Debian Security Advisory
DLA-2149-1 rails -- LTS security update
- Date Reported:
- 20 Mar 2020
- Affected Packages:
- rails
- Vulnerable:
- Yes
- Security database references:
- In the Debian bugtracking system: Bug 954304.
In Mitre's CVE dictionary: CVE-2020-5267. - More information:
-
In ActionView before versions 6.0.2.2 and 5.2.4.2, there is a possible XSS vulnerability in ActionView's JavaScript literal escape helpers. Views that use the `j` or `escape_javascript` methods may be susceptible to XSS attacks.
For Debian 8
Jessie
, this problem has been fixed in version 2:4.1.8-1+deb8u6.We recommend that you upgrade your rails packages.
Further information about Debian LTS security advisories, how to apply these updates to your system and frequently asked questions can be found at: https://wiki.debian.org/LTS