9-9DFB-70835DE6506C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"3E50ACF6-7277-4C9A-B42A-E7EFDC317691\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C191DC2B-1EC3-48E0-A586-867E6EE4431C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3AA51263-6680-42C6-B119-8241D6F76206\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B4BC41E8-FEDA-4C31-B479-D49A59FC4D63\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"09C20971-53B5-43B0-AC45-5AA0FDF1B054\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"D1AEFA5D-A793-4BAB-8DED-3D3A31260AD8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"496902D6-409A-40D9-849F-C41264BE5B04\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2482AB3F-8303-4F95-BE04-C5F06EEF2015\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.1.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"244C6952-377C-4AF0-8BA2-C34516A3EB5A\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E3BE7DFE-BA20-434B-A1DE-AD038B255C60\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*\",\"matchCriteriaId\":\"DCEE5B21-C990-4705-8239-0D7B29DAEDA1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*\",\"matchCriteriaId\":\"65EE33B1-B079-4CDE-B9C2-F1613A4610DC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*\",\"matchCriteriaId\":\"5CAAA20B-824F-4448-99DC-9712FE628073\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*\",\"matchCriteriaId\":\"D2BEBDFB-0F30-454A-B74C-F820C9D2708B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*\",\"matchCriteriaId\":\"1D7CD8C1-95D1-477E-AD96-6582EC33BA01\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"B6F00D98-3D0F-40AF-AE4F-090B1E6B660C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9476CE55-69C0-45D3-B723-6F459C90BF05\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:*\",\"matchCriteriaId\":\"486F5BA6-BCF7-4691-9754-19D364B4438D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"112FC73B-A8BC-4EEA-9F4B-CCE685EF2838\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:*\",\"matchCriteriaId\":\"E4498383-6FCA-4E17-A1FD-B0CE7EE50F85\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D26565B1-2BA6-4A3C-9264-7FC9A1820B59\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"644EF85E-6D3E-4F5C-96B0-49AD2A2D90CE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"392E2D58-CB39-4832-B4D9-9C2E23B8E14C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F2466EA-7039-46A1-B4A3-8DACD1953A59\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0CAB4E72-0A15-4B26-9B69-074C278568D6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A085E105-9375-440A-80CB-9B23E6D7EB4A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"25911E48-C5D7-4ED8-B4DB-7523A74CCF49\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE6EC1E5-3A4A-4751-9F77-28EF5AF681E3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"B29674E3-CC80-446B-9A43-82594AE7A058\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"FF34D8CB-2B6D-4CB8-A206-108293BCFFE7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"8E5187F6-E3AC-4E0D-B1D0-83DE76C20A4B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"272268EE-E3E8-4683-B679-55D748877A7E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"7B69FD33-61FE-4F10-BBE1-215F59035D30\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"08D7CB5D-82EF-4A24-A792-938FAB40863D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"8A044B21-47D5-468D-AF4A-06B3B5CC0824\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2196F3D0-532A-40F9-843A-1DFBC8B63FDC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"CBEDA932-6CB5-438C-94E4-824732A91BE0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"903E5524-5E45-48CE-A804-EDAEBE3A79AD\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:*\",\"matchCriteriaId\":\"08534AF2-F94E-4FB6-A572-4FB9827276D4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:*\",\"matchCriteriaId\":\"29E3B4A6-1346-4358-B7BC-84D00ED3ABBE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:*\",\"matchCriteriaId\":\"B52D7A6B-DD93-45F0-9186-18ABEFF28DF4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1F07C641-48DF-43BE-9EB5-72B337C54846\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"A1CB1B12-99F5-430F-AE19-9A95C17FA123\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D1A7C449-8F9A-4CE5-9C3D-375996BFAEE3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"05D5D58C-DB79-41EA-81AE-5D95C48211B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE331D6D-99BA-4369-AD8B-B556DEE4955F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"58304E17-ADFD-4686-9CCF-C1CA31843B94\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"05108EF0-81AD-4378-9843-5C23F2AC79A3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"4EE7DA7E-23A5-42AF-9D5C-39240CE2FBDB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.0.16:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0C448F62-8231-4221-ADA0-C9B848AE03D1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:*\",\"versionEndIncluding\":\"3.0.17\",\"matchCriteriaId\":\"53AE7CCA-1E57-4925-A025-F1BBFCE70272\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"224BD488-0D7E-4F8B-9012-DE872DEB544C\"}]}]},{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"2816C02C-E13E-4367-91F3-14756A90EC9E\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"E82AF7C7-B725-40EF-8EE3-18F8E7FAEB29\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"1AE674DE-65DB-437E-A034-A2EE5C584B33\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0524F3E3-BAD7-4CD3-A6E7-74CFBE4B46E6\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"32EB2C3F-0F24-43DB-988E-BD2973598F71\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"EB32713D-FE64-445E-872E-B4678C243AB1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"C55E6B4A-2B9C-46C8-A739-109EA4BA7FD4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"89C618DC-38BC-4484-8C41-BC38B7EB636B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:*\",\"matchCriteriaId\":\"FE1EF01A-F358-45D3-ADA2-51DD1D8CB6E2\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"AC2616BD-A4E8-42F3-BB5A-7517DC4EDA3D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:*\",\"matchCriteriaId\":\"0E376782-98B0-4766-B6FC-67E032A00C62\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"96D08DC1-14E9-4DB9-BC95-3F73B454FBC4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"F365C9E5-27DC-46C3-AFE4-4876EC7B352B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6F0016A6-0ED6-443D-B969-CB1226D8E28C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.8:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"E69470EA-5EBC-4FB9-A722-5B61C70C1140\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubyonrails:rails:3.2.9:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"B13A8EBB-4211-4AB1-8872-244EEEE20ABD\"}]}]}],\"references\":[{\"url\":\"http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-0154.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-0155.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-0220.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-0544.html\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://security.gentoo.org/glsa/glsa-201401-22.xml\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://www.securityfocus.com/bid/57084\",\"source\":\"cve@mitre.org\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=889649\",\"source\":\"cve@mitre.org\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"https://groups.google.com/group/rubyonrails-security/msg/23daa048baf28b64?dmode=source\u0026output=gplain\",\"source\":\"cve@mitre.org\"},{\"url\":\"http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-0154.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-0155.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-0220.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-0544.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://security.gentoo.org/glsa/glsa-201401-22.xml\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/57084\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://bugzilla.redhat.com/show_bug.cgi?id=889649\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Exploit\",\"Patch\"]},{\"url\":\"https://groups.google.com/group/rubyonrails-security/msg/23daa048baf28b64?dmode=source\u0026output=gplain\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
rhsa-2013:0154
Vulnerability from csaf_redhat
Published
2013-01-10 20:39
Modified
2024-11-22 06:14
Summary
Red Hat Security Advisory: Ruby on Rails security update
Notes
Topic
Updated rubygem-actionpack, rubygem-activesupport, and rubygem-activerecord
packages that fix multiple security issues are now available for Red Hat
Subscription Asset Manager.
The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Ruby on Rails is a model–view–controller (MVC) framework for web
application development. Action Pack implements the controller and the view
components. Active Record implements object-relational mapping for
accessing database entries using objects. Active Support provides support
and utility classes used by the Ruby on Rails framework.
Multiple flaws were found in the way Ruby on Rails performed XML parameter
parsing in HTTP requests. A remote attacker could use these flaws to
execute arbitrary code with the privileges of a Ruby on Rails application,
perform SQL injection attacks, or bypass the authentication using a
specially-created HTTP request. (CVE-2013-0156)
Red Hat is aware that a public exploit for the CVE-2013-0156 issues is
available that allows remote code execution in applications using Ruby on
Rails.
Multiple input validation vulnerabilities were discovered in
rubygem-activerecord. A remote attacker could possibly use these flaws to
perform an SQL injection attack against an application using
rubygem-activerecord. (CVE-2012-2661, CVE-2012-2695, CVE-2012-6496,
CVE-2013-0155)
Multiple input validation vulnerabilities were discovered in
rubygem-actionpack. A remote attacker could possibly use these flaws to
perform an SQL injection attack against an application using
rubygem-actionpack and rubygem-activerecord. (CVE-2012-2660, CVE-2012-2694)
Multiple cross-site scripting (XSS) flaws were found in rubygem-actionpack.
A remote attacker could use these flaws to conduct XSS attacks against
users of an application using rubygem-actionpack. (CVE-2012-3463,
CVE-2012-3464, CVE-2012-3465)
A flaw was found in the HTTP digest authentication implementation in
rubygem-actionpack. A remote attacker could use this flaw to cause a
denial of service of an application using rubygem-actionpack and digest
authentication. (CVE-2012-3424)
Users are advised to upgrade to these updated rubygem-actionpack,
rubygem-activesupport, and rubygem-activerecord packages, which resolve
these issues. Katello must be restarted ("service katello restart") for
this update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated rubygem-actionpack, rubygem-activesupport, and rubygem-activerecord\npackages that fix multiple security issues are now available for Red Hat\nSubscription Asset Manager.\n\nThe Red Hat Security Response Team has rated this update as having critical\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model\u2013view\u2013controller (MVC) framework for web\napplication development. Action Pack implements the controller and the view\ncomponents. Active Record implements object-relational mapping for\naccessing database entries using objects. Active Support provides support\nand utility classes used by the Ruby on Rails framework.\n\nMultiple flaws were found in the way Ruby on Rails performed XML parameter\nparsing in HTTP requests. A remote attacker could use these flaws to\nexecute arbitrary code with the privileges of a Ruby on Rails application,\nperform SQL injection attacks, or bypass the authentication using a\nspecially-created HTTP request. (CVE-2013-0156)\n\nRed Hat is aware that a public exploit for the CVE-2013-0156 issues is\navailable that allows remote code execution in applications using Ruby on\nRails.\n\nMultiple input validation vulnerabilities were discovered in\nrubygem-activerecord. A remote attacker could possibly use these flaws to\nperform an SQL injection attack against an application using\nrubygem-activerecord. (CVE-2012-2661, CVE-2012-2695, CVE-2012-6496,\nCVE-2013-0155)\n\nMultiple input validation vulnerabilities were discovered in\nrubygem-actionpack. A remote attacker could possibly use these flaws to\nperform an SQL injection attack against an application using\nrubygem-actionpack and rubygem-activerecord. (CVE-2012-2660, CVE-2012-2694)\n\nMultiple cross-site scripting (XSS) flaws were found in rubygem-actionpack.\nA remote attacker could use these flaws to conduct XSS attacks against\nusers of an application using rubygem-actionpack. (CVE-2012-3463,\nCVE-2012-3464, CVE-2012-3465)\n\nA flaw was found in the HTTP digest authentication implementation in\nrubygem-actionpack. A remote attacker could use this flaw to cause a\ndenial of service of an application using rubygem-actionpack and digest\nauthentication. (CVE-2012-3424)\n\nUsers are advised to upgrade to these updated rubygem-actionpack,\nrubygem-activesupport, and rubygem-activerecord packages, which resolve\nthese issues. Katello must be restarted (\"service katello restart\") for\nthis update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2013:0154",
"url": "https://access.redhat.com/errata/RHSA-2013:0154"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "https://access.redhat.com/knowledge/solutions/290903",
"url": "https://access.redhat.com/knowledge/solutions/290903"
},
{
"category": "external",
"summary": "827353",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=827353"
},
{
"category": "external",
"summary": "827363",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=827363"
},
{
"category": "external",
"summary": "831573",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=831573"
},
{
"category": "external",
"summary": "831581",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=831581"
},
{
"category": "external",
"summary": "843711",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=843711"
},
{
"category": "external",
"summary": "847196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=847196"
},
{
"category": "external",
"summary": "847199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=847199"
},
{
"category": "external",
"summary": "847200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=847200"
},
{
"category": "external",
"summary": "889649",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=889649"
},
{
"category": "external",
"summary": "892866",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=892866"
},
{
"category": "external",
"summary": "892870",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=892870"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0154.json"
}
],
"title": "Red Hat Security Advisory: Ruby on Rails security update",
"tracking": {
"current_release_date": "2024-11-22T06:14:17+00:00",
"generator": {
"date": "2024-11-22T06:14:17+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2013:0154",
"initial_release_date": "2013-01-10T20:39:00+00:00",
"revision_history": [
{
"date": "2013-01-10T20:39:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2013-01-10T20:38:55+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T06:14:17+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Subscription Asset Manager for RHEL 6 Server",
"product": {
"name": "Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager11",
"product_identification_helper": {
"cpe": "cpe:/a:rhel_sam:1.1::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat Subscription Asset Manager"
},
{
"branches": [
{
"category": "product_version",
"name": "rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"product": {
"name": "rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"product_id": "rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-activesupport@3.0.10-5.el6cf?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"product": {
"name": "rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"product_id": "rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-activerecord@3.0.10-8.el6cf?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"product": {
"name": "rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"product_id": "rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-actionpack@3.0.10-11.el6cf?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "rubygem-activesupport-1:3.0.10-5.el6cf.src",
"product": {
"name": "rubygem-activesupport-1:3.0.10-5.el6cf.src",
"product_id": "rubygem-activesupport-1:3.0.10-5.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-activesupport@3.0.10-5.el6cf?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-activerecord-1:3.0.10-8.el6cf.src",
"product": {
"name": "rubygem-activerecord-1:3.0.10-8.el6cf.src",
"product_id": "rubygem-activerecord-1:3.0.10-8.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-activerecord@3.0.10-8.el6cf?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-actionpack-1:3.0.10-11.el6cf.src",
"product": {
"name": "rubygem-actionpack-1:3.0.10-11.el6cf.src",
"product_id": "rubygem-actionpack-1:3.0.10-11.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-actionpack@3.0.10-11.el6cf?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-actionpack-1:3.0.10-11.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch"
},
"product_reference": "rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-actionpack-1:3.0.10-11.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src"
},
"product_reference": "rubygem-actionpack-1:3.0.10-11.el6cf.src",
"relates_to_product_reference": "6Server-SubscriptionAssetManager11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activerecord-1:3.0.10-8.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch"
},
"product_reference": "rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activerecord-1:3.0.10-8.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src"
},
"product_reference": "rubygem-activerecord-1:3.0.10-8.el6cf.src",
"relates_to_product_reference": "6Server-SubscriptionAssetManager11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activesupport-1:3.0.10-5.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch"
},
"product_reference": "rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager11"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activesupport-1:3.0.10-5.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
},
"product_reference": "rubygem-activesupport-1:3.0.10-5.el6cf.src",
"relates_to_product_reference": "6Server-SubscriptionAssetManager11"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2012-2660",
"discovery_date": "2012-05-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "827353"
}
],
"notes": [
{
"category": "description",
"text": "actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain \"[nil]\" values, a related issue to CVE-2012-2694.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionpack: Unsafe query generation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-2660"
},
{
"category": "external",
"summary": "RHBZ#827353",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=827353"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-2660",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2660"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2660",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2660"
}
],
"release_date": "2012-05-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-01-10T20:39:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0154"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rubygem-actionpack: Unsafe query generation"
},
{
"cve": "CVE-2012-2661",
"discovery_date": "2012-05-31T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "827363"
}
],
"notes": [
{
"category": "description",
"text": "The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-activerecord: SQL injection when processing nested query paramaters",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-2661"
},
{
"category": "external",
"summary": "RHBZ#827363",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=827363"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-2661",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2661"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2661",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2661"
}
],
"release_date": "2012-05-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-01-10T20:39:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0154"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rubygem-activerecord: SQL injection when processing nested query paramaters"
},
{
"cve": "CVE-2012-2694",
"cwe": {
"id": "CWE-305",
"name": "Authentication Bypass by Primary Weakness"
},
"discovery_date": "2012-06-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "831581"
}
],
"notes": [
{
"category": "description",
"text": "actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain \"[\u0027xyz\u0027, nil]\" values, a related issue to CVE-2012-2660.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-2694"
},
{
"category": "external",
"summary": "RHBZ#831581",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=831581"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-2694",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2694"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2694",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2694"
}
],
"release_date": "2012-06-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-01-10T20:39:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0154"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "HIGH",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:H/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rubygem-actionpack: Unsafe query generation (a different flaw than CVE-2012-2660)"
},
{
"cve": "CVE-2012-2695",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"discovery_date": "2012-06-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "831573"
}
],
"notes": [
{
"category": "description",
"text": "The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage improper handling of nested hashes, a related issue to CVE-2012-2661.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-activerecord: SQL injection when processing nested query paramaters (a different flaw than CVE-2012-2661)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-2695"
},
{
"category": "external",
"summary": "RHBZ#831573",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=831573"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-2695",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-2695"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-2695",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-2695"
}
],
"release_date": "2012-06-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-01-10T20:39:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0154"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rubygem-activerecord: SQL injection when processing nested query paramaters (a different flaw than CVE-2012-2661)"
},
{
"cve": "CVE-2012-3424",
"discovery_date": "2012-07-26T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "843711"
}
],
"notes": [
{
"category": "description",
"text": "The decode_credentials method in actionpack/lib/action_controller/metal/http_authentication.rb in Ruby on Rails 3.x before 3.0.16, 3.1.x before 3.1.7, and 3.2.x before 3.2.7 converts Digest Authentication strings to symbols, which allows remote attackers to cause a denial of service by leveraging access to an application that uses a with_http_digest helper method, as demonstrated by the authenticate_or_request_with_http_digest method.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-3424"
},
{
"category": "external",
"summary": "RHBZ#843711",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=843711"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-3424",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-3424"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3424",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3424"
}
],
"release_date": "2012-07-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-01-10T20:39:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0154"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "rubygem-actionpack: DoS vulnerability in authenticate_or_request_with_http_digest"
},
{
"cve": "CVE-2012-3463",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2012-08-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "847196"
}
],
"notes": [
{
"category": "description",
"text": "Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/form_tag_helper.rb in Ruby on Rails 3.x before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via the prompt field to the select_tag helper.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionpack: potential XSS vulnerability in select_tag prompt",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-3463"
},
{
"category": "external",
"summary": "RHBZ#847196",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=847196"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-3463",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-3463"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3463",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3463"
}
],
"release_date": "2012-08-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-01-10T20:39:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0154"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionpack: potential XSS vulnerability in select_tag prompt"
},
{
"cve": "CVE-2012-3464",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2012-08-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "847199"
}
],
"notes": [
{
"category": "description",
"text": "Cross-site scripting (XSS) vulnerability in activesupport/lib/active_support/core_ext/string/output_safety.rb in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 might allow remote attackers to inject arbitrary web script or HTML via vectors involving a \u0027 (quote) character.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionpack: potential XSS vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-3464"
},
{
"category": "external",
"summary": "RHBZ#847199",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=847199"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-3464",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-3464"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3464",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3464"
}
],
"release_date": "2012-08-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-01-10T20:39:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0154"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionpack: potential XSS vulnerability"
},
{
"cve": "CVE-2012-3465",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2012-08-09T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "847200"
}
],
"notes": [
{
"category": "description",
"text": "Cross-site scripting (XSS) vulnerability in actionpack/lib/action_view/helpers/sanitize_helper.rb in the strip_tags helper in Ruby on Rails before 3.0.17, 3.1.x before 3.1.8, and 3.2.x before 3.2.8 allows remote attackers to inject arbitrary web script or HTML via malformed HTML markup.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-actionpack: XSS Vulnerability in strip_tags",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-3465"
},
{
"category": "external",
"summary": "RHBZ#847200",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=847200"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-3465",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-3465"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-3465",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-3465"
}
],
"release_date": "2012-08-09T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-01-10T20:39:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0154"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-actionpack: XSS Vulnerability in strip_tags"
},
{
"cve": "CVE-2012-6496",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"discovery_date": "2012-12-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "889649"
}
],
"notes": [
{
"category": "description",
"text": "SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-activerecord: find_by_* SQL Injection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-6496"
},
{
"category": "external",
"summary": "RHBZ#889649",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=889649"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-6496",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6496"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6496",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6496"
},
{
"category": "external",
"summary": "http://phenoelit.org/blog/archives/2012/12/21/let_me_github_that_for_you/index.html",
"url": "http://phenoelit.org/blog/archives/2012/12/21/let_me_github_that_for_you/index.html"
}
],
"release_date": "2012-12-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-01-10T20:39:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0154"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"products": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-activerecord: find_by_* SQL Injection"
},
{
"cve": "CVE-2013-0155",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"discovery_date": "2013-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "892866"
}
],
"notes": [
{
"category": "description",
"text": "Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain \"[nil]\" values, a related issue to CVE-2012-2660 and CVE-2012-2694.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-activerecord: Unsafe Query Generation Risk in Ruby on Rails",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-0155"
},
{
"category": "external",
"summary": "RHBZ#892866",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=892866"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-0155",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0155"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0155",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0155"
}
],
"release_date": "2013-01-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-01-10T20:39:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0154"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rubygem-activerecord: Unsafe Query Generation Risk in Ruby on Rails"
},
{
"cve": "CVE-2013-0156",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2013-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "892870"
}
],
"notes": [
{
"category": "description",
"text": "active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "For details of affected products and workarounds see https://access.redhat.com/knowledge/node/290903",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-0156"
},
{
"category": "external",
"summary": "RHBZ#892870",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=892870"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-0156",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0156"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0156",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0156"
}
],
"release_date": "2013-01-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-01-10T20:39:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0154"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SubscriptionAssetManager11:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack"
}
]
}
rhsa-2013:0155
Vulnerability from csaf_redhat
Published
2013-01-10 22:32
Modified
2024-11-22 06:14
Summary
Red Hat Security Advisory: Ruby on Rails security update
Notes
Topic
Updated rubygem-actionpack, rubygem-activesupport, and rubygem-activerecord
packages that fix multiple security issues are now available for Red Hat
CloudForms.
The Red Hat Security Response Team has rated this update as having critical
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Ruby on Rails is a model–view–controller (MVC) framework for web
application development. Action Pack implements the controller and the view
components. Active Record implements object-relational mapping for
accessing database entries using objects. Active Support provides support
and utility classes used by the Ruby on Rails framework.
Multiple flaws were found in the way Ruby on Rails performed XML parameter
parsing in HTTP requests. A remote attacker could use these flaws to
execute arbitrary code with the privileges of a Ruby on Rails application,
perform SQL injection attacks, or bypass the authentication using a
specially-created HTTP request. (CVE-2013-0156)
Red Hat is aware that a public exploit for the CVE-2013-0156 issues is
available that allows remote code execution in applications using Ruby on
Rails.
A flaw was found in the way Ruby on Rails performed JSON parameter parsing.
If a Ruby on Rails application passed JSON parameters to Active Record, it
could result in the generation of unexpected SQL queries. A remote attacker
could possibly use this flaw to manipulate SQL queries executed by the
application. (CVE-2013-0155)
A flaw was found in the way rubygem-activerecord dynamic finders extracted
options from method parameters. A remote attacker could possibly use this
flaw to perform SQL injection attacks against applications using the Active
Record dynamic finder methods. (CVE-2012-6496)
Users are advised to upgrade to these updated rubygem-actionpack,
rubygem-activesupport, and rubygem-activerecord packages, which resolve
these issues. Users of CloudForms Cloud Engine must run "aeolus-services
restart" and users of CloudForms System Engine must run "katello-service
restart" for this update to take effect.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Critical"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated rubygem-actionpack, rubygem-activesupport, and rubygem-activerecord\npackages that fix multiple security issues are now available for Red Hat\nCloudForms.\n\nThe Red Hat Security Response Team has rated this update as having critical\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby on Rails is a model\u2013view\u2013controller (MVC) framework for web\napplication development. Action Pack implements the controller and the view\ncomponents. Active Record implements object-relational mapping for\naccessing database entries using objects. Active Support provides support\nand utility classes used by the Ruby on Rails framework.\n\nMultiple flaws were found in the way Ruby on Rails performed XML parameter\nparsing in HTTP requests. A remote attacker could use these flaws to\nexecute arbitrary code with the privileges of a Ruby on Rails application,\nperform SQL injection attacks, or bypass the authentication using a\nspecially-created HTTP request. (CVE-2013-0156)\n\nRed Hat is aware that a public exploit for the CVE-2013-0156 issues is\navailable that allows remote code execution in applications using Ruby on\nRails.\n\nA flaw was found in the way Ruby on Rails performed JSON parameter parsing.\nIf a Ruby on Rails application passed JSON parameters to Active Record, it\ncould result in the generation of unexpected SQL queries. A remote attacker\ncould possibly use this flaw to manipulate SQL queries executed by the\napplication. (CVE-2013-0155)\n\nA flaw was found in the way rubygem-activerecord dynamic finders extracted\noptions from method parameters. A remote attacker could possibly use this\nflaw to perform SQL injection attacks against applications using the Active\nRecord dynamic finder methods. (CVE-2012-6496)\n\nUsers are advised to upgrade to these updated rubygem-actionpack,\nrubygem-activesupport, and rubygem-activerecord packages, which resolve\nthese issues. Users of CloudForms Cloud Engine must run \"aeolus-services\nrestart\" and users of CloudForms System Engine must run \"katello-service\nrestart\" for this update to take effect.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2013:0155",
"url": "https://access.redhat.com/errata/RHSA-2013:0155"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#critical",
"url": "https://access.redhat.com/security/updates/classification/#critical"
},
{
"category": "external",
"summary": "https://access.redhat.com/knowledge/solutions/290903",
"url": "https://access.redhat.com/knowledge/solutions/290903"
},
{
"category": "external",
"summary": "889649",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=889649"
},
{
"category": "external",
"summary": "892866",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=892866"
},
{
"category": "external",
"summary": "892870",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=892870"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0155.json"
}
],
"title": "Red Hat Security Advisory: Ruby on Rails security update",
"tracking": {
"current_release_date": "2024-11-22T06:14:23+00:00",
"generator": {
"date": "2024-11-22T06:14:23+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2013:0155",
"initial_release_date": "2013-01-10T22:32:00+00:00",
"revision_history": [
{
"date": "2013-01-10T22:32:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2013-01-10T22:40:25+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T06:14:23+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "CloudForms Cloud Engine for RHEL 6 Server",
"product": {
"name": "CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine",
"product_identification_helper": {
"cpe": "cpe:/a:cloudforms_cloudengine:1::el6"
}
}
},
{
"category": "product_name",
"name": "CloudForms System Engine for RHEL 6 Server",
"product": {
"name": "CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine",
"product_identification_helper": {
"cpe": "cpe:/a:cloudforms_systemengine:1::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat CloudForms"
},
{
"branches": [
{
"category": "product_version",
"name": "rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"product": {
"name": "rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"product_id": "rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-activesupport@3.0.10-5.el6cf?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"product": {
"name": "rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"product_id": "rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-activerecord@3.0.10-8.el6cf?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"product": {
"name": "rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"product_id": "rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-actionpack@3.0.10-11.el6cf?arch=noarch\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "rubygem-activesupport-1:3.0.10-5.el6cf.src",
"product": {
"name": "rubygem-activesupport-1:3.0.10-5.el6cf.src",
"product_id": "rubygem-activesupport-1:3.0.10-5.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-activesupport@3.0.10-5.el6cf?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-activerecord-1:3.0.10-8.el6cf.src",
"product": {
"name": "rubygem-activerecord-1:3.0.10-8.el6cf.src",
"product_id": "rubygem-activerecord-1:3.0.10-8.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-activerecord@3.0.10-8.el6cf?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-actionpack-1:3.0.10-11.el6cf.src",
"product": {
"name": "rubygem-actionpack-1:3.0.10-11.el6cf.src",
"product_id": "rubygem-actionpack-1:3.0.10-11.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-actionpack@3.0.10-11.el6cf?arch=src\u0026epoch=1"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-actionpack-1:3.0.10-11.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-11.el6cf.noarch"
},
"product_reference": "rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-actionpack-1:3.0.10-11.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-actionpack-1:3.0.10-11.el6cf.src"
},
"product_reference": "rubygem-actionpack-1:3.0.10-11.el6cf.src",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activerecord-1:3.0.10-8.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-8.el6cf.noarch"
},
"product_reference": "rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activerecord-1:3.0.10-8.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-activerecord-1:3.0.10-8.el6cf.src"
},
"product_reference": "rubygem-activerecord-1:3.0.10-8.el6cf.src",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activesupport-1:3.0.10-5.el6cf.noarch as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-5.el6cf.noarch"
},
"product_reference": "rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activesupport-1:3.0.10-5.el6cf.src as a component of CloudForms Cloud Engine for RHEL 6 Server",
"product_id": "6Server-CloudEngine:rubygem-activesupport-1:3.0.10-5.el6cf.src"
},
"product_reference": "rubygem-activesupport-1:3.0.10-5.el6cf.src",
"relates_to_product_reference": "6Server-CloudEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-actionpack-1:3.0.10-11.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-11.el6cf.noarch"
},
"product_reference": "rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-actionpack-1:3.0.10-11.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-actionpack-1:3.0.10-11.el6cf.src"
},
"product_reference": "rubygem-actionpack-1:3.0.10-11.el6cf.src",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activerecord-1:3.0.10-8.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-8.el6cf.noarch"
},
"product_reference": "rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activerecord-1:3.0.10-8.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-activerecord-1:3.0.10-8.el6cf.src"
},
"product_reference": "rubygem-activerecord-1:3.0.10-8.el6cf.src",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activesupport-1:3.0.10-5.el6cf.noarch as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-5.el6cf.noarch"
},
"product_reference": "rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"relates_to_product_reference": "6Server-SystemEngine"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activesupport-1:3.0.10-5.el6cf.src as a component of CloudForms System Engine for RHEL 6 Server",
"product_id": "6Server-SystemEngine:rubygem-activesupport-1:3.0.10-5.el6cf.src"
},
"product_reference": "rubygem-activesupport-1:3.0.10-5.el6cf.src",
"relates_to_product_reference": "6Server-SystemEngine"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2012-6496",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"discovery_date": "2012-12-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "889649"
}
],
"notes": [
{
"category": "description",
"text": "SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-activerecord: find_by_* SQL Injection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-5.el6cf.src",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-6496"
},
{
"category": "external",
"summary": "RHBZ#889649",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=889649"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-6496",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6496"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6496",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6496"
},
{
"category": "external",
"summary": "http://phenoelit.org/blog/archives/2012/12/21/let_me_github_that_for_you/index.html",
"url": "http://phenoelit.org/blog/archives/2012/12/21/let_me_github_that_for_you/index.html"
}
],
"release_date": "2012-12-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-01-10T22:32:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-5.el6cf.src",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-5.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0155"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"products": [
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-5.el6cf.src",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-activerecord: find_by_* SQL Injection"
},
{
"cve": "CVE-2013-0155",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"discovery_date": "2013-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "892866"
}
],
"notes": [
{
"category": "description",
"text": "Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain \"[nil]\" values, a related issue to CVE-2012-2660 and CVE-2012-2694.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-activerecord: Unsafe Query Generation Risk in Ruby on Rails",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-5.el6cf.src",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-0155"
},
{
"category": "external",
"summary": "RHBZ#892866",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=892866"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-0155",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0155"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0155",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0155"
}
],
"release_date": "2013-01-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-01-10T22:32:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-5.el6cf.src",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-5.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0155"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 6.4,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-5.el6cf.src",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "rubygem-activerecord: Unsafe Query Generation Risk in Ruby on Rails"
},
{
"cve": "CVE-2013-0156",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2013-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "892870"
}
],
"notes": [
{
"category": "description",
"text": "active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "For details of affected products and workarounds see https://access.redhat.com/knowledge/node/290903",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-5.el6cf.src",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-0156"
},
{
"category": "external",
"summary": "RHBZ#892870",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=892870"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-0156",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0156"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0156",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0156"
}
],
"release_date": "2013-01-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-01-10T22:32:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-5.el6cf.src",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-5.el6cf.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0155"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-CloudEngine:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-CloudEngine:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-CloudEngine:rubygem-activesupport-1:3.0.10-5.el6cf.src",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-11.el6cf.noarch",
"6Server-SystemEngine:rubygem-actionpack-1:3.0.10-11.el6cf.src",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-8.el6cf.noarch",
"6Server-SystemEngine:rubygem-activerecord-1:3.0.10-8.el6cf.src",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-5.el6cf.noarch",
"6Server-SystemEngine:rubygem-activesupport-1:3.0.10-5.el6cf.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Critical"
}
],
"title": "rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack"
}
]
}
rhsa-2013:0220
Vulnerability from csaf_redhat
Published
2013-01-31 19:41
Modified
2025-03-19 13:44
Summary
Red Hat Security Advisory: Red Hat OpenShift Enterprise 1.1 update
Notes
Topic
Red Hat OpenShift Enterprise 1.1 is now available.
The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
Details
Red Hat OpenShift Enterprise is a cloud computing Platform-as-a-Service
(PaaS) solution designed for on-premise or private cloud deployments.
Refer to the Red Hat OpenShift Enterprise 1.1 Release Notes for information
about the changes in this release. The Release Notes will be available
shortly from https://access.redhat.com/knowledge/docs/
This update also fixes the following security issues:
It was found that the master cryptographic key of Jenkins could be
retrieved via the HTTP server that is hosting Jenkins. A remote attacker
could use this flaw to access the server and execute arbitrary code with
the privileges of the user running Jenkins. Note that this issue only
affected Jenkins instances that had slaves attached and that also allowed
anonymous read access (not the default configuration). Manual action is
also required to correct this issue. Refer to "Jenkins Security Advisory
2013-01-04", linked to in the References, for further information.
(CVE-2013-0158)
When the rhc-chk script was run in debug mode, its output included
sensitive information, such as database passwords, in plain text. As this
script is commonly used when troubleshooting, this flaw could lead to users
unintentionally exposing sensitive information in support channels (for
example, a Bugzilla report). This update removes the rhc-chk script.
(CVE-2012-5658)
Multiple flaws in the Jenkins web interface could allow a remote attacker
to perform HTTP response splitting and cross-site scripting (XSS) attacks,
as well as redirecting a victim to an arbitrary page by utilizing an open
redirect flaw. (CVE-2012-6072, CVE-2012-6074, CVE-2012-6073)
A flaw was found in the way rubygem-activerecord dynamic finders extracted
options from method parameters. A remote attacker could possibly use this
flaw to perform SQL injection attacks against applications using the Active
Record dynamic finder methods. (CVE-2012-6496)
The openshift-port-proxy-cfg program created a temporary file in an
insecure way. A local attacker could use this flaw to perform a symbolic
link attack, overwriting an arbitrary file accessible to the root user with
a "0" or a "1", which could lead to a denial of service. By default,
OpenShift uses polyinstantiation (per user) for the /tmp/ directory,
minimizing the risk of exploitation by local attackers. (CVE-2013-0164)
The CVE-2013-0164 issue was discovered by Michael Scherer of the Red Hat
Regional IT team.
Users of Red Hat OpenShift Enterprise 1.0 are advised to upgrade to Red Hat
OpenShift Enterprise 1.1.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat OpenShift Enterprise 1.1 is now available.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat OpenShift Enterprise is a cloud computing Platform-as-a-Service\n(PaaS) solution designed for on-premise or private cloud deployments.\n\nRefer to the Red Hat OpenShift Enterprise 1.1 Release Notes for information\nabout the changes in this release. The Release Notes will be available\nshortly from https://access.redhat.com/knowledge/docs/\n\nThis update also fixes the following security issues:\n\nIt was found that the master cryptographic key of Jenkins could be\nretrieved via the HTTP server that is hosting Jenkins. A remote attacker\ncould use this flaw to access the server and execute arbitrary code with\nthe privileges of the user running Jenkins. Note that this issue only\naffected Jenkins instances that had slaves attached and that also allowed\nanonymous read access (not the default configuration). Manual action is\nalso required to correct this issue. Refer to \"Jenkins Security Advisory\n2013-01-04\", linked to in the References, for further information.\n(CVE-2013-0158)\n\nWhen the rhc-chk script was run in debug mode, its output included\nsensitive information, such as database passwords, in plain text. As this\nscript is commonly used when troubleshooting, this flaw could lead to users\nunintentionally exposing sensitive information in support channels (for\nexample, a Bugzilla report). This update removes the rhc-chk script.\n(CVE-2012-5658)\n\nMultiple flaws in the Jenkins web interface could allow a remote attacker\nto perform HTTP response splitting and cross-site scripting (XSS) attacks,\nas well as redirecting a victim to an arbitrary page by utilizing an open\nredirect flaw. (CVE-2012-6072, CVE-2012-6074, CVE-2012-6073)\n\nA flaw was found in the way rubygem-activerecord dynamic finders extracted\noptions from method parameters. A remote attacker could possibly use this\nflaw to perform SQL injection attacks against applications using the Active\nRecord dynamic finder methods. (CVE-2012-6496)\n\nThe openshift-port-proxy-cfg program created a temporary file in an\ninsecure way. A local attacker could use this flaw to perform a symbolic\nlink attack, overwriting an arbitrary file accessible to the root user with\na \"0\" or a \"1\", which could lead to a denial of service. By default,\nOpenShift uses polyinstantiation (per user) for the /tmp/ directory,\nminimizing the risk of exploitation by local attackers. (CVE-2013-0164)\n\nThe CVE-2013-0164 issue was discovered by Michael Scherer of the Red Hat\nRegional IT team.\n\nUsers of Red Hat OpenShift Enterprise 1.0 are advised to upgrade to Red Hat\nOpenShift Enterprise 1.1.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2013:0220",
"url": "https://access.redhat.com/errata/RHSA-2013:0220"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04",
"url": "https://wiki.jenkins-ci.org/display/SECURITY/Jenkins+Security+Advisory+2013-01-04"
},
{
"category": "external",
"summary": "https://access.redhat.com/knowledge/docs/",
"url": "https://access.redhat.com/knowledge/docs/"
},
{
"category": "external",
"summary": "855264",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=855264"
},
{
"category": "external",
"summary": "864921",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=864921"
},
{
"category": "external",
"summary": "872415",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=872415"
},
{
"category": "external",
"summary": "873765",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=873765"
},
{
"category": "external",
"summary": "873768",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=873768"
},
{
"category": "external",
"summary": "874511",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=874511"
},
{
"category": "external",
"summary": "874750",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=874750"
},
{
"category": "external",
"summary": "874751",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=874751"
},
{
"category": "external",
"summary": "874757",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=874757"
},
{
"category": "external",
"summary": "874799",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=874799"
},
{
"category": "external",
"summary": "874845",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=874845"
},
{
"category": "external",
"summary": "875657",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=875657"
},
{
"category": "external",
"summary": "876324",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=876324"
},
{
"category": "external",
"summary": "876465",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=876465"
},
{
"category": "external",
"summary": "876644",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=876644"
},
{
"category": "external",
"summary": "876937",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=876937"
},
{
"category": "external",
"summary": "876939",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=876939"
},
{
"category": "external",
"summary": "877158",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=877158"
},
{
"category": "external",
"summary": "877407",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=877407"
},
{
"category": "external",
"summary": "883527",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=883527"
},
{
"category": "external",
"summary": "885587",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=885587"
},
{
"category": "external",
"summary": "885598",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=885598"
},
{
"category": "external",
"summary": "886159",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=886159"
},
{
"category": "external",
"summary": "888043",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=888043"
},
{
"category": "external",
"summary": "888056",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=888056"
},
{
"category": "external",
"summary": "888671",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=888671"
},
{
"category": "external",
"summary": "889062",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=889062"
},
{
"category": "external",
"summary": "889088",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=889088"
},
{
"category": "external",
"summary": "889095",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=889095"
},
{
"category": "external",
"summary": "889125",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=889125"
},
{
"category": "external",
"summary": "889649",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=889649"
},
{
"category": "external",
"summary": "890607",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=890607"
},
{
"category": "external",
"summary": "890608",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=890608"
},
{
"category": "external",
"summary": "890612",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=890612"
},
{
"category": "external",
"summary": "892781",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=892781"
},
{
"category": "external",
"summary": "892795",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=892795"
},
{
"category": "external",
"summary": "892990",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=892990"
},
{
"category": "external",
"summary": "893288",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=893288"
},
{
"category": "external",
"summary": "893307",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=893307"
},
{
"category": "external",
"summary": "893895",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=893895"
},
{
"category": "external",
"summary": "896406",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=896406"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0220.json"
}
],
"title": "Red Hat Security Advisory: Red Hat OpenShift Enterprise 1.1 update",
"tracking": {
"current_release_date": "2025-03-19T13:44:16+00:00",
"generator": {
"date": "2025-03-19T13:44:16+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.4.1"
}
},
"id": "RHSA-2013:0220",
"initial_release_date": "2013-01-31T19:41:00+00:00",
"revision_history": [
{
"date": "2013-01-31T19:41:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2013-01-31T20:23:24+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-03-19T13:44:16+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Enterprise Node",
"product": {
"name": "Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:1::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat OpenShift Enterprise Infrastructure",
"product": {
"name": "Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:1::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat OpenShift Enterprise Client Tools",
"product": {
"name": "Red Hat OpenShift Enterprise Client Tools",
"product_id": "6Server-RHOSE-CLIENT",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:1::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"product": {
"name": "openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"product_id": "openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-origin-cartridge-ruby-1.8@1.0.5-1.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"product": {
"name": "openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"product_id": "openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-origin-cartridge-ruby-1.9-scl@1.0.5-1.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"product": {
"name": "rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"product_id": "rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-openshift-origin-common@1.0.2-1.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"product": {
"name": "rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"product_id": "rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-openshift-origin-dns-bind@1.0.2-1.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"product": {
"name": "rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"product_id": "rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-openshift-origin-msg-broker-mcollective@1.0.4-1.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rhc-0:1.3.2-1.3.el6op.noarch",
"product": {
"name": "rhc-0:1.3.2-1.3.el6op.noarch",
"product_id": "rhc-0:1.3.2-1.3.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhc@1.3.2-1.3.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"product": {
"name": "openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"product_id": "openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-origin-broker-util@1.0.14-1.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"product": {
"name": "rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"product_id": "rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-openshift-origin-controller@1.0.11-1.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "jenkins-0:1.498-1.1.el6op.noarch",
"product": {
"name": "jenkins-0:1.498-1.1.el6op.noarch",
"product_id": "jenkins-0:1.498-1.1.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jenkins@1.498-1.1.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"product": {
"name": "openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"product_id": "openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-origin-port-proxy@1.0.3-1.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"product": {
"name": "openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"product_id": "openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-origin-cartridge-haproxy-1.4@1.0.3-1.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"product": {
"name": "openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"product_id": "openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-origin-broker@1.0.10-1.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"product": {
"name": "openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"product_id": "openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-origin-node-util@1.0.7-1.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"product": {
"name": "openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"product_id": "openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-origin-msg-node-mcollective@1.0.2-1.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"product": {
"name": "rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"product_id": "rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-openshift-origin-auth-remote-user@1.0.4-2.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"product": {
"name": "rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"product_id": "rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-openshift-origin-console@1.0.6-1.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"product": {
"name": "rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"product_id": "rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-openshift-origin-console-doc@1.0.6-1.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "openshift-console-0:0.0.13-2.el6op.noarch",
"product": {
"name": "openshift-console-0:0.0.13-2.el6op.noarch",
"product_id": "openshift-console-0:0.0.13-2.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-console@0.0.13-2.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"product": {
"name": "rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"product_id": "rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-activerecord@3.0.13-3.el6op?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"product": {
"name": "ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"product_id": "ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-activerecord-doc@3.2.8-2.el6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"product": {
"name": "ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"product_id": "ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-activerecord@3.2.8-2.el6?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"product": {
"name": "rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"product_id": "rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-openshift-origin-node@1.0.10-6.el6op?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"product": {
"name": "openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"product_id": "openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-origin-cartridge-ruby-1.8@1.0.5-1.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"product": {
"name": "openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"product_id": "openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-origin-cartridge-ruby-1.9-scl@1.0.5-1.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"product": {
"name": "rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"product_id": "rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-openshift-origin-common@1.0.2-1.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"product": {
"name": "rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"product_id": "rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-openshift-origin-dns-bind@1.0.2-1.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"product": {
"name": "rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"product_id": "rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-openshift-origin-msg-broker-mcollective@1.0.4-1.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "rhc-0:1.3.2-1.3.el6op.src",
"product": {
"name": "rhc-0:1.3.2-1.3.el6op.src",
"product_id": "rhc-0:1.3.2-1.3.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rhc@1.3.2-1.3.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"product": {
"name": "openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"product_id": "openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-origin-broker-util@1.0.14-1.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"product": {
"name": "rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"product_id": "rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-openshift-origin-controller@1.0.11-1.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "jenkins-0:1.498-1.1.el6op.src",
"product": {
"name": "jenkins-0:1.498-1.1.el6op.src",
"product_id": "jenkins-0:1.498-1.1.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/jenkins@1.498-1.1.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"product": {
"name": "openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"product_id": "openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-origin-port-proxy@1.0.3-1.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"product": {
"name": "openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"product_id": "openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-origin-cartridge-haproxy-1.4@1.0.3-1.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "openshift-origin-broker-0:1.0.10-1.el6op.src",
"product": {
"name": "openshift-origin-broker-0:1.0.10-1.el6op.src",
"product_id": "openshift-origin-broker-0:1.0.10-1.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-origin-broker@1.0.10-1.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "openshift-origin-node-util-0:1.0.7-1.el6op.src",
"product": {
"name": "openshift-origin-node-util-0:1.0.7-1.el6op.src",
"product_id": "openshift-origin-node-util-0:1.0.7-1.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-origin-node-util@1.0.7-1.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "mongodb-0:2.0.2-6.el6op.src",
"product": {
"name": "mongodb-0:2.0.2-6.el6op.src",
"product_id": "mongodb-0:2.0.2-6.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mongodb@2.0.2-6.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"product": {
"name": "ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"product_id": "ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-passenger@3.0.12-21.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"product": {
"name": "openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"product_id": "openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-origin-msg-node-mcollective@1.0.2-1.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"product": {
"name": "rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"product_id": "rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-openshift-origin-auth-remote-user@1.0.4-2.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"product": {
"name": "rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"product_id": "rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-openshift-origin-console@1.0.6-1.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "openshift-console-0:0.0.13-2.el6op.src",
"product": {
"name": "openshift-console-0:0.0.13-2.el6op.src",
"product_id": "openshift-console-0:0.0.13-2.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/openshift-console@0.0.13-2.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-activerecord-1:3.0.13-3.el6op.src",
"product": {
"name": "rubygem-activerecord-1:3.0.13-3.el6op.src",
"product_id": "rubygem-activerecord-1:3.0.13-3.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-activerecord@3.0.13-3.el6op?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"product": {
"name": "ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"product_id": "ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-activerecord@3.2.8-2.el6?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-openshift-origin-node-0:1.0.10-6.el6op.src",
"product": {
"name": "rubygem-openshift-origin-node-0:1.0.10-6.el6op.src",
"product_id": "rubygem-openshift-origin-node-0:1.0.10-6.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-openshift-origin-node@1.0.10-6.el6op?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "libmongodb-0:2.0.2-6.el6op.x86_64",
"product": {
"name": "libmongodb-0:2.0.2-6.el6op.x86_64",
"product_id": "libmongodb-0:2.0.2-6.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/libmongodb@2.0.2-6.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mongodb-server-0:2.0.2-6.el6op.x86_64",
"product": {
"name": "mongodb-server-0:2.0.2-6.el6op.x86_64",
"product_id": "mongodb-server-0:2.0.2-6.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mongodb-server@2.0.2-6.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mongodb-0:2.0.2-6.el6op.x86_64",
"product": {
"name": "mongodb-0:2.0.2-6.el6op.x86_64",
"product_id": "mongodb-0:2.0.2-6.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mongodb@2.0.2-6.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"product": {
"name": "mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"product_id": "mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mongodb-debuginfo@2.0.2-6.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "mongodb-devel-0:2.0.2-6.el6op.x86_64",
"product": {
"name": "mongodb-devel-0:2.0.2-6.el6op.x86_64",
"product_id": "mongodb-devel-0:2.0.2-6.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/mongodb-devel@2.0.2-6.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"product": {
"name": "ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"product_id": "ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-passenger-doc@3.0.12-21.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"product": {
"name": "ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"product_id": "ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-passenger-native@3.0.12-21.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"product": {
"name": "ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"product_id": "ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-passenger-debuginfo@3.0.12-21.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"product": {
"name": "ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"product_id": "ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-passenger@3.0.12-21.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"product": {
"name": "ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"product_id": "ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-passenger-devel@3.0.12-21.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"product": {
"name": "ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"product_id": "ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-mod_passenger@3.0.12-21.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"product": {
"name": "ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"product_id": "ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-passenger-native-libs@3.0.12-21.el6op?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "rhc-0:1.3.2-1.3.el6op.noarch as a component of Red Hat OpenShift Enterprise Client Tools",
"product_id": "6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.noarch"
},
"product_reference": "rhc-0:1.3.2-1.3.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-CLIENT"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rhc-0:1.3.2-1.3.el6op.src as a component of Red Hat OpenShift Enterprise Client Tools",
"product_id": "6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.src"
},
"product_reference": "rhc-0:1.3.2-1.3.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-CLIENT"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "libmongodb-0:2.0.2-6.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:libmongodb-0:2.0.2-6.el6op.x86_64"
},
"product_reference": "libmongodb-0:2.0.2-6.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mongodb-0:2.0.2-6.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.src"
},
"product_reference": "mongodb-0:2.0.2-6.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mongodb-0:2.0.2-6.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.x86_64"
},
"product_reference": "mongodb-0:2.0.2-6.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mongodb-debuginfo-0:2.0.2-6.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:mongodb-debuginfo-0:2.0.2-6.el6op.x86_64"
},
"product_reference": "mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mongodb-devel-0:2.0.2-6.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:mongodb-devel-0:2.0.2-6.el6op.x86_64"
},
"product_reference": "mongodb-devel-0:2.0.2-6.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "mongodb-server-0:2.0.2-6.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:mongodb-server-0:2.0.2-6.el6op.x86_64"
},
"product_reference": "mongodb-server-0:2.0.2-6.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-console-0:0.0.13-2.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.noarch"
},
"product_reference": "openshift-console-0:0.0.13-2.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-console-0:0.0.13-2.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.src"
},
"product_reference": "openshift-console-0:0.0.13-2.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-origin-broker-0:1.0.10-1.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.noarch"
},
"product_reference": "openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-origin-broker-0:1.0.10-1.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.src"
},
"product_reference": "openshift-origin-broker-0:1.0.10-1.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-origin-broker-util-0:1.0.14-1.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.noarch"
},
"product_reference": "openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-origin-broker-util-0:1.0.14-1.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.src"
},
"product_reference": "openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64"
},
"product_reference": "ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch"
},
"product_reference": "ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-activerecord-1:3.2.8-2.el6.src as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src"
},
"product_reference": "ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch"
},
"product_reference": "ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-0:3.0.12-21.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src"
},
"product_reference": "ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activerecord-1:3.0.13-3.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.noarch"
},
"product_reference": "rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activerecord-1:3.0.13-3.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.src"
},
"product_reference": "rubygem-activerecord-1:3.0.13-3.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch"
},
"product_reference": "rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src"
},
"product_reference": "rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch"
},
"product_reference": "rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-openshift-origin-common-0:1.0.2-1.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src"
},
"product_reference": "rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch"
},
"product_reference": "rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-openshift-origin-console-0:1.0.6-1.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.src"
},
"product_reference": "rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch"
},
"product_reference": "rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch"
},
"product_reference": "rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src"
},
"product_reference": "rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch"
},
"product_reference": "rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src"
},
"product_reference": "rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch"
},
"product_reference": "rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src"
},
"product_reference": "rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jenkins-0:1.498-1.1.el6op.noarch as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.noarch"
},
"product_reference": "jenkins-0:1.498-1.1.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "jenkins-0:1.498-1.1.el6op.src as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.src"
},
"product_reference": "jenkins-0:1.498-1.1.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch"
},
"product_reference": "openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src"
},
"product_reference": "openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch"
},
"product_reference": "openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src"
},
"product_reference": "openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch"
},
"product_reference": "openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src"
},
"product_reference": "openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch"
},
"product_reference": "openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src"
},
"product_reference": "openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-origin-node-util-0:1.0.7-1.el6op.noarch as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.noarch"
},
"product_reference": "openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-origin-node-util-0:1.0.7-1.el6op.src as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.src"
},
"product_reference": "openshift-origin-node-util-0:1.0.7-1.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch"
},
"product_reference": "openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "openshift-origin-port-proxy-0:1.0.3-1.el6op.src as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.src"
},
"product_reference": "openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64"
},
"product_reference": "ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch"
},
"product_reference": "ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-activerecord-1:3.2.8-2.el6.src as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src"
},
"product_reference": "ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch"
},
"product_reference": "ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-0:3.0.12-21.el6op.src as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src"
},
"product_reference": "ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64"
},
"product_reference": "ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch"
},
"product_reference": "rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-openshift-origin-common-0:1.0.2-1.el6op.src as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src"
},
"product_reference": "rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch"
},
"product_reference": "rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-openshift-origin-node-0:1.0.10-6.el6op.src as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.src"
},
"product_reference": "rubygem-openshift-origin-node-0:1.0.10-6.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-NODE"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2012-5658",
"discovery_date": "2012-12-17T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "889062"
}
],
"notes": [
{
"category": "description",
"text": "rhc-chk.rb in Red Hat OpenShift Origin before 1.1, when -d (debug mode) is used, outputs the password and other sensitive information in cleartext, which allows context-dependent attackers to obtain sensitive information, as demonstrated by including log files or Bugzilla reports in support channels.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Origin: rhc-chk.rb password exposure in log files",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.noarch",
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.src",
"6Server-RHOSE-INFRA:libmongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.src",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-devel-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-server-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"6Server-RHOSE-INFRA:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.noarch",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-5658"
},
{
"category": "external",
"summary": "RHBZ#889062",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=889062"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-5658",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-5658"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-5658",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5658"
}
],
"release_date": "2012-12-17T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-01-31T19:41:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.noarch",
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.src",
"6Server-RHOSE-INFRA:libmongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.src",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-devel-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-server-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"6Server-RHOSE-INFRA:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.noarch",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0220"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 2.1,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.noarch",
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.src",
"6Server-RHOSE-INFRA:libmongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.src",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-devel-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-server-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"6Server-RHOSE-INFRA:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.noarch",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Origin: rhc-chk.rb password exposure in log files"
},
{
"cve": "CVE-2012-6072",
"discovery_date": "2012-11-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "890607"
}
],
"notes": [
{
"category": "description",
"text": "CRLF injection vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via unspecified vectors.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Jenkins: HTTP response splitting",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.noarch",
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.src",
"6Server-RHOSE-INFRA:libmongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.src",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-devel-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-server-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"6Server-RHOSE-INFRA:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.noarch",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-6072"
},
{
"category": "external",
"summary": "RHBZ#890607",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=890607"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-6072",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6072"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6072",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6072"
}
],
"release_date": "2012-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-01-31T19:41:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.noarch",
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.src",
"6Server-RHOSE-INFRA:libmongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.src",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-devel-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-server-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"6Server-RHOSE-INFRA:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.noarch",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0220"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.noarch",
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.src",
"6Server-RHOSE-INFRA:libmongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.src",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-devel-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-server-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"6Server-RHOSE-INFRA:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.noarch",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Jenkins: HTTP response splitting"
},
{
"cve": "CVE-2012-6073",
"discovery_date": "2012-11-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "890608"
}
],
"notes": [
{
"category": "description",
"text": "Open redirect vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Jenkins: open redirect",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.noarch",
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.src",
"6Server-RHOSE-INFRA:libmongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.src",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-devel-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-server-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"6Server-RHOSE-INFRA:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.noarch",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-6073"
},
{
"category": "external",
"summary": "RHBZ#890608",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=890608"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-6073",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6073"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6073",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6073"
}
],
"release_date": "2012-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-01-31T19:41:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.noarch",
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.src",
"6Server-RHOSE-INFRA:libmongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.src",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-devel-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-server-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"6Server-RHOSE-INFRA:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.noarch",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0220"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.noarch",
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.src",
"6Server-RHOSE-INFRA:libmongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.src",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-devel-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-server-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"6Server-RHOSE-INFRA:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.noarch",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Jenkins: open redirect"
},
{
"cve": "CVE-2012-6074",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2012-11-20T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "890612"
}
],
"notes": [
{
"category": "description",
"text": "Cross-site scripting (XSS) vulnerability in Jenkins before 1.491, Jenkins LTS before 1.480.1, and Jenkins Enterprise 1.424.x before 1.424.6.13, 1.447.x before 1.447.4.1, and 1.466.x before 1.466.10.1 allows remote authenticated users with write access to inject arbitrary web script or HTML via unspecified vectors.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Jenkins: cross-site scripting vulnerability",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.noarch",
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.src",
"6Server-RHOSE-INFRA:libmongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.src",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-devel-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-server-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"6Server-RHOSE-INFRA:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.noarch",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-6074"
},
{
"category": "external",
"summary": "RHBZ#890612",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=890612"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-6074",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6074"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6074",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6074"
}
],
"release_date": "2012-11-20T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-01-31T19:41:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.noarch",
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.src",
"6Server-RHOSE-INFRA:libmongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.src",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-devel-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-server-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"6Server-RHOSE-INFRA:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.noarch",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0220"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.noarch",
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.src",
"6Server-RHOSE-INFRA:libmongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.src",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-devel-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-server-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"6Server-RHOSE-INFRA:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.noarch",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Jenkins: cross-site scripting vulnerability"
},
{
"cve": "CVE-2012-6496",
"cwe": {
"id": "CWE-89",
"name": "Improper Neutralization of Special Elements used in an SQL Command (\u0027SQL Injection\u0027)"
},
"discovery_date": "2012-12-21T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "889649"
}
],
"notes": [
{
"category": "description",
"text": "SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-activerecord: find_by_* SQL Injection",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.noarch",
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.src",
"6Server-RHOSE-INFRA:libmongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.src",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-devel-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-server-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"6Server-RHOSE-INFRA:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.noarch",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-6496"
},
{
"category": "external",
"summary": "RHBZ#889649",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=889649"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-6496",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6496"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6496",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6496"
},
{
"category": "external",
"summary": "http://phenoelit.org/blog/archives/2012/12/21/let_me_github_that_for_you/index.html",
"url": "http://phenoelit.org/blog/archives/2012/12/21/let_me_github_that_for_you/index.html"
}
],
"release_date": "2012-12-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-01-31T19:41:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.noarch",
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.src",
"6Server-RHOSE-INFRA:libmongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.src",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-devel-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-server-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"6Server-RHOSE-INFRA:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.noarch",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0220"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.4,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:P",
"version": "2.0"
},
"products": [
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.noarch",
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.src",
"6Server-RHOSE-INFRA:libmongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.src",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-devel-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-server-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"6Server-RHOSE-INFRA:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.noarch",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-activerecord: find_by_* SQL Injection"
},
{
"cve": "CVE-2013-0158",
"discovery_date": "2013-01-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "892795"
}
],
"notes": [
{
"category": "description",
"text": "Unspecified vulnerability in Jenkins before 1.498, Jenkins LTS before 1.480.2, and Jenkins Enterprise 1.447.x before 1.447.6.1 and 1.466.x before 1.466.12.1, when a slave is attached and anonymous read access is enabled, allows remote attackers to obtain the master cryptographic key via unknown vectors.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jenkins: remote unauthenticated retrieval of master cryptographic key (Jenkins Security Advisory 2013-01-04)",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.noarch",
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.src",
"6Server-RHOSE-INFRA:libmongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.src",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-devel-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-server-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"6Server-RHOSE-INFRA:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.noarch",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-0158"
},
{
"category": "external",
"summary": "RHBZ#892795",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=892795"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-0158",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0158"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0158",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0158"
}
],
"release_date": "2013-01-04T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-01-31T19:41:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.noarch",
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.src",
"6Server-RHOSE-INFRA:libmongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.src",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-devel-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-server-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"6Server-RHOSE-INFRA:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.noarch",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0220"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 6.8,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.noarch",
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.src",
"6Server-RHOSE-INFRA:libmongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.src",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-devel-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-server-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"6Server-RHOSE-INFRA:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.noarch",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "jenkins: remote unauthenticated retrieval of master cryptographic key (Jenkins Security Advisory 2013-01-04)"
},
{
"acknowledgments": [
{
"names": [
"Michael Scherer"
],
"organization": "Red Hat Regional IT team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2013-0164",
"cwe": {
"id": "CWE-377",
"name": "Insecure Temporary File"
},
"discovery_date": "2013-01-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "893307"
}
],
"notes": [
{
"category": "description",
"text": "The lockwrap function in port-proxy/bin/openshift-port-proxy-cfg in Red Hat OpenShift Origin before 1.1 allows local users to overwrite arbitrary files via a symlink attack on a temporary file with a predictable name in /tmp.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openshift-origin-port-proxy: openshift-port-proxy-cfg lockwrap() tmp file creation",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.noarch",
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.src",
"6Server-RHOSE-INFRA:libmongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.src",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-devel-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-server-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"6Server-RHOSE-INFRA:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.noarch",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.src"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-0164"
},
{
"category": "external",
"summary": "RHBZ#893307",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=893307"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-0164",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0164"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0164",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0164"
}
],
"release_date": "2013-01-31T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-01-31T19:41:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.noarch",
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.src",
"6Server-RHOSE-INFRA:libmongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.src",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-devel-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-server-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"6Server-RHOSE-INFRA:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.noarch",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.src"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0220"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 2.1,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:L/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.noarch",
"6Server-RHOSE-CLIENT:rhc-0:1.3.2-1.3.el6op.src",
"6Server-RHOSE-INFRA:libmongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.src",
"6Server-RHOSE-INFRA:mongodb-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-debuginfo-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-devel-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:mongodb-server-0:2.0.2-6.el6op.x86_64",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-console-0:0.0.13-2.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-0:1.0.10-1.el6op.src",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.noarch",
"6Server-RHOSE-INFRA:openshift-origin-broker-util-0:1.0.14-1.el6op.src",
"6Server-RHOSE-INFRA:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-activerecord-1:3.0.13-3.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-auth-remote-user-0:1.0.4-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-0:1.0.6-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-console-doc-0:1.0.6-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-controller-0:1.0.11-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-dns-bind-0:1.0.2-1.el6op.src",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-openshift-origin-msg-broker-mcollective-0:1.0.4-1.el6op.src",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.noarch",
"6Server-RHOSE-NODE:jenkins-0:1.498-1.1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-haproxy-1.4-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.8-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-cartridge-ruby-1.9-scl-0:1.0.5-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-msg-node-mcollective-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-node-util-0:1.0.7-1.el6op.src",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.noarch",
"6Server-RHOSE-NODE:openshift-origin-port-proxy-0:1.0.3-1.el6op.src",
"6Server-RHOSE-NODE:ruby193-mod_passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-1:3.2.8-2.el6.src",
"6Server-RHOSE-NODE:ruby193-rubygem-activerecord-doc-1:3.2.8-2.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.src",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-debuginfo-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-devel-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-doc-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-passenger-native-libs-0:3.0.12-21.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-common-0:1.0.2-1.el6op.src",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.noarch",
"6Server-RHOSE-NODE:rubygem-openshift-origin-node-0:1.0.10-6.el6op.src"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "openshift-origin-port-proxy: openshift-port-proxy-cfg lockwrap() tmp file creation"
}
]
}
gsd-2012-6496
Vulnerability from gsd
Modified
2012-12-22 00:00
Details
Due to the way dynamic finders in Active Record extract options from method
parameters, a method parameter can mistakenly be used as a scope. Carefully
crafted requests can use the scope to inject arbitrary SQL.
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2012-6496",
"description": "SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.",
"id": "GSD-2012-6496",
"references": [
"https://www.suse.com/security/cve/CVE-2012-6496.html",
"https://www.debian.org/security/2013/dsa-2597",
"https://access.redhat.com/errata/RHSA-2013:0220",
"https://access.redhat.com/errata/RHSA-2013:0155",
"https://access.redhat.com/errata/RHSA-2013:0154"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "activerecord",
"purl": "pkg:gem/activerecord"
}
}
],
"aliases": [
"CVE-2012-6496",
"OSVDB-88661"
],
"details": "Due to the way dynamic finders in Active Record extract options from method\nparameters, a method parameter can mistakenly be used as a scope. Carefully\ncrafted requests can use the scope to inject arbitrary SQL.\n",
"id": "GSD-2012-6496",
"modified": "2012-12-22T00:00:00.000Z",
"published": "2012-12-22T00:00:00.000Z",
"references": [
{
"type": "WEB",
"url": "https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": 6.4,
"type": "CVSS_V2"
}
],
"summary": "Ruby on Rails find_by_* Methods Authlogic SQL Injection Bypass"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-6496",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=889649",
"refsource": "CONFIRM",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=889649"
},
{
"name": "RHSA-2013:0155",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0155.html"
},
{
"name": "http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/",
"refsource": "MISC",
"url": "http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/"
},
{
"name": "RHSA-2013:0220",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0220.html"
},
{
"name": "GLSA-201401-22",
"refsource": "GENTOO",
"url": "http://security.gentoo.org/glsa/glsa-201401-22.xml"
},
{
"name": "RHSA-2013:0154",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
},
{
"name": "[rubyonrails-security] 20130102 SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664)",
"refsource": "MLIST",
"url": "https://groups.google.com/group/rubyonrails-security/msg/23daa048baf28b64?dmode=source\u0026output=gplain"
},
{
"name": "57084",
"refsource": "BID",
"url": "http://www.securityfocus.com/bid/57084"
},
{
"name": "RHSA-2013:0544",
"refsource": "REDHAT",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0544.html"
}
]
}
},
"github.com/rubysec/ruby-advisory-db": {
"cve": "2012-6496",
"cvss_v2": 6.4,
"date": "2012-12-22",
"description": "Due to the way dynamic finders in Active Record extract options from method\nparameters, a method parameter can mistakenly be used as a scope. Carefully\ncrafted requests can use the scope to inject arbitrary SQL.\n",
"framework": "rails",
"gem": "activerecord",
"osvdb": 88661,
"patched_versions": [
"~\u003e 3.0.18",
"~\u003e 3.1.9",
"\u003e= 3.2.10"
],
"title": "Ruby on Rails find_by_* Methods Authlogic SQL Injection Bypass",
"url": "https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/DCNTNp_qjFM"
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003e=3.0.0 \u003c3.0.18||\u003e=3.1.0 \u003c3.1.9||\u003e=3.2.0 \u003c3.2.10",
"affected_versions": "All versions starting from 3.0.0 before 3.0.18, all versions starting from 3.1.0 before 3.1.9, all versions starting from 3.2.0 before 3.2.10",
"credit": "Aaron Patterson",
"cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe_ids": [
"CWE-1035",
"CWE-89",
"CWE-937"
],
"date": "2019-08-08",
"description": "Due to the way dynamic finders in Active Record extract options from method parameters, a method parameter can mistakenly be used as a scope. Carefully crafted requests can use the scope to inject arbitrary SQL. ",
"fixed_versions": [
"3.0.18",
"3.1.9",
"3.2.10"
],
"identifier": "CVE-2012-6496",
"identifiers": [
"CVE-2012-6496"
],
"not_impacted": "All versions before 3.0.0, all versions starting from 3.0.18 before 3.1.0, all versions starting from 3.1.9 before 3.2.0, all versions starting from 3.2.10",
"package_slug": "gem/activerecord",
"pubdate": "2013-01-03",
"solution": "Upgrade to versions 3.0.18, 3.1.9, 3.2.10 or above.",
"title": "Ruby on Rails find_by_* Methods Authlogic SQL Injection Bypass",
"urls": [
"https://github.com/rails/rails/commit/c42f548960fe2359571e62748bf7b92f4fa22f66#diff-391caa9b9464021e932ebf657fa9b13c",
"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/OSVDB-88661.yml",
"https://groups.google.com/forum/#!original/rubyonrails-security/DCNTNp_qjFM/ZIvyukig2iMJ"
],
"uuid": "2a17d3df-1a2a-490c-bd7b-b59dc964e178"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.16:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:*",
"cpe_name": [],
"versionEndIncluding": "3.0.17",
"vulnerable": true
}
],
"operator": "OR"
},
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.8:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.9:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "cve@mitre.org",
"ID": "CVE-2012-6496"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls."
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://bugzilla.redhat.com/show_bug.cgi?id=889649",
"refsource": "CONFIRM",
"tags": [
"Exploit",
"Patch"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=889649"
},
{
"name": "http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/",
"refsource": "MISC",
"tags": [],
"url": "http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/"
},
{
"name": "[rubyonrails-security] 20130102 SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664)",
"refsource": "MLIST",
"tags": [],
"url": "https://groups.google.com/group/rubyonrails-security/msg/23daa048baf28b64?dmode=source\u0026output=gplain"
},
{
"name": "RHSA-2013:0154",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
},
{
"name": "RHSA-2013:0155",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0155.html"
},
{
"name": "RHSA-2013:0220",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0220.html"
},
{
"name": "RHSA-2013:0544",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0544.html"
},
{
"name": "GLSA-201401-22",
"refsource": "GENTOO",
"tags": [],
"url": "http://security.gentoo.org/glsa/glsa-201401-22.xml"
},
{
"name": "57084",
"refsource": "BID",
"tags": [],
"url": "http://www.securityfocus.com/bid/57084"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"userInteractionRequired": false
}
},
"lastModifiedDate": "2019-08-08T15:42Z",
"publishedDate": "2013-01-04T04:46Z"
}
}
}
ghsa-gh2w-j7cx-2664
Vulnerability from github
Published
2017-10-24 18:33
Modified
2025-01-21 16:47
VLAI Severity ?
Summary
Active Record contains SQL Injection
Details
SQL injection vulnerability in the Active Record component in Ruby on Rails before 2.3.15, 3.0.x before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "activerecord"
},
"ranges": [
{
"events": [
{
"introduced": "3.0.0.beta"
},
{
"fixed": "3.0.18"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "activerecord"
},
"ranges": [
{
"events": [
{
"introduced": "3.1.0"
},
{
"fixed": "3.1.9"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "activerecord"
},
"ranges": [
{
"events": [
{
"introduced": "3.2.0"
},
{
"fixed": "3.2.10"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "activerecord"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "2.3.15"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2012-6496"
],
"database_specific": {
"cwe_ids": [
"CWE-89"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T21:37:20Z",
"nvd_published_at": "2013-01-04T04:46:02Z",
"severity": "HIGH"
},
"details": "SQL injection vulnerability in the Active Record component in Ruby on Rails before 2.3.15, 3.0.x before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.",
"id": "GHSA-gh2w-j7cx-2664",
"modified": "2025-01-21T16:47:32Z",
"published": "2017-10-24T18:33:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6496"
},
{
"type": "WEB",
"url": "https://github.com/rails/rails/commit/9de9b359d0d24f70f0f6c5c58a7ad8750684d456"
},
{
"type": "WEB",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=889649"
},
{
"type": "PACKAGE",
"url": "https://github.com/rails/rails"
},
{
"type": "WEB",
"url": "https://groups.google.com/group/rubyonrails-security/msg/23daa048baf28b64?dmode=source\u0026output=gplain"
},
{
"type": "WEB",
"url": "http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0220.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0544.html"
},
{
"type": "WEB",
"url": "http://security.gentoo.org/glsa/glsa-201401-22.xml"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "Active Record contains SQL Injection"
}
fkie_cve-2012-6496
Vulnerability from fkie_nvd
Published
2013-01-04 04:46
Modified
2025-04-11 00:51
Severity ?
Summary
SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.
References
| ▶ | URL | Tags | |
|---|---|---|---|
| cve@mitre.org | http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/ | ||
| cve@mitre.org | http://rhn.redhat.com/errata/RHSA-2013-0154.html | ||
| cve@mitre.org | http://rhn.redhat.com/errata/RHSA-2013-0155.html | ||
| cve@mitre.org | http://rhn.redhat.com/errata/RHSA-2013-0220.html | ||
| cve@mitre.org | http://rhn.redhat.com/errata/RHSA-2013-0544.html | ||
| cve@mitre.org | http://security.gentoo.org/glsa/glsa-201401-22.xml | ||
| cve@mitre.org | http://www.securityfocus.com/bid/57084 | ||
| cve@mitre.org | https://bugzilla.redhat.com/show_bug.cgi?id=889649 | Exploit, Patch | |
| cve@mitre.org | https://groups.google.com/group/rubyonrails-security/msg/23daa048baf28b64?dmode=source&output=gplain | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/ | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2013-0154.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2013-0155.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2013-0220.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2013-0544.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://security.gentoo.org/glsa/glsa-201401-22.xml | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/57084 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://bugzilla.redhat.com/show_bug.cgi?id=889649 | Exploit, Patch | |
| af854a3a-2127-422b-91ae-364da2661108 | https://groups.google.com/group/rubyonrails-security/msg/23daa048baf28b64?dmode=source&output=gplain |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| rubyonrails | rails | 3.1.0 | |
| rubyonrails | rails | 3.1.0 | |
| rubyonrails | rails | 3.1.0 | |
| rubyonrails | rails | 3.1.0 | |
| rubyonrails | rails | 3.1.0 | |
| rubyonrails | rails | 3.1.0 | |
| rubyonrails | rails | 3.1.0 | |
| rubyonrails | rails | 3.1.0 | |
| rubyonrails | rails | 3.1.0 | |
| rubyonrails | rails | 3.1.0 | |
| rubyonrails | rails | 3.1.1 | |
| rubyonrails | rails | 3.1.1 | |
| rubyonrails | rails | 3.1.1 | |
| rubyonrails | rails | 3.1.1 | |
| rubyonrails | rails | 3.1.2 | |
| rubyonrails | rails | 3.1.2 | |
| rubyonrails | rails | 3.1.2 | |
| rubyonrails | rails | 3.1.3 | |
| rubyonrails | rails | 3.1.4 | |
| rubyonrails | rails | 3.1.4 | |
| rubyonrails | rails | 3.1.5 | |
| rubyonrails | rails | 3.1.5 | |
| rubyonrails | rails | 3.1.6 | |
| rubyonrails | rails | 3.1.7 | |
| rubyonrails | rails | 3.1.8 | |
| rubyonrails | rails | 3.0.0 | |
| rubyonrails | rails | 3.0.0 | |
| rubyonrails | rails | 3.0.0 | |
| rubyonrails | rails | 3.0.0 | |
| rubyonrails | rails | 3.0.0 | |
| rubyonrails | rails | 3.0.0 | |
| rubyonrails | rails | 3.0.0 | |
| rubyonrails | rails | 3.0.1 | |
| rubyonrails | rails | 3.0.1 | |
| rubyonrails | rails | 3.0.2 | |
| rubyonrails | rails | 3.0.2 | |
| rubyonrails | rails | 3.0.3 | |
| rubyonrails | rails | 3.0.4 | |
| rubyonrails | rails | 3.0.5 | |
| rubyonrails | rails | 3.0.5 | |
| rubyonrails | rails | 3.0.6 | |
| rubyonrails | rails | 3.0.6 | |
| rubyonrails | rails | 3.0.6 | |
| rubyonrails | rails | 3.0.7 | |
| rubyonrails | rails | 3.0.7 | |
| rubyonrails | rails | 3.0.7 | |
| rubyonrails | rails | 3.0.8 | |
| rubyonrails | rails | 3.0.8 | |
| rubyonrails | rails | 3.0.8 | |
| rubyonrails | rails | 3.0.8 | |
| rubyonrails | rails | 3.0.8 | |
| rubyonrails | rails | 3.0.9 | |
| rubyonrails | rails | 3.0.9 | |
| rubyonrails | rails | 3.0.9 | |
| rubyonrails | rails | 3.0.9 | |
| rubyonrails | rails | 3.0.9 | |
| rubyonrails | rails | 3.0.9 | |
| rubyonrails | rails | 3.0.10 | |
| rubyonrails | rails | 3.0.10 | |
| rubyonrails | rails | 3.0.11 | |
| rubyonrails | rails | 3.0.12 | |
| rubyonrails | rails | 3.0.12 | |
| rubyonrails | rails | 3.0.13 | |
| rubyonrails | rails | 3.0.13 | |
| rubyonrails | rails | 3.0.14 | |
| rubyonrails | rails | 3.0.16 | |
| rubyonrails | ruby_on_rails | * | |
| rubyonrails | ruby_on_rails | 3.0.4 | |
| rubyonrails | rails | 3.2.0 | |
| rubyonrails | rails | 3.2.0 | |
| rubyonrails | rails | 3.2.0 | |
| rubyonrails | rails | 3.2.1 | |
| rubyonrails | rails | 3.2.2 | |
| rubyonrails | rails | 3.2.2 | |
| rubyonrails | rails | 3.2.3 | |
| rubyonrails | rails | 3.2.3 | |
| rubyonrails | rails | 3.2.3 | |
| rubyonrails | rails | 3.2.4 | |
| rubyonrails | rails | 3.2.4 | |
| rubyonrails | rails | 3.2.5 | |
| rubyonrails | rails | 3.2.6 | |
| rubyonrails | rails | 3.2.7 | |
| rubyonrails | rails | 3.2.8 | |
| rubyonrails | rails | 3.2.9 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*",
"matchCriteriaId": "DB51F3E9-4899-49A9-9E7B-0DCA92A91DD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:*",
"matchCriteriaId": "F884F2F4-94F3-46CB-860B-1BCC0EEF408A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "88DFBB48-1C29-4639-9369-F5B413CA2337",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "D37696D7-BEE6-4587-9E33-A7FE24780409",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:*",
"matchCriteriaId": "E95B5D44-0C8D-47BC-A89D-48A5BDEB84F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:*",
"matchCriteriaId": "1DFDAF6A-76AA-436F-A4F3-DA69892DE2B8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:*",
"matchCriteriaId": "D3172982-3FA4-427F-BE3E-2321D804E49D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:*",
"matchCriteriaId": "FD6EC85B-F092-48FF-966A-96B9227C8656",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:*",
"matchCriteriaId": "9000F3C1-57A0-474C-9C82-E58688F29838",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:*",
"matchCriteriaId": "6E55E42E-AB6A-4E47-AC69-DFDAEB0A8735",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:*",
"matchCriteriaId": "A42F4E7A-6F6A-485C-8D30-95F3B0285922",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:*",
"matchCriteriaId": "30B9C0CB-F6E6-4233-84E4-D6E69104DD73",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:*",
"matchCriteriaId": "84309CC7-A8B7-4ADB-AEA1-964DA5F7B0E0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:*",
"matchCriteriaId": "5343241F-274D-45FF-97C7-2BC2E920BAF0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:*",
"matchCriteriaId": "FED122B8-AF4C-4C48-B1E5-54F4A7A31A53",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "157ACCAD-0FB8-4CC9-9DFB-70835DE6506C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:*",
"matchCriteriaId": "3E50ACF6-7277-4C9A-B42A-E7EFDC317691",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C191DC2B-1EC3-48E0-A586-867E6EE4431C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:*",
"matchCriteriaId": "3AA51263-6680-42C6-B119-8241D6F76206",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B4BC41E8-FEDA-4C31-B479-D49A59FC4D63",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:*",
"matchCriteriaId": "09C20971-53B5-43B0-AC45-5AA0FDF1B054",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "D1AEFA5D-A793-4BAB-8DED-3D3A31260AD8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:*",
"matchCriteriaId": "496902D6-409A-40D9-849F-C41264BE5B04",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.7:*:*:*:*:*:*:*",
"matchCriteriaId": "2482AB3F-8303-4F95-BE04-C5F06EEF2015",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.1.8:*:*:*:*:*:*:*",
"matchCriteriaId": "244C6952-377C-4AF0-8BA2-C34516A3EB5A",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:*:*:*:*:*:*:*",
"matchCriteriaId": "E3BE7DFE-BA20-434B-A1DE-AD038B255C60",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta:*:*:*:*:*:*",
"matchCriteriaId": "DCEE5B21-C990-4705-8239-0D7B29DAEDA1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta2:*:*:*:*:*:*",
"matchCriteriaId": "65EE33B1-B079-4CDE-B9C2-F1613A4610DC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta3:*:*:*:*:*:*",
"matchCriteriaId": "5CAAA20B-824F-4448-99DC-9712FE628073",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:beta4:*:*:*:*:*:*",
"matchCriteriaId": "D2BEBDFB-0F30-454A-B74C-F820C9D2708B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:rc:*:*:*:*:*:*",
"matchCriteriaId": "1D7CD8C1-95D1-477E-AD96-6582EC33BA01",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "B6F00D98-3D0F-40AF-AE4F-090B1E6B660C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.1:*:*:*:*:*:*:*",
"matchCriteriaId": "9476CE55-69C0-45D3-B723-6F459C90BF05",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.1:pre:*:*:*:*:*:*",
"matchCriteriaId": "486F5BA6-BCF7-4691-9754-19D364B4438D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.2:*:*:*:*:*:*:*",
"matchCriteriaId": "112FC73B-A8BC-4EEA-9F4B-CCE685EF2838",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.2:pre:*:*:*:*:*:*",
"matchCriteriaId": "E4498383-6FCA-4E17-A1FD-B0CE7EE50F85",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.3:*:*:*:*:*:*:*",
"matchCriteriaId": "D26565B1-2BA6-4A3C-9264-7FC9A1820B59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "644EF85E-6D3E-4F5C-96B0-49AD2A2D90CE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.5:*:*:*:*:*:*:*",
"matchCriteriaId": "392E2D58-CB39-4832-B4D9-9C2E23B8E14C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.5:rc1:*:*:*:*:*:*",
"matchCriteriaId": "1F2466EA-7039-46A1-B4A3-8DACD1953A59",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.6:*:*:*:*:*:*:*",
"matchCriteriaId": "0CAB4E72-0A15-4B26-9B69-074C278568D6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.6:rc1:*:*:*:*:*:*",
"matchCriteriaId": "A085E105-9375-440A-80CB-9B23E6D7EB4A",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.6:rc2:*:*:*:*:*:*",
"matchCriteriaId": "25911E48-C5D7-4ED8-B4DB-7523A74CCF49",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.7:*:*:*:*:*:*:*",
"matchCriteriaId": "FE6EC1E5-3A4A-4751-9F77-28EF5AF681E3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.7:rc1:*:*:*:*:*:*",
"matchCriteriaId": "B29674E3-CC80-446B-9A43-82594AE7A058",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.7:rc2:*:*:*:*:*:*",
"matchCriteriaId": "FF34D8CB-2B6D-4CB8-A206-108293BCFFE7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.8:*:*:*:*:*:*:*",
"matchCriteriaId": "8E5187F6-E3AC-4E0D-B1D0-83DE76C20A4B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc1:*:*:*:*:*:*",
"matchCriteriaId": "272268EE-E3E8-4683-B679-55D748877A7E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc2:*:*:*:*:*:*",
"matchCriteriaId": "7B69FD33-61FE-4F10-BBE1-215F59035D30",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc3:*:*:*:*:*:*",
"matchCriteriaId": "08D7CB5D-82EF-4A24-A792-938FAB40863D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.8:rc4:*:*:*:*:*:*",
"matchCriteriaId": "8A044B21-47D5-468D-AF4A-06B3B5CC0824",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:*:*:*:*:*:*:*",
"matchCriteriaId": "2196F3D0-532A-40F9-843A-1DFBC8B63FDC",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc1:*:*:*:*:*:*",
"matchCriteriaId": "CBEDA932-6CB5-438C-94E4-824732A91BE0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc2:*:*:*:*:*:*",
"matchCriteriaId": "903E5524-5E45-48CE-A804-EDAEBE3A79AD",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc3:*:*:*:*:*:*",
"matchCriteriaId": "08534AF2-F94E-4FB6-A572-4FB9827276D4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc4:*:*:*:*:*:*",
"matchCriteriaId": "29E3B4A6-1346-4358-B7BC-84D00ED3ABBE",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.9:rc5:*:*:*:*:*:*",
"matchCriteriaId": "B52D7A6B-DD93-45F0-9186-18ABEFF28DF4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.10:*:*:*:*:*:*:*",
"matchCriteriaId": "1F07C641-48DF-43BE-9EB5-72B337C54846",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.10:rc1:*:*:*:*:*:*",
"matchCriteriaId": "A1CB1B12-99F5-430F-AE19-9A95C17FA123",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.11:*:*:*:*:*:*:*",
"matchCriteriaId": "D1A7C449-8F9A-4CE5-9C3D-375996BFAEE3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.12:*:*:*:*:*:*:*",
"matchCriteriaId": "05D5D58C-DB79-41EA-81AE-5D95C48211B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.12:rc1:*:*:*:*:*:*",
"matchCriteriaId": "FE331D6D-99BA-4369-AD8B-B556DEE4955F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.13:*:*:*:*:*:*:*",
"matchCriteriaId": "58304E17-ADFD-4686-9CCF-C1CA31843B94",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.13:rc1:*:*:*:*:*:*",
"matchCriteriaId": "05108EF0-81AD-4378-9843-5C23F2AC79A3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.14:*:*:*:*:*:*:*",
"matchCriteriaId": "4EE7DA7E-23A5-42AF-9D5C-39240CE2FBDB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.0.16:*:*:*:*:*:*:*",
"matchCriteriaId": "0C448F62-8231-4221-ADA0-C9B848AE03D1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:*",
"matchCriteriaId": "53AE7CCA-1E57-4925-A025-F1BBFCE70272",
"versionEndIncluding": "3.0.17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:ruby_on_rails:3.0.4:*:*:*:*:*:*:*",
"matchCriteriaId": "224BD488-0D7E-4F8B-9012-DE872DEB544C",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
},
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*",
"matchCriteriaId": "2816C02C-E13E-4367-91F3-14756A90EC9E",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:*",
"matchCriteriaId": "E82AF7C7-B725-40EF-8EE3-18F8E7FAEB29",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:*",
"matchCriteriaId": "1AE674DE-65DB-437E-A034-A2EE5C584B33",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*",
"matchCriteriaId": "0524F3E3-BAD7-4CD3-A6E7-74CFBE4B46E6",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*",
"matchCriteriaId": "32EB2C3F-0F24-43DB-988E-BD2973598F71",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:*",
"matchCriteriaId": "EB32713D-FE64-445E-872E-B4678C243AB1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*",
"matchCriteriaId": "C55E6B4A-2B9C-46C8-A739-109EA4BA7FD4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:*",
"matchCriteriaId": "89C618DC-38BC-4484-8C41-BC38B7EB636B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:*",
"matchCriteriaId": "FE1EF01A-F358-45D3-ADA2-51DD1D8CB6E2",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:*",
"matchCriteriaId": "AC2616BD-A4E8-42F3-BB5A-7517DC4EDA3D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:*",
"matchCriteriaId": "0E376782-98B0-4766-B6FC-67E032A00C62",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:*",
"matchCriteriaId": "96D08DC1-14E9-4DB9-BC95-3F73B454FBC4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:*",
"matchCriteriaId": "F365C9E5-27DC-46C3-AFE4-4876EC7B352B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:*",
"matchCriteriaId": "6F0016A6-0ED6-443D-B969-CB1226D8E28C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.8:*:*:*:*:*:*:*",
"matchCriteriaId": "E69470EA-5EBC-4FB9-A722-5B61C70C1140",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubyonrails:rails:3.2.9:*:*:*:*:*:*:*",
"matchCriteriaId": "B13A8EBB-4211-4AB1-8872-244EEEE20ABD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls."
},
{
"lang": "es",
"value": "Vulnerabilidad de inyecci\u00f3n SQL en el componente Active Record en Ruby on Rails antes de v3.0.18, v3.1.x antes de v3.1.9, y v3.2.x antes de v3.2.10, permite a atacantes remotos ejecutar comandos SQL a trav\u00e9s de una solicitud modificada que aprovecha el comportamiento incorrecto de buscadores din\u00e1micos en aplicaciones que pueden utilizar los tipos de datos inesperados en ciertas llamadas al m\u00e9todo find_by_."
}
],
"id": "CVE-2012-6496",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-01-04T04:46:02.947",
"references": [
{
"source": "cve@mitre.org",
"url": "http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/"
},
{
"source": "cve@mitre.org",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
},
{
"source": "cve@mitre.org",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0155.html"
},
{
"source": "cve@mitre.org",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0220.html"
},
{
"source": "cve@mitre.org",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0544.html"
},
{
"source": "cve@mitre.org",
"url": "http://security.gentoo.org/glsa/glsa-201401-22.xml"
},
{
"source": "cve@mitre.org",
"url": "http://www.securityfocus.com/bid/57084"
},
{
"source": "cve@mitre.org",
"tags": [
"Exploit",
"Patch"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=889649"
},
{
"source": "cve@mitre.org",
"url": "https://groups.google.com/group/rubyonrails-security/msg/23daa048baf28b64?dmode=source\u0026output=gplain"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0154.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0155.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0220.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0544.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://security.gentoo.org/glsa/glsa-201401-22.xml"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/57084"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Exploit",
"Patch"
],
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=889649"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://groups.google.com/group/rubyonrails-security/msg/23daa048baf28b64?dmode=source\u0026output=gplain"
}
],
"sourceIdentifier": "cve@mitre.org",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-89"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…