CVE-2015-3226
Fixed in a distro release EPSS 3%
Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding.
Products: rubyonrails rails, rubyonrails ruby_on_rails
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | activesupport | 4.1.11 |
| RubyGems | activesupport | 4.2.2 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | rails | 2:4.2.4-2 |
| Debian 13 | rails | 2:4.2.4-2 |
| Debian 14 | rails | 2:4.2.4-2 |
| Debian 8 | rails | 2:4.1.8-1+deb8u1 |
| SUSE OpenStack Cloud 5 | rubygem-activesupport-4_1 | 4.1.9-9.2 |
| openSUSE Tumbleweed | rubygem-activesupport-4_2 | 5.0.0.1-1.1 |