CVE-2020-8163

Published: 2 July 2020

The is a code injection vulnerability in versions of Rails prior to 5.0.1 that wouldallow an attacker who controlled the `locals` argument of a `render` call to perform a RCE.

Priority

Medium

CVSS 3 base score: 8.8

Status

Notes

In Oneiric-Saucy, rails package is just for transition;
The rails package contains actual code from vivid onward

References

• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8163
• https://weblog.rubyonrails.org/2020/5/16/rails-4-2-11-3-has-been-released/
• https://github.com/rails/rails/commit/4c46a15e0a7815ca9e4cd7c7fda042eb8c1b7724 (4.2.11.2)
• https://github.com/rails/rails/commit/1f3db0ad793441a0c00e85d56228fc80aafbe6c1 (4.2.11.3)
• NVD
• Launchpad
• Debian

Bugs