CVE-2018-16476
Fixed in a distro release EPSS 3%
A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1.
Products: rubyonrails rails, redhat cloudforms
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | activejob | 4.2.11 |
| RubyGems | activejob | 5.0.7.1 |
| RubyGems | activejob | 5.1.6.1 |
| RubyGems | activejob | 5.2.1.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | rails | 2:5.2.2+dfsg-1 |
| Debian 13 | rails | 2:5.2.2+dfsg-1 |
| Debian 14 | rails | 2:5.2.2+dfsg-1 |
| Red Hat cloudforms managementengine 5.9 | cfme | 0:5.9.9.1-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-amazon-smartstate | 0:5.9.9.1-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-appliance | 0:5.9.9.1-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-appliance-common | 0:5.9.9.1-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-appliance-debuginfo | 0:5.9.9.1-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-appliance-tools | 0:5.9.9.1-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-debuginfo | 0:5.9.9.1-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-gemset | 0:5.9.9.1-1.el7cf |
| Red Hat cloudforms managementengine 5.9 | cfme-gemset-debuginfo | 0:5.9.9.1-1.el7cf |
| SUSE Enterprise Storage 4 | rubygem-activejob-4_2 | 4.2.9-3.6.1 |
| SUSE Linux Enterprise High Availability Extension 15 | rubygem-activejob-5_1 | 5.1.4-3.3.1 |
| SUSE OpenStack Cloud 7 | rubygem-activejob-4_2 | 4.2.9-3.6.1 |
| SUSE OpenStack Cloud Crowbar 8 | rubygem-activejob-4_2 | 4.2.9-3.6.1 |
| Ubuntu Pro 16.04 LTS | rails | no fix |
| Ubuntu Pro 18.04 LTS | rails | no fix |
| Ubuntu Pro 20.04 LTS | rails | no fix |
| Ubuntu Pro 22.04 LTS | rails | no fix |