CVE-2012-1098

NameCVE-2012-1098
DescriptionCross-site scripting (XSS) vulnerability in Ruby on Rails 3.0.x before 3.0.12, 3.1.x before 3.1.4, and 3.2.x before 3.2.2 allows remote attackers to inject arbitrary web script or HTML via vectors involving a SafeBuffer object that is manipulated through certain methods.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, bugtraq, EDB, Metasploit, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, Mageia, GitHub advisories/code/issues, web search, more)
Debian Bugs668977

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
rails (PTS)buster2:5.2.2.1+dfsg-1+deb10u3fixed
buster (security)2:5.2.2.1+dfsg-1+deb10u5fixed
bullseye (security), bullseye2:6.0.3.7+dfsg-2+deb11u2fixed
bookworm, sid2:6.1.7.3+dfsg-1fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
railssourcesqueeze(not affected)
railssource(unstable)2.3.14
ruby-actionpack-2.3source(unstable)2.3.14-3668977

Notes

[squeeze] - rails <not-affected> (Vulnerable code not present)
(code lives within ruby-actionpack in unstable)
Search for package or bug name: Reporting problems