CVE-2024-32464

NameCVE-2024-32464
DescriptionAction Text brings rich text content and editing to Rails. Instances of ActionText::Attachable::ContentAttachment included within a rich_text_area tag could potentially contain unsanitized HTML. This vulnerability is fixed in 7.1.3.4 and 7.2.0.beta2.
SourceCVE (at NVD; CERT, ENISA, LWN, oss-sec, fulldisc, Debian ELTS, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)

Vulnerable and fixed packages

The table below lists information on source packages.

Source PackageReleaseVersionStatus
rails (PTS)bookworm, bookworm (security)2:6.1.7.10+dfsg-1~deb12u2fixed
trixie (security), trixie2:7.2.2.2+dfsg-2~deb13u1fixed
forky, sid2:7.2.3.2+dfsg-2fixed

The information below is based on the following data on fixed versions.

PackageTypeReleaseFixed VersionUrgencyOriginDebian Bugs
railssource(unstable)(not affected)

Notes

- rails <not-affected> (Only affects 7.1.x)
https://github.com/rails/rails/security/advisories/GHSA-prjp-h48f-jgf6
https://github.com/rails/rails/commit/e215bf3360e6dfe1497c1503a495e384ed6b0995
Search for package or bug name: Reporting problems