Candidate: CVE-2020-15169
PublicDate: 2020-09-11 16:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-15169
 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionview/CVE-2020-15169.yml
 https://groups.google.com/g/rubyonrails-security/c/b-C9kSGXYrc?pli=1
 https://github.com/rails/rails/commit/e663f084460ea56c55c3dc76f78c7caeddeeb02e
Description:
 In Action View before versions 5.2.4.4 and 6.0.3.3 there is a potential
 Cross-Site Scripting (XSS) vulnerability in Action View's translation
 helpers. Views that allow the user to control the default (not found) value
 of the `t` and `translate` helpers could be susceptible to XSS attacks.
 When an HTML-unsafe string is passed as the default for a missing
 translation key named html or ending in _html, the default string is
 incorrectly marked as HTML-safe and not escaped. This is patched in
 versions 6.0.3.3 and 5.2.4.4. A workaround without upgrading is proposed in
 the source advisory.
Ubuntu-Description:
Notes:
 seth-arnold> In Oneiric-Saucy, rails package is just for transition;
 seth-arnold> The rails package contains actual code from vivid onward
Mitigation:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=970040
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N [6.1 MEDIUM]

Patches_rails:
upstream_rails: needs-triage
precise/esm_rails: DNE
trusty_rails: ignored (out of standard support)
trusty/esm_rails: DNE
xenial_rails: ignored (end of standard support, was needs-triage)
bionic_rails: needs-triage
focal_rails: needs-triage
groovy_rails: ignored (reached end-of-life)
hirsute_rails: ignored (reached end-of-life)
impish_rails: needs-triage
jammy_rails: needs-triage
devel_rails: needs-triage

Patches_ruby-rails-3.2:
upstream_ruby-rails-3.2: needs-triage
precise/esm_ruby-rails-3.2: DNE
trusty_ruby-rails-3.2: ignored (out of standard support)
trusty/esm_ruby-rails-3.2: DNE
xenial_ruby-rails-3.2: DNE
bionic_ruby-rails-3.2: DNE
focal_ruby-rails-3.2: DNE
groovy_ruby-rails-3.2: DNE
hirsute_ruby-rails-3.2: DNE
impish_ruby-rails-3.2: DNE
jammy_ruby-rails-3.2: DNE
devel_ruby-rails-3.2: DNE

Patches_ruby-actionpack-3.2:
upstream_ruby-actionpack-3.2: needs-triage
precise/esm_ruby-actionpack-3.2: DNE
trusty_ruby-actionpack-3.2: ignored (out of standard support)
trusty/esm_ruby-actionpack-3.2: DNE
xenial_ruby-actionpack-3.2: DNE
bionic_ruby-actionpack-3.2: DNE
focal_ruby-actionpack-3.2: DNE
groovy_ruby-actionpack-3.2: DNE
hirsute_ruby-actionpack-3.2: DNE
impish_ruby-actionpack-3.2: DNE
jammy_ruby-actionpack-3.2: DNE
devel_ruby-actionpack-3.2: DNE

Patches_ruby-activesupport-3.2:
upstream_ruby-activesupport-3.2: needs-triage
precise/esm_ruby-activesupport-3.2: DNE
trusty_ruby-activesupport-3.2: ignored (out of standard support)
trusty/esm_ruby-activesupport-3.2: DNE
xenial_ruby-activesupport-3.2: DNE
bionic_ruby-activesupport-3.2: DNE
focal_ruby-activesupport-3.2: DNE
groovy_ruby-activesupport-3.2: DNE
hirsute_ruby-activesupport-3.2: DNE
impish_ruby-activesupport-3.2: DNE
jammy_ruby-activesupport-3.2: DNE
devel_ruby-activesupport-3.2: DNE

Patches_ruby-activerecord-3.2:
upstream_ruby-activerecord-3.2: needs-triage
precise/esm_ruby-activerecord-3.2: DNE
trusty_ruby-activerecord-3.2: ignored (out of standard support)
trusty/esm_ruby-activerecord-3.2: DNE
xenial_ruby-activerecord-3.2: DNE
bionic_ruby-activerecord-3.2: DNE
focal_ruby-activerecord-3.2: DNE
groovy_ruby-activerecord-3.2: DNE
hirsute_ruby-activerecord-3.2: DNE
impish_ruby-activerecord-3.2: DNE
jammy_ruby-activerecord-3.2: DNE
devel_ruby-activerecord-3.2: DNE

Patches_ruby-activemodel-3.2:
upstream_ruby-activemodel-3.2: needs-triage
precise/esm_ruby-activemodel-3.2: DNE
trusty_ruby-activemodel-3.2: ignored (out of standard support)
trusty/esm_ruby-activemodel-3.2: DNE
xenial_ruby-activemodel-3.2: DNE
bionic_ruby-activemodel-3.2: DNE
focal_ruby-activemodel-3.2: DNE
groovy_ruby-activemodel-3.2: DNE
hirsute_ruby-activemodel-3.2: DNE
impish_ruby-activemodel-3.2: DNE
jammy_ruby-activemodel-3.2: DNE
devel_ruby-activemodel-3.2: DNE

Patches_rails-4.0:
upstream_rails-4.0: needs-triage
precise/esm_rails-4.0: DNE
trusty_rails-4.0: ignored (out of standard support)
trusty/esm_rails-4.0: DNE
xenial_rails-4.0: DNE
bionic_rails-4.0: DNE
focal_rails-4.0: DNE
groovy_rails-4.0: DNE
hirsute_rails-4.0: DNE
impish_rails-4.0: DNE
jammy_rails-4.0: DNE
devel_rails-4.0: DNE