FLAT-JLP0T – Vulnerability | Fluid Attacks Database

Database

Description

There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem	Component	Affected version	Patched versions
debian 12	rails	>=0 <2:6.1.7.3+dfsg-1	2:6.1.7.3+dfsg-1
debian 13	rails	>=0 <2:6.1.7.3+dfsg-1	2:6.1.7.3+dfsg-1
debian 14	rails	>=0 <2:6.1.7.3+dfsg-1	2:6.1.7.3+dfsg-1
rubygems	activesupport	>=7.0.0 <7.0.4.3 \|\| >=0 <6.1.7.3	7.0.4.3, 6.1.7.3

Aliases

1. CVE-2023-281202. NVD-2023-281203. OSV-DEBIAN-2023-281204. OSV-2023-281205. GCVE-2023-281206. SECURITY-TRACKER-CVE-2023-28120

References

1. https://github.com/rails/rails/commit/3cf23c3f891e2e81c977ea4ab83b62bc2a444b702. https://discuss.rubyonrails.org/t/cve-2023-28120-possible-xss-security-vulnerability-in-safebuffer-bytesplice/824693. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2023-28120.yml4. https://lists.fedoraproject.org/archives/list/[email protected]/message/UPV6PVCX4VDJHLFFT42EXBBSGAWZICOW5. https://lists.fedoraproject.org/archives/list/[email protected]/message/ZE5W4MH6IE4DV7GELDK6ISCSTFLHKSYO6. https://security.netapp.com/advisory/ntap-20240202-00067. https://www.debian.org/security/2023/dsa-5389

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.