activestorage (RubyGems)
Advisories
30
Latest version
—
License
—
OpenSSF Scorecard
—
How to fix
Upgrading to 8.1.3.1 or later clears every advisory below that has a fix.
Upgrade commands
bundler
bundle update activestorage # Gemfile: gem "activestorage", ">= 8.1.3.1"Known vulnerabilities
| Advisory | Severity | Affected | Fixed in |
|---|---|---|---|
| GHSA-xr9x-r78c-5hrm Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing |
Critical EPSS 30.07% |
< 7.2.3.2 | 7.2.3.2 |
| GHSA-xr9x-r78c-5hrm Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing |
Critical EPSS 30.07% |
>= 8.0.0.beta1, < 8.0.5.1 | 8.0.5.1 |
| GHSA-xr9x-r78c-5hrm Active Storage has possible arbitrary file read and remote code execution in Active Storage variant processing |
Critical EPSS 30.07% |
>= 8.1.0.beta1, < 8.1.3.1 | 8.1.3.1 |
| GHSA-p9fm-f462-ggrg Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests |
Medium EPSS 0.45% |
< 7.2.3.1 | 7.2.3.1 |
| GHSA-p9fm-f462-ggrg Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests |
Medium EPSS 0.45% |
>= 8.1.0, < 8.1.2.1 | 8.1.2.1 |
| GHSA-p9fm-f462-ggrg Rails Active Storage has a possible DoS vulnerability in proxy mode via multi-range requests |
Medium EPSS 0.45% |
>= 8.0.0, < 8.0.4.1 | 8.0.4.1 |
| GHSA-73f9-jhhh-hr5m Rails Active Storage has possible glob injection in its DiskService |
Critical EPSS 0.67% |
>= 8.1.0.beta1, < 8.1.2.1 | 8.1.2.1 |
| GHSA-73f9-jhhh-hr5m Rails Active Storage has possible glob injection in its DiskService |
Critical EPSS 0.67% |
< 7.2.3.1 | 7.2.3.1 |
| GHSA-73f9-jhhh-hr5m Rails Active Storage has possible glob injection in its DiskService |
Critical EPSS 0.67% |
>= 8.0.0.beta1, < 8.0.4.1 | 8.0.4.1 |
| GHSA-9xrj-h377-fr87 Rails Active Storage has possible Path Traversal in DiskService |
Critical EPSS 0.58% |
< 7.2.3.1 | 7.2.3.1 |
| GHSA-9xrj-h377-fr87 Rails Active Storage has possible Path Traversal in DiskService |
Critical EPSS 0.58% |
>= 8.0.0.beta1, < 8.0.4.1 | 8.0.4.1 |
| GHSA-9xrj-h377-fr87 Rails Active Storage has possible Path Traversal in DiskService |
Critical EPSS 0.58% |
>= 8.1.0.beta1, < 8.1.2.1 | 8.1.2.1 |
| GHSA-r46p-8f7g-vvvg Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests |
High EPSS 0.62% |
< 7.2.3.1 | 7.2.3.1 |
| GHSA-r46p-8f7g-vvvg Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests |
High EPSS 0.62% |
>= 8.1.0.beta1, < 8.1.2.1 | 8.1.2.1 |
| GHSA-r46p-8f7g-vvvg Rails Active Storage has a possible DoS vulnerability when in proxy mode via Range requests |
High EPSS 0.62% |
>= 8.0.0.beta1, < 8.0.4.1 | 8.0.4.1 |
| GHSA-qcfx-2mfw-w4cg Rails Active Storage has possible content type bypass via metadata in direct uploads |
Medium EPSS 0.40% |
< 7.2.3.1 | 7.2.3.1 |
| GHSA-qcfx-2mfw-w4cg Rails Active Storage has possible content type bypass via metadata in direct uploads |
Medium EPSS 0.40% |
>= 8.1.0.beta1, < 8.1.2.1 | 8.1.2.1 |
| GHSA-qcfx-2mfw-w4cg Rails Active Storage has possible content type bypass via metadata in direct uploads |
Medium EPSS 0.40% |
>= 8.0.0.beta1, < 8.0.4.1 | 8.0.4.1 |
| GHSA-r4mg-4433-c7g3 Active Storage allowed transformation methods that were potentially unsafe |
High EPSS 5.58% |
>= 5.2.0, < 7.1.5.2 | 7.1.5.2 |
| GHSA-r4mg-4433-c7g3 Active Storage allowed transformation methods that were potentially unsafe |
High EPSS 5.58% |
>= 7.2, < 7.2.2.2 | 7.2.2.2 |
| GHSA-r4mg-4433-c7g3 Active Storage allowed transformation methods that were potentially unsafe |
High EPSS 5.58% |
>= 8.0, < 8.0.2.1 | 8.0.2.1 |
| GHSA-8h22-8cf7-hq6g Rails has possible Sensitive Session Information Leak in Active Storage |
Medium EPSS 1.12% |
>= 5.2.0, < 6.1.7.7 | 6.1.7.7 |
| GHSA-8h22-8cf7-hq6g Rails has possible Sensitive Session Information Leak in Active Storage |
Medium EPSS 1.12% |
>= 7.0.0, < 7.0.8.1 | 7.0.8.1 |
| GHSA-w749-p3v6-hccq Possible code injection vulnerability in Rails / Active Storage |
Critical EPSS 3.10% |
>= 5.2.0, < 5.2.6.3 | 5.2.6.3 |
| GHSA-w749-p3v6-hccq Possible code injection vulnerability in Rails / Active Storage |
Critical EPSS 3.10% |
>= 6.0.0, < 6.0.4.7 | 6.0.4.7 |
| GHSA-w749-p3v6-hccq Possible code injection vulnerability in Rails / Active Storage |
Critical EPSS 3.10% |
>= 6.1.0, < 6.1.4.7 | 6.1.4.7 |
| GHSA-w749-p3v6-hccq Possible code injection vulnerability in Rails / Active Storage |
Critical EPSS 3.10% |
>= 7.0.0, < 7.0.2.3 | 7.0.2.3 |
| GHSA-m42x-37p3-fv5w Circumvention of file size limits in ActiveStorage |
High EPSS 3.03% |
>= 5.0.0, < 5.2.4.3 | 5.2.4.3 |
| GHSA-m42x-37p3-fv5w Circumvention of file size limits in ActiveStorage |
High EPSS 3.03% |
>= 6.0.0, < 6.0.3.1 | 6.0.3.1 |
| GHSA-7rr7-rcjw-56vj Exposure of Sensitive Information to an Unauthorized Actor in activestorage |
Medium EPSS 1.31% |
>= 5.2.0, < 5.2.1.1 | 5.2.1.1 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor