CVE-2010-3299 (Medium) detected in rails-3.0.9.gem
mend-bolt-for-github opened this issue · comments
CVE-2010-3299 - Medium Severity Vulnerability
Vulnerable Library - rails-3.0.9.gem
Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.
Library home page: https://rubygems.org/gems/rails-3.0.9.gem
Dependency Hierarchy:
- ❌ rails-3.0.9.gem (Vulnerable Library)
Found in HEAD commit: 0c785fd9400921392b8ee5e3e166f30364359ecc
Found in base branch: master
Vulnerability Details
The encrypt/decrypt functions in Ruby on Rails 2.3 are vulnerable to padding oracle attacks.
Publish Date: 2019-11-12
URL: CVE-2010-3299
CVSS 3 Score Details (6.5)
Base Score Metrics:
- Exploitability Metrics:
- Attack Vector: Network
- Attack Complexity: Low
- Privileges Required: None
- User Interaction: Required
- Scope: Unchanged
- Impact Metrics:
- Confidentiality Impact: High
- Integrity Impact: None
- Availability Impact: None
Suggested Fix
Type: Upgrade version
Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-3299
Release Date: 2019-11-12
Fix Resolution: rails - 5.2.0.beta1
Step up your Open Source Security Game with WhiteSource here