Allocation of Resources Without Limits or Throttling

Overview Affected versions of this package are vulnerable to Allocation of Resources Without Limits or Throttling in the proxy controller when processing HTTP requests containing a large number of byte ranges in the Range header. An attacker can cause excessive CPU usage by sending requests with...

Glob Injection

Overview Affected versions of this package are vulnerable to Glob Injection via the DiskServicedeleteprefixed function. An attacker can delete unintended files from the storage directory by supplying blob keys containing glob metacharacters that are passed unescaped to Dir.glob. Remediation Upgra...

Memory Allocation with Excessive Size Value

Overview Affected versions of this package are vulnerable to Memory Allocation with Excessive Size Value in the Blobs::ProxyController. An attacker can exhaust server memory by sending requests with large or unbounded range headers. Remediation Upgrade activestorage to version 7.2.3.1, 8.0.4.1,...

Improper Handling of Values

Overview Affected versions of this package are vulnerable to Improper Handling of Values in the DirectUploadsController. A malicious direct-upload client can set contenttype flags like identified and analyzed to make a malicious uploaded file appear safe. Remediation Upgrade activestorage to...

ruby4.0-rubygem-activestorage-8.0-8.0.3-1.3 on GA media (moderate)

ruby4.0-rubygem-activestorage-8.0-8.0.3-1.3 on GA media Announcement ID: openSUSE-SU-2026:10344-1 Rating: moderate Cross-References: CVE-2024-54133 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed...

OPENSUSE-SU-2026:10344-1 ruby4.0-rubygem-activestorage-8.0-8.0.3-1.3 on GA media

These are all security issues fixed in the ruby4.0-rubygem-activestorage-8.0-8.0.3-1.3 package on the GA media of openSUSE Tumbleweed...

MAL-2025-192894 Malicious code in activestorage-redundancy (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

Malicious code in activestorage-redundancy (RubyGems)

--- -= Per source details. Do not edit below this line.=-...

EUVD-2020-0430

Malware in sbrugna...

Command Injection

activestorage is vulnerable to command injection. The vulnerability is due to unsafe defaults in the allowed list of image transformation methods, which allows an attacker to supply arbitrary input and execute malicious commands...

Linux Distros Unpatched Vulnerability : CVE-2020-8162

The Linux/Unix host has one or more packages installed that are impacted by a vulnerability without a vendor supplied patch available. - A client side enforcement of server side security vulnerability exists in rails 5.2.4.2 and rails 6.0.3.1 ActiveStorage's S3 adapter that allows the...

Arbitrary Command Injection

Overview Affected versions of this package are vulnerable to Arbitrary Command Injection due to untrusted user input being accepted as transformation methods or parameters. An attacker can execute arbitrary commands on the server by supplying crafted input that circumvents safe defaults. Note: Th...

ruby3.4-rubygem-activestorage-8.0-8.0.1-1.1 on GA media (moderate)

ruby3.4-rubygem-activestorage-8.0-8.0.1-1.1 on GA media Announcement ID: openSUSE-SU-2025:14677-1 Rating: moderate Cross-References: CVE-2024-54133 Affected Products: openSUSE Tumbleweed An update that solves one vulnerability can now be installed. Description: These are all security issues fixed...

OPENSUSE-SU-2025:14677-1 ruby3.4-rubygem-activestorage-8.0-8.0.1-1.1 on GA media

These are all security issues fixed in the ruby3.4-rubygem-activestorage-8.0-8.0.1-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:14070-1 ruby3.3-rubygem-activestorage-7.0-7.0.8.4-1.1 on GA media

These are all security issues fixed in the ruby3.3-rubygem-activestorage-7.0-7.0.8.4-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11329-1 ruby2.7-rubygem-activestorage-6.0-6.0.4-1.2 on GA media

These are all security issues fixed in the ruby2.7-rubygem-activestorage-6.0-6.0.4-1.2 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11827-1 ruby3.1-rubygem-activestorage-6.0-6.0.4.4-1.1 on GA media

These are all security issues fixed in the ruby3.1-rubygem-activestorage-6.0-6.0.4.4-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:12880-1 ruby3.2-rubygem-activestorage-7.0-7.0.4.3-1.1 on GA media

These are all security issues fixed in the ruby3.2-rubygem-activestorage-7.0-7.0.4.3-1.1 package on the GA media of openSUSE Tumbleweed...

OPENSUSE-SU-2024:11903-1 ruby3.1-rubygem-activestorage-7.0-7.0.2.3-1.1 on GA media

These are all security issues fixed in the ruby3.1-rubygem-activestorage-7.0-7.0.2.3-1.1 package on the GA media of openSUSE Tumbleweed...

Session Token Disclosure

activestorage is vulnerable to Sensitive Information Disclosure. The vulnerability is due to the Set-Cookie header getting cached when serving blobs if Rails is behind a proxy. Certain proxies may cache the Set-Cookie header, which can result in a users session being disclosed to another user...