Source: rails Version: 2:5.2.4.1+dfsg-1 Severity: important Tags: security upstream Control: found -1 2:6.0.2.1+dfsg-2 Control: found -1 2:5.2.2.1+dfsg-1 Control: found -1 2:4.2.7.1-1+deb9u1 Control: found -1 2:4.2.7.1-1
Hi, The following vulnerability was published for rails. CVE-2020-5267[0]: | In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible | XSS vulnerability in ActionView's JavaScript literal escape helpers. | Views that use the `j` or `escape_javascript` methods may be | susceptible to XSS attacks. The issue is fixed in versions 6.0.2.2 and | 5.2.4.2. If you fix the vulnerability please also make sure to include the CVE (Common Vulnerabilities & Exposures) id in your changelog entry. For further information see: [0] https://security-tracker.debian.org/tracker/CVE-2020-5267 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-5267 [1] https://www.openwall.com/lists/oss-security/2020/03/19/1 Regards, Salvatore _______________________________________________ Pkg-ruby-extras-maintainers mailing list [email protected] https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/pkg-ruby-extras-maintainers
