Candidate: CVE-2020-8264
PublicDate: 2021-01-06 21:15:00 UTC
References:
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-8264
 https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ
Description:
 In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an
 application is running in development mode allowing an attacker to send or
 embed (in another page) a specially crafted URL which can allow the
 attacker to execute JavaScript in the context of the local application.
 This vulnerability is in the Actionable Exceptions middleware.
Ubuntu-Description:
Notes:
 seth-arnold> In Oneiric-Saucy, rails package is just for transition;
 seth-arnold> The rails package contains actual code from vivid onward
 ebarretto> Only affects rails >= 6.0.0
Mitigation:
Bugs:
 http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=971988
Priority: medium
Discovered-by:
Assigned-to:
CVSS:
 nvd: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N [6.1 MEDIUM]

Patches_rails:
upstream_rails: needs-triage
precise/esm_rails: DNE
trusty_rails: ignored (out of standard support)
trusty/esm_rails: DNE
xenial_rails: not-affected (code not present)
bionic_rails: not-affected (code not present)
focal_rails: not-affected (code not present)
devel_rails: not-affected (code not present)

Patches_ruby-rails-3.2:
upstream_ruby-rails-3.2: needs-triage
precise/esm_ruby-rails-3.2: DNE
trusty_ruby-rails-3.2: ignored (out of standard support)
trusty/esm_ruby-rails-3.2: DNE
xenial_ruby-rails-3.2: DNE
bionic_ruby-rails-3.2: DNE
focal_ruby-rails-3.2: DNE
devel_ruby-rails-3.2: DNE

Patches_ruby-actionpack-3.2:
upstream_ruby-actionpack-3.2: needs-triage
precise/esm_ruby-actionpack-3.2: DNE
trusty_ruby-actionpack-3.2: ignored (out of standard support)
trusty/esm_ruby-actionpack-3.2: DNE
xenial_ruby-actionpack-3.2: DNE
bionic_ruby-actionpack-3.2: DNE
focal_ruby-actionpack-3.2: DNE
devel_ruby-actionpack-3.2: DNE

Patches_ruby-activesupport-3.2:
upstream_ruby-activesupport-3.2: needs-triage
precise/esm_ruby-activesupport-3.2: DNE
trusty_ruby-activesupport-3.2: ignored (out of standard support)
trusty/esm_ruby-activesupport-3.2: DNE
xenial_ruby-activesupport-3.2: DNE
bionic_ruby-activesupport-3.2: DNE
focal_ruby-activesupport-3.2: DNE
devel_ruby-activesupport-3.2: DNE

Patches_ruby-activerecord-3.2:
upstream_ruby-activerecord-3.2: needs-triage
precise/esm_ruby-activerecord-3.2: DNE
trusty_ruby-activerecord-3.2: ignored (out of standard support)
trusty/esm_ruby-activerecord-3.2: DNE
xenial_ruby-activerecord-3.2: DNE
bionic_ruby-activerecord-3.2: DNE
focal_ruby-activerecord-3.2: DNE
devel_ruby-activerecord-3.2: DNE

Patches_ruby-activemodel-3.2:
upstream_ruby-activemodel-3.2: needs-triage
precise/esm_ruby-activemodel-3.2: DNE
trusty_ruby-activemodel-3.2: ignored (out of standard support)
trusty/esm_ruby-activemodel-3.2: DNE
xenial_ruby-activemodel-3.2: DNE
bionic_ruby-activemodel-3.2: DNE
focal_ruby-activemodel-3.2: DNE
devel_ruby-activemodel-3.2: DNE

Patches_rails-4.0:
upstream_rails-4.0: needs-triage
precise/esm_rails-4.0: DNE
trusty_rails-4.0: ignored (out of standard support)
trusty/esm_rails-4.0: DNE
xenial_rails-4.0: DNE
bionic_rails-4.0: DNE
focal_rails-4.0: DNE
devel_rails-4.0: DNE