A Broken Access Control vulnerability in Active Job versions >= 4.2.0 allows an attacker to craft user input which can cause Active Job to deserialize it using GlobalId and give them access to information that they should not have. This vulnerability has been fixed in versions 4.2.11, 5.0.7.1, 5.1.6.1, and 5.2.1.1.

The remote Redhat Enterprise Linux 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2019:0600 advisory.

    Red Hat CloudForms Management Engine delivers the insight, control, and automation needed to address the     challenges of managing virtual environments. CloudForms Management Engine is built on Ruby on Rails, a     model-view-controller (MVC) framework for web application development. Action Pack implements the     controller and the view components.

    Security Fix(es):

    * activejob: Information Exposure through deserialization using GlobalId (CVE-2018-16476)

    For more details about the security issue(s), including the impact, a CVSS score, and other related     information, refer to the CVE page(s) listed in the References section.

    Additional Changes:

    This update fixes various bugs and adds enhancements. Documentation for these changes is available from     the Release Notes document linked to in the References section.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

This update for rubygem-activejob-5_1 fixes the following issues :

Security issue fixed :

  - CVE-2018-16476: Fixed broken access control     vulnerability (bsc#1117632).

This update was imported from the SUSE:SLE-15:Update update project.

Fix information exposure through deserialization using GlobalId (CVE-2018-16476).

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora update system website.
Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Gitlab reports :

Remote Command Execution via GitLab Pages

Covert Redirect to Steal GitHub/Bitbucket Tokens

Remote Mirror Branches Leaked by Git Transfer Refs

Denial of Service with Markdown

Guests Can View List of Group Merge Requests

Guest Can View Merge Request Titles via System Notes

Persistent XSS via KaTeX

Emails Sent to Unauthorized Users

Hyperlink Injection in Notification Emails

Unauthorized Access to LFS Objects

Trigger Token Exposure

Upgrade Rails to 5.0.7.1 and 4.2.11

Contributed Project Information Visible in Private Profile

Imported Project Retains Prior Visibility Setting

Error disclosure on Project Import

Persistent XSS in User Status

Last Commit Status Leaked to Guest Users

Mitigations for IDN Homograph and RTLO Attacks

Access to Internal Wiki When External Wiki Enabled

User Can Comment on Locked Project Issues

Unauthorized Reaction Emojis by Guest Users

User Retains Project Role After Removal from Private Group

GitHub Token Leaked to Maintainers

Unauthenticated Blind SSRF in Jira Integration

Unauthorized Access to Group Membership

Validate SAML Response in Group SAML SSO

This update for rubygem-activejob-5_1 fixes the following issues :

Security issue fixed :

CVE-2018-16476: Fixed broken access control vulnerability (bsc#1117632).

Note that Tenable Network Security has extracted the preceding description block directly from the SUSE security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Ruby on Rails blog :

Rails 4.2.11, 5.0.7.1, 5.1.6.1 and 5.2.1.1 have been released! These contain the following important security fixes, and it is recommended that users upgrade as soon as possible

CVE-2018-16476 Broken Access Control vulnerability in Active Job :
Carefully crafted user input can cause Active Job to deserialize it using GlobalId and allow an attacker to have access to information that they should not have.

ID	Name	Product	Family	Severity
193987	RHEL 7 : CloudForms 4.6.9 (RHSA-2019:0600)	Nessus	Red Hat Local Security Checks	high
123400	openSUSE Security Update : rubygem-activejob-5_1 (openSUSE-2019-982)	Nessus	SuSE Local Security Checks	high
122437	Fedora 28 : rubygem-activejob (2019-31e6f6e545)	Nessus	Fedora Local Security Checks	high
121522	FreeBSD : Gitlab -- Multiple vulnerabilities (467b7cbe-257d-11e9-8573-001b217b3468)	Nessus	FreeBSD Local Security Checks	critical
120178	SUSE SLED15 / SLES15 Security Update : rubygem-activejob-5_1 (SUSE-SU-2018:3996-1)	Nessus	SuSE Local Security Checks	high
119538	openSUSE Security Update : rubygem-activejob-5_1 (openSUSE-2018-1502)	Nessus	SuSE Local Security Checks	high
119317	FreeBSD : Rails -- Active Job vulnerability (f96044a2-7df9-414b-9f6b-6e5b85d06c86)	Nessus	FreeBSD Local Security Checks	high

Detections

Analytics

CVE-2018-16476

high

Tenable Plugins

high

high

high

critical

high

high

high