Cross-site scripting (XSS) vulnerability in json/encoding.rb in Active Support in Ruby on Rails 3.x and 4.1.x before 4.1.11 and 4.2.x before 4.2.2 allows remote attackers to inject arbitrary web script or HTML via a crafted Hash that is mishandled during JSON encoding.

Multiple security issues have been discovered in the Ruby on Rails web application development framework, which may result in denial of service, cross-site scripting, information disclosure or bypass of input validation.

Fixes for :

CVE-2015-3226 Escape HTML entities in JSON keys

CVE-2015-3227 XML documents that are too deep can cause an stack overflow, which in turn will cause a potential DoS attack.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ruby on Rails blog :

Rails 3.2.22, 4.1.11 and 4.2.2 have been released, along with web console and jquery-rails plugins and Rack 1.5.4 and 1.6.2.

ID	Name	Product	Family	Severity
88499	Debian DSA-3464-1 : rails - security update	Nessus	Debian Local Security Checks	high
84479	Fedora 21 : rubygem-activesupport-4.1.5-2.fc21 (2015-10545)	Nessus	Fedora Local Security Checks	medium
84478	Fedora 22 : rubygem-activesupport-4.2.0-2.fc22 (2015-10538)	Nessus	Fedora Local Security Checks	medium
84255	FreeBSD : rubygem-rails -- multiple vulnerabilities (eb8a8978-8dd5-49ce-87f4-49667b2166dd)	Nessus	FreeBSD Local Security Checks	medium

Detections

Analytics

CVE-2015-3226

medium

Tenable Plugins

high

medium

medium

medium