PT-2016-5662 · Ruby · Safemode

Ivan Necas · Published 2016-05-20 · Updated 2023-02-12 · CVE-2016-3693

Positive Technologies (AI Summary)

CVSS v3.1

8.1

High

Base vector

AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Safemode gem versions prior to 1.2.4

Description The issue allows context-dependent attackers to obtain sensitive information via the inspect method when the Safemode gem is initialized with a delegate object that is a Rails controller.

Recommendations For versions prior to 1.2.4, update to version 1.2.4 or later to resolve the issue. As a temporary workaround, consider restricting access to the inspect method when the delegate object is a Rails controller until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-264

CWE-200

Related Identifiers

CVE-2016-3693

GHSA-44VC-FPCG-5CC5

GHSA-C92M-RRRC-Q5WF

RHSA-2018:0336

Affected Products

Safemode

References · 14

• http://rubysec.com/advisories/CVE-2016-3693 · Vendor Advisory
• https://access.redhat.com/errata/RHSA-2018:0336 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-3693 · Security Note
• https://osv.dev/vulnerability/GHSA-c92m-rrrc-q5wf · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-44vc-fpcg-5cc5 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-3693 · Vendor Advisory
• https://github.com/theforeman/foreman/commit/82f9b93c54f72c5814df6bab7fad057eab65b2f2 · Note
• https://github.com/svenfuchs/safemode · Note
• https://github.com/svenfuchs/safemode/commit/0f764a1720a3a68fd2842e21377c8bfad6d7126f · Note
• https://t.me/cvenotify/43452 · Telegram Post
• http://openwall.com/lists/oss-security/2016/04/20/8 · Note
• http://theforeman.org/security.html#2016-3693 · Note
• http://projects.theforeman.org/issues/14635 · Note
• https://github.com/advisories/GHSA-44vc-fpcg-5cc5 · Note