Description: "In actionpack gem >= 6.0.0, a possible XSS vulnerability exists when an application is running in development mode allowing an attacker to send or embed (in another page) a specially crafted URL which can allow the attacker to execute JavaScript in the context of the local application. This vulnerability is in the Actionable Exceptions middleware." See also: https://groups.google.com/g/rubyonrails-security/c/yQzUVfv42jk/m/oJWw-xhNAQAJ
Unable to check for sanity: > no match for package: dev-ruby/actionpack-6.0.34
Sanity check failed: > dev-ruby/actionpack-6.0.3.4 > bdepend amd64 dev profile default/linux/amd64/17.0/no-multilib/prefix/kernel-3.2+ (3 total) > ~dev-ruby/actionview-6.0.3.4[ruby_targets_ruby25(-)] > ~dev-ruby/actionview-6.0.3.4[ruby_targets_ruby26(-)] > ~dev-ruby/activemodel-6.0.3.4[ruby_targets_ruby25(-)] > ~dev-ruby/activemodel-6.0.3.4[ruby_targets_ruby26(-)] > ~dev-ruby/activesupport-6.0.3.4[ruby_targets_ruby25(-)] > ~dev-ruby/activesupport-6.0.3.4[ruby_targets_ruby26(-)] > ~dev-ruby/railties-6.0.3.4[ruby_targets_ruby25(-)] > ~dev-ruby/railties-6.0.3.4[ruby_targets_ruby26(-)] > bdepend amd64 stable profile default/linux/amd64/17.1 (14 total) > ~dev-ruby/actionview-6.0.3.4[ruby_targets_ruby25(-)] > ~dev-ruby/actionview-6.0.3.4[ruby_targets_ruby26(-)] > ~dev-ruby/activemodel-6.0.3.4[ruby_targets_ruby25(-)] > ~dev-ruby/activemodel-6.0.3.4[ruby_targets_ruby26(-)] > ~dev-ruby/activesupport-6.0.3.4[ruby_targets_ruby25(-)] > ~dev-ruby/activesupport-6.0.3.4[ruby_targets_ruby26(-)] > ~dev-ruby/railties-6.0.3.4[ruby_targets_ruby25(-)] > ~dev-ruby/railties-6.0.3.4[ruby_targets_ruby26(-)] > rdepend amd64 dev profile default/linux/amd64/17.0/no-multilib/prefix/kernel-3.2+ (3 total) > ~dev-ruby/actionview-6.0.3.4[ruby_targets_ruby25(-)] > ~dev-ruby/actionview-6.0.3.4[ruby_targets_ruby26(-)] > ~dev-ruby/activesupport-6.0.3.4[ruby_targets_ruby25(-)] > ~dev-ruby/activesupport-6.0.3.4[ruby_targets_ruby26(-)] > rdepend amd64 stable profile default/linux/amd64/17.1 (14 total) > ~dev-ruby/actionview-6.0.3.4[ruby_targets_ruby25(-)] > ~dev-ruby/actionview-6.0.3.4[ruby_targets_ruby26(-)] > ~dev-ruby/activesupport-6.0.3.4[ruby_targets_ruby25(-)] > ~dev-ruby/activesupport-6.0.3.4[ruby_targets_ruby26(-)]
Not sure what the point of the package list is here. There are no vulnerable versions in the tree anymore so it looks like we are done here.
(In reply to Hans de Graaff from comment #3) > Not sure what the point of the package list is here. There are no vulnerable > versions in the tree anymore so it looks like we are done here. Sorry, you're right, only 6.x is vulnerable anyway. Thank you.
