CVE-2024-54133
Fixed in a distro release EPSS 1%CVSS 2.3
Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
Products: rails
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | actionpack | 7.0.8.7 |
| RubyGems | actionpack | 7.1.5.1 |
| RubyGems | actionpack | 7.2.2.1 |
| RubyGems | actionpack | 8.0.0.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 11 | rails | 2:6.0.3.7+dfsg-2+deb11u3 |
| Debian 12 | rails | 2:6.1.7.10+dfsg-1~deb12u1 |
| Debian 13 | rails | 2:7.2.2.1+dfsg-1 |
| Debian 14 | rails | 2:7.2.2.1+dfsg-1 |
| Ubuntu 24.04 LTS | rails | no fix |
| Ubuntu 25.10 | rails | no fix |
| Ubuntu 26.04 LTS | rails | no fix |
| Ubuntu 26.10 | rails | no fix |
| Ubuntu Pro 16.04 LTS | rails | no fix |
| Ubuntu Pro 18.04 LTS | rails | no fix |
| Ubuntu Pro 20.04 LTS | rails | no fix |
| Ubuntu Pro 22.04 LTS | rails | no fix |
| openSUSE Tumbleweed | rubygem-actioncable-8.0 | 8.0.1-1.1 |
| openSUSE Tumbleweed | rubygem-actioncable-8.0 | 8.0.3-1.3 |
| openSUSE Tumbleweed | rubygem-actionmailbox-8.0 | 8.0.1-1.1 |
| openSUSE Tumbleweed | rubygem-actionmailbox-8.0 | 8.0.3-1.3 |
| openSUSE Tumbleweed | rubygem-actionmailer-8.0 | 8.0.1-1.1 |
| openSUSE Tumbleweed | rubygem-actionmailer-8.0 | 8.0.3-1.3 |
| openSUSE Tumbleweed | rubygem-actionpack-8.0 | 8.0.1-1.1 |
| openSUSE Tumbleweed | rubygem-actionpack-8.0 | 8.0.3-1.3 |
| openSUSE Tumbleweed | rubygem-actiontext-8.0 | 8.0.1-1.1 |
| openSUSE Tumbleweed | rubygem-actiontext-8.0 | 8.0.3-1.3 |
| openSUSE Tumbleweed | rubygem-actionview-8.0 | 8.0.1-1.1 |
| openSUSE Tumbleweed | rubygem-actionview-8.0 | 8.0.3-1.3 |
| openSUSE Tumbleweed | rubygem-activejob-8.0 | 8.0.1-1.1 |
| openSUSE Tumbleweed | rubygem-activejob-8.0 | 8.0.3-1.3 |
| openSUSE Tumbleweed | rubygem-activemodel-8.0 | 8.0.3-1.3 |
| openSUSE Tumbleweed | rubygem-activemodel-8.0 | 8.0.1-1.1 |
| openSUSE Tumbleweed | rubygem-activerecord-8.0 | 8.0.3-1.3 |
| openSUSE Tumbleweed | rubygem-activerecord-8.0 | 8.0.1-1.1 |
| openSUSE Tumbleweed | rubygem-activestorage-8.0 | 8.0.1-1.1 |
| openSUSE Tumbleweed | rubygem-activestorage-8.0 | 8.0.3-1.3 |
| openSUSE Tumbleweed | rubygem-activesupport-8.0 | 8.0.3-1.3 |
| openSUSE Tumbleweed | rubygem-activesupport-8.0 | 8.0.1-1.1 |
| openSUSE Tumbleweed | rubygem-rails-8.0 | 8.0.1-1.1 |
| openSUSE Tumbleweed | rubygem-rails-8.0 | 8.0.3-1.3 |
| openSUSE Tumbleweed | rubygem-railties-8.0 | 8.0.1-1.1 |
| openSUSE Tumbleweed | rubygem-railties-8.0 | 8.0.3-1.3 |