FreshPorts - VuXML

This page displays vulnerability information about FreeBSD Ports.

The last vuln.xml file processed by FreshPorts is:

nothing found there

List all Vulnerabilities, by package

List all Vulnerabilities, by date

These are the vulnerabilities relating to the commit you have selected:

VuXML IDDescription
85fca718-99f6-11ea-bf1d-08002728f74cRails -- multiple vulnerabilities

Ruby on Rails blog:

Hi everyone! Rails 5.2.4.3 and 6.0.3.1 have been released! These releases contain important security fixes, so please upgrade when you can.

Both releases contain the following fixes:

CVE-2020-8162: Circumvention of file size limits in ActiveStorage

CVE-2020-8164: Possible Strong Parameters Bypass in ActionPack

CVE-2020-8165: Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore

CVE-2020-8166: Ability to forge per-form CSRF tokens given a global CSRF token

CVE-2020-8167: CSRF Vulnerability in rails-ujs


Discovery 2020-05-18
Entry 2020-05-19
rubygem-actionpack52
rubygem-actionview52
rubygem-activestorage52
rubygem-activesupport52
lt 5.2.4.3

rubygem-actionpack60
rubygem-actionview60
rubygem-activestorage60
rubygem-activesupport60
lt 6.0.3.1

https://weblog.rubyonrails.org/2020/5/18/Rails-5-2-4-3-and-6-0-3-1-have-been-released/
https://groups.google.com/forum/#!topic/rubyonrails-security/PjU3946mreQ
https://groups.google.com/forum/#!topic/rubyonrails-security/f6ioe4sdpbY
https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c
https://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw
https://groups.google.com/forum/#!topic/rubyonrails-security/x9DixQDG9a0
CVE-2020-8162
CVE-2020-8164
CVE-2020-8165
CVE-2020-8166
CVE-2020-8167