GHSA-q2qw-rmrh-vv42
Improper Access Control in activejob
At a glance
- Published
- Updated
- CVE
- CVE-2018-16476
- CVSS_V3
- CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N
Description
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have.
Affected packages
| Package | Versions |
|---|---|
| RubyGems · activejob | introduced 4.2.0, fixed 4.2.11 |
| RubyGems · activejob | introduced 5.0.0, fixed 5.0.7.1 |
| RubyGems · activejob | introduced 5.1.0, fixed 5.1.6.1 |
| RubyGems · activejob | introduced 5.2.0, fixed 5.2.1.1 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2018-16476 ADVISORY
- https://github.com/rails/rails/commit/970b0d754be7c71a760d9b807eea32297fd838e3 WEB
- https://access.redhat.com/errata/RHSA-2019:0600 WEB
- https://github.com/rails/rails PACKAGE
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activejob/CVE-2018-16476.yml WEB
- https://groups.google.com/d/msg/rubyonrails-security/FL4dSdzr2zw/zjKVhF4qBAAJ WEB
- https://groups.google.com/forum/#!topic/rubyonrails-security/FL4dSdzr2zw WEB
- https://weblog.rubyonrails.org/2018/11/27/Rails-4-2-5-0-5-1-5-2-have-been-released WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |