CVE-2015-3226

NameCVE-2015-3226
DescriptionCross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding.
SourceCVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
ReferencesDSA-3464-1
Debian Bugs790486

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
rails (PTS)buster2:5.2.2.1+dfsg-1+deb10u3fixed
buster (security)2:5.2.2.1+dfsg-1+deb10u5fixed
bullseye (security), bullseye2:6.0.3.7+dfsg-2+deb11u2fixed
bookworm2:6.1.7.3+dfsg-1fixed
sid, trixie2:6.1.7.3+dfsg-3fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
railssourcesqueeze(unfixed)end-of-life
railssourcewheezy(not affected)
railssourcejessie2:4.1.8-1+deb8u1DSA-3464-1
railssource(unstable)2:4.2.4-2790486
ruby-activesupport-2.3sourcewheezy(unfixed)end-of-life
ruby-activesupport-2.3source(unstable)(unfixed)
ruby-activesupport-3.2sourcewheezy(not affected)
ruby-activesupport-3.2source(unstable)(unfixed)

Notes

[squeeze] - rails <end-of-life> (Unsupported in squeeze-lts)
[wheezy] - rails <not-affected> (Vulnerable code not present, is only a transitional package)
[wheezy] - ruby-activesupport-3.2 <not-affected> (Vulnerable code not present)
[wheezy] - ruby-activesupport-2.3 <end-of-life> (https://lists.debian.org/debian-security-announce/2014/msg00164.html)

Search for package or bug name: Reporting problems