GHSA-46j2-xjgp-jrfm

Information disclosure issue in Active Resource

Source: GitHub Advisory Database (reviewed) High CVE-2020-8151

Packages

Ecosystem	Package	Affected	Fixed in
RubyGems	activeresource	>= 3.0.0.rc, < 5.1.1	5.1.1

Details

As written in the advisory (Markdown source, shown as plain text).

There is a possible information disclosure issue in Active Resource <v5.1.1 that could allow an attacker to create specially crafted requests to access data in an unexpected way and possibly leak information.

References

External links from the advisory. They lead to third-party sites.

https://nvd.nist.gov/vuln/detail/CVE-2020-8151 advisory
https://github.com/rails/activeresource/commit/0de18f7e96fa90bbf23b16ac11980bc2cb6a716e web
https://github.com/rails/rails/commit/0e969bdaf8ff2e3384350687aa0b583f94d6dfbc web
https://github.com/rails/activeresource package
https://groups.google.com/forum/#!topic/rubyonrails-security/pktoF4VmiM8 web
https://lists.fedoraproject.org/archives/list/[email protected]/message/P7B7A4H22DZ522HLDS3JX3NX2CXIOZSR web