CVE catalog
CVE-2024-54133
rails: CVE-2024-54133
- Severity
- Medium · CVSS 4.3
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N - Published
- Source
- [NVD] · [CVE record]
- EPSS
- 1.00% · Oct 25, 2026
Action Pack is a framework for handling and responding to web requests. There is a possible Cross Site Scripting (XSS) vulnerability in the `content_security_policy` helper starting in version 5.2.0 of Action Pack and prior to versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1. Applications which set Content-Security-Policy (CSP) headers dynamically from untrusted user input may be vulnerable to carefully crafted inputs being able to inject new directives into the CSP. This could lead to a bypass of the CSP and its protection against XSS and other attacks. Versions 7.0.8.7, 7.1.5.1, 7.2.2.1, and 8.0.0.1 contain a fix. As a workaround, applications can avoid setting CSP headers dynamically from untrusted input, or can validate/sanitize that input.
Vulnerable and fixed packages
Distribution-reported package versions and fixes. These do not depend on matching against the OpenFactory package catalog.
| Distribution | Package | Release | Version | Status |
|---|---|---|---|---|
| Debian | rails | sid | 2:7.2.4+dfsg-2 | fixed |
| Debian | rails | forky | 2:7.2.4+dfsg-1 | fixed |
| Debian | rails | trixie | 2:7.2.2.2+dfsg-2~deb13u1 | fixed |
| Debian | rails | trixie-security | 2:7.2.2.2+dfsg-2~deb13u2 | fixed |
| Debian | rails | bookworm | 2:6.1.7.10+dfsg-1~deb12u2 | fixed |
| Debian | rails | bookworm-security | 2:6.1.7.10+dfsg-1~deb12u3 | fixed |
| Opensuse | rubygem-actionmailer-8.0 | tumbleweed | 8.0.3-1.3 | fixed |
| Opensuse | rubygem-activemodel-8.0 | tumbleweed | 8.0.3-1.3 | fixed |
| Opensuse | rubygem-actionview-8.0 | tumbleweed | 8.0.3-1.3 | fixed |
| Opensuse | rubygem-actionpack-8.0 | tumbleweed | 8.0.3-1.3 | fixed |
| Opensuse | rubygem-activerecord-8.0 | tumbleweed | 8.0.3-1.3 | fixed |
| Opensuse | rubygem-actioncable-8.0 | tumbleweed | 8.0.3-1.3 | fixed |
| Opensuse | rubygem-activesupport-8.0 | tumbleweed | 8.0.3-1.3 | fixed |
| Opensuse | rubygem-actionmailbox-8.0 | tumbleweed | 8.0.3-1.3 | fixed |
| Opensuse | rubygem-activejob-8.0 | tumbleweed | 8.0.3-1.3 | fixed |
| Opensuse | rubygem-activestorage-8.0 | tumbleweed | 8.0.3-1.3 | fixed |
| Opensuse | rubygem-actiontext-8.0 | tumbleweed | 8.0.3-1.3 | fixed |
| Opensuse | rubygem-rails-8.0 | tumbleweed | 8.0.3-1.3 | fixed |
| Opensuse | rubygem-railties-8.0 | tumbleweed | 8.0.3-1.3 | fixed |
| Opensuse | rubygem-actiontext-8.0 | tumbleweed | 8.0.1-1.1 | fixed |
| Opensuse | rubygem-actionview-8.0 | tumbleweed | 8.0.1-1.1 | fixed |
| Opensuse | rubygem-activestorage-8.0 | tumbleweed | 8.0.1-1.1 | fixed |
| Opensuse | rubygem-actionpack-8.0 | tumbleweed | 8.0.1-1.1 | fixed |
| Opensuse | rubygem-rails-8.0 | tumbleweed | 8.0.1-1.1 | fixed |
| Opensuse | rubygem-activesupport-8.0 | tumbleweed | 8.0.1-1.1 | fixed |
| Opensuse | rubygem-actionmailbox-8.0 | tumbleweed | 8.0.1-1.1 | fixed |
| Opensuse | rubygem-railties-8.0 | tumbleweed | 8.0.1-1.1 | fixed |
| Opensuse | rubygem-activerecord-8.0 | tumbleweed | 8.0.1-1.1 | fixed |
| Opensuse | rubygem-actioncable-8.0 | tumbleweed | 8.0.1-1.1 | fixed |
| Opensuse | rubygem-actionmailer-8.0 | tumbleweed | 8.0.1-1.1 | fixed |
| Opensuse | rubygem-activemodel-8.0 | tumbleweed | 8.0.1-1.1 | fixed |
| Opensuse | rubygem-activejob-8.0 | tumbleweed | 8.0.1-1.1 | fixed |
Fixed-version evidence
| Distribution | Package | Type | Release | Fixed version | Urgency | Origin | Bugs |
|---|---|---|---|---|---|---|---|
| Debian | rails | source | sid | 2:7.2.2.1+dfsg-1 | not yet assigned | Not reported | [1089755] |
| Debian | rails | source | forky | 2:7.2.2.1+dfsg-1 | not yet assigned | Not reported | [1089755] |
| Debian | rails | source | trixie | 2:7.2.2.1+dfsg-1 | not yet assigned | Not reported | [1089755] |
| Debian | rails | source | bookworm | 2:6.1.7.10+dfsg-1~deb12u1 | not yet assigned | Not reported | [1089755] |
| Opensuse | rubygem-actionmailer-8.0 | rpm | tumbleweed | 8.0.3-1.3 | Not reported | OPENSUSE-SU-2026:10337-1 | Not reported |
| Opensuse | rubygem-activemodel-8.0 | rpm | tumbleweed | 8.0.3-1.3 | Not reported | OPENSUSE-SU-2026:10342-1 | Not reported |
| Opensuse | rubygem-actionview-8.0 | rpm | tumbleweed | 8.0.3-1.3 | Not reported | OPENSUSE-SU-2026:10340-1 | Not reported |
| Opensuse | rubygem-actionpack-8.0 | rpm | tumbleweed | 8.0.3-1.3 | Not reported | OPENSUSE-SU-2026:10338-1 | Not reported |
| Opensuse | rubygem-activerecord-8.0 | rpm | tumbleweed | 8.0.3-1.3 | Not reported | OPENSUSE-SU-2026:10343-1 | Not reported |
| Opensuse | rubygem-actioncable-8.0 | rpm | tumbleweed | 8.0.3-1.3 | Not reported | OPENSUSE-SU-2026:10335-1 | Not reported |
| Opensuse | rubygem-activesupport-8.0 | rpm | tumbleweed | 8.0.3-1.3 | Not reported | OPENSUSE-SU-2026:10345-1 | Not reported |
| Opensuse | rubygem-actionmailbox-8.0 | rpm | tumbleweed | 8.0.3-1.3 | Not reported | OPENSUSE-SU-2026:10336-1 | Not reported |
| Opensuse | rubygem-activejob-8.0 | rpm | tumbleweed | 8.0.3-1.3 | Not reported | OPENSUSE-SU-2026:10341-1 | Not reported |
| Opensuse | rubygem-activestorage-8.0 | rpm | tumbleweed | 8.0.3-1.3 | Not reported | OPENSUSE-SU-2026:10344-1 | Not reported |
| Opensuse | rubygem-actiontext-8.0 | rpm | tumbleweed | 8.0.3-1.3 | Not reported | OPENSUSE-SU-2026:10339-1 | Not reported |
| Opensuse | rubygem-rails-8.0 | rpm | tumbleweed | 8.0.3-1.3 | Not reported | OPENSUSE-SU-2026:10360-1 | Not reported |
| Opensuse | rubygem-railties-8.0 | rpm | tumbleweed | 8.0.3-1.3 | Not reported | OPENSUSE-SU-2026:10362-1 | Not reported |
| Opensuse | rubygem-actiontext-8.0 | rpm | tumbleweed | 8.0.1-1.1 | Not reported | OPENSUSE-SU-2025:14672-1 | Not reported |
| Opensuse | rubygem-actionview-8.0 | rpm | tumbleweed | 8.0.1-1.1 | Not reported | OPENSUSE-SU-2025:14673-1 | Not reported |
| Opensuse | rubygem-activestorage-8.0 | rpm | tumbleweed | 8.0.1-1.1 | Not reported | OPENSUSE-SU-2025:14677-1 | Not reported |
| Opensuse | rubygem-actionpack-8.0 | rpm | tumbleweed | 8.0.1-1.1 | Not reported | OPENSUSE-SU-2025:14671-1 | Not reported |
| Opensuse | rubygem-rails-8.0 | rpm | tumbleweed | 8.0.1-1.1 | Not reported | OPENSUSE-SU-2025:14679-1 | Not reported |
| Opensuse | rubygem-activesupport-8.0 | rpm | tumbleweed | 8.0.1-1.1 | Not reported | OPENSUSE-SU-2025:14678-1 | Not reported |
| Opensuse | rubygem-actionmailbox-8.0 | rpm | tumbleweed | 8.0.1-1.1 | Not reported | OPENSUSE-SU-2025:14669-1 | Not reported |
| Opensuse | rubygem-railties-8.0 | rpm | tumbleweed | 8.0.1-1.1 | Not reported | OPENSUSE-SU-2025:14680-1 | Not reported |
| Opensuse | rubygem-activerecord-8.0 | rpm | tumbleweed | 8.0.1-1.1 | Not reported | OPENSUSE-SU-2025:14676-1 | Not reported |
| Opensuse | rubygem-actioncable-8.0 | rpm | tumbleweed | 8.0.1-1.1 | Not reported | OPENSUSE-SU-2025:14668-1 | Not reported |
| Opensuse | rubygem-actionmailer-8.0 | rpm | tumbleweed | 8.0.1-1.1 | Not reported | OPENSUSE-SU-2025:14670-1 | Not reported |
| Opensuse | rubygem-activemodel-8.0 | rpm | tumbleweed | 8.0.1-1.1 | Not reported | OPENSUSE-SU-2025:14675-1 | Not reported |
| Opensuse | rubygem-activejob-8.0 | rpm | tumbleweed | 8.0.1-1.1 | Not reported | OPENSUSE-SU-2025:14674-1 | Not reported |
OpenFactory catalog packages
[openSUSE Tumbleweed]
- [ruby4.0-rubygem-actioncable-8.0]Unknown
Source package: [rubygem-actioncable-8.0]
Details (1)
8.0.5-1.2· x86_64 · tumbleweedUnknown · Fixed:
8.0.1-1.1, 8.0.3-1.3Version impact unknown
dsa · rubygem-actioncable-8.0 · opensuse · tumbleweed
- [ruby4.0-rubygem-actionmailbox-8.0]Unknown
Source package: [rubygem-actionmailbox-8.0]
Details (1)
8.0.5-1.2· x86_64 · tumbleweedUnknown · Fixed:
8.0.1-1.1, 8.0.3-1.3Version impact unknown
dsa · rubygem-actionmailbox-8.0 · opensuse · tumbleweed
- [ruby4.0-rubygem-actionmailer-8.0]Unknown
Source package: [rubygem-actionmailer-8.0]
Details (1)
8.0.5-1.2· x86_64 · tumbleweedUnknown · Fixed:
8.0.1-1.1, 8.0.3-1.3Version impact unknown
dsa · rubygem-actionmailer-8.0 · opensuse · tumbleweed
- [ruby4.0-rubygem-actionpack-8.0]Unknown
Source package: [rubygem-actionpack-8.0]
Details (1)
8.0.5-1.2· x86_64 · tumbleweedUnknown · Fixed:
8.0.1-1.1, 8.0.3-1.3Version impact unknown
dsa · rubygem-actionpack-8.0 · opensuse · tumbleweed
- [ruby4.0-rubygem-actiontext-8.0]Unknown
Source package: [rubygem-actiontext-8.0]
Details (1)
8.0.5-1.2· x86_64 · tumbleweedUnknown · Fixed:
8.0.1-1.1, 8.0.3-1.3Version impact unknown
dsa · rubygem-actiontext-8.0 · opensuse · tumbleweed
- [ruby4.0-rubygem-actionview-8.0]Unknown
Source package: [rubygem-actionview-8.0]
Details (1)
8.0.5-1.2· x86_64 · tumbleweedUnknown · Fixed:
8.0.1-1.1, 8.0.3-1.3Version impact unknown
dsa · rubygem-actionview-8.0 · opensuse · tumbleweed
- [ruby4.0-rubygem-activejob-8.0]Unknown
Source package: [rubygem-activejob-8.0]
Details (1)
8.0.5-1.2· x86_64 · tumbleweedUnknown · Fixed:
8.0.1-1.1, 8.0.3-1.3Version impact unknown
dsa · rubygem-activejob-8.0 · opensuse · tumbleweed
- [ruby4.0-rubygem-activemodel-8.0]Unknown
Source package: [rubygem-activemodel-8.0]
Details (1)
8.0.5-1.2· x86_64 · tumbleweedUnknown · Fixed:
8.0.1-1.1, 8.0.3-1.3Version impact unknown
dsa · rubygem-activemodel-8.0 · opensuse · tumbleweed
- [ruby4.0-rubygem-activerecord-8.0]Unknown
Source package: [rubygem-activerecord-8.0]
Details (1)
8.0.5-1.2· x86_64 · tumbleweedUnknown · Fixed:
8.0.1-1.1, 8.0.3-1.3Version impact unknown
dsa · rubygem-activerecord-8.0 · opensuse · tumbleweed
- [ruby4.0-rubygem-activestorage-8.0]Unknown
Source package: [rubygem-activestorage-8.0]
Details (1)
8.0.5-1.2· x86_64 · tumbleweedUnknown · Fixed:
8.0.1-1.1, 8.0.3-1.3Version impact unknown
dsa · rubygem-activestorage-8.0 · opensuse · tumbleweed
- [ruby4.0-rubygem-activesupport-8.0]Unknown
Source package: [rubygem-activesupport-8.0]
Details (1)
8.0.5-1.2· x86_64 · tumbleweedUnknown · Fixed:
8.0.1-1.1, 8.0.3-1.3Version impact unknown
dsa · rubygem-activesupport-8.0 · opensuse · tumbleweed
- [ruby4.0-rubygem-rails-8.0]Unknown
Source package: [rubygem-rails-8.0]
Details (1)
8.0.5-1.2· x86_64 · tumbleweedUnknown · Fixed:
8.0.1-1.1, 8.0.3-1.3Version impact unknown
dsa · rubygem-rails-8.0 · opensuse · tumbleweed
- [ruby4.0-rubygem-railties-8.0]Unknown
Source package: [rubygem-railties-8.0]
Details (1)
8.0.5-1.2· x86_64 · tumbleweedUnknown · Fixed:
8.0.1-1.1, 8.0.3-1.3Version impact unknown
dsa · rubygem-railties-8.0 · opensuse · tumbleweed
[Debian 12 (Bookworm)]
- [rails]Fixed
Details (4)
2:6.1.7.10+dfsg-1~deb12u2· all · bookwormFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
2:6.1.7.10+dfsg-1~deb12u2· all · bookwormFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
2:6.1.7.10+dfsg-1~deb12u2· all · bookworm-securityFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
2:6.1.7.10+dfsg-1~deb12u2· all · bookworm-securityFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
- [ruby-actioncable]Fixed
Source package: [rails]
Details (4)
2:6.1.7.10+dfsg-1~deb12u2· all · bookwormFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
2:6.1.7.10+dfsg-1~deb12u2· all · bookwormFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
2:6.1.7.10+dfsg-1~deb12u2· all · bookworm-securityFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
2:6.1.7.10+dfsg-1~deb12u2· all · bookworm-securityFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
- [ruby-actionmailbox]Fixed
Source package: [rails]
Details (4)
2:6.1.7.10+dfsg-1~deb12u2· all · bookwormFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
2:6.1.7.10+dfsg-1~deb12u2· all · bookwormFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
2:6.1.7.10+dfsg-1~deb12u2· all · bookworm-securityFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
2:6.1.7.10+dfsg-1~deb12u2· all · bookworm-securityFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
- [ruby-actionmailer]Fixed
Source package: [rails]
Details (4)
2:6.1.7.10+dfsg-1~deb12u2· all · bookwormFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
2:6.1.7.10+dfsg-1~deb12u2· all · bookwormFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
2:6.1.7.10+dfsg-1~deb12u2· all · bookworm-securityFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
2:6.1.7.10+dfsg-1~deb12u2· all · bookworm-securityFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
- [ruby-actionpack]Fixed
Source package: [rails]
Details (4)
2:6.1.7.10+dfsg-1~deb12u2· all · bookwormFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
2:6.1.7.10+dfsg-1~deb12u2· all · bookwormFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
2:6.1.7.10+dfsg-1~deb12u2· all · bookworm-securityFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
2:6.1.7.10+dfsg-1~deb12u2· all · bookworm-securityFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
- [ruby-actiontext]Fixed
Source package: [rails]
Details (4)
2:6.1.7.10+dfsg-1~deb12u2· all · bookwormFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
2:6.1.7.10+dfsg-1~deb12u2· all · bookwormFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
2:6.1.7.10+dfsg-1~deb12u2· all · bookworm-securityFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
2:6.1.7.10+dfsg-1~deb12u2· all · bookworm-securityFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
- [ruby-actionview]Fixed
Source package: [rails]
Details (4)
2:6.1.7.10+dfsg-1~deb12u2· all · bookwormFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
2:6.1.7.10+dfsg-1~deb12u2· all · bookwormFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
2:6.1.7.10+dfsg-1~deb12u2· all · bookworm-securityFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
2:6.1.7.10+dfsg-1~deb12u2· all · bookworm-securityFixed · Fixed:
2:6.1.7.10+dfsg-1~deb12u1dsa · rails · debian · bookworm; dsa · rails · debian · 12
Observed:
References
- [https://ftp.suse.com/pub/projects/security/csaf/opensuse-su-2025_14668-1.json]
- [https://osv.dev/vulnerability/DEBIAN-CVE-2024-54133]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14668-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14669-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14670-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14671-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14672-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14673-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14674-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14675-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14676-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14677-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14678-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14679-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2025:14680-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10335-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10336-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10337-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10338-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10339-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10340-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10341-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10342-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10343-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10344-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10345-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10360-1]
- [https://osv.dev/vulnerability/openSUSE-SU-2026:10362-1]
- [https://security-tracker.debian.org/tracker/CVE-2024-54133]
- [https://security.access.redhat.com/data/csaf/v2/vex/2024/cve-2024-54133.json]
- [https://wid.cert-bund.de/.well-known/csaf/white/2024/wid-sec-w-2024-3665.json]
[CERT-Bund public advisories] · [Debian Security Tracker] · [FIRST EPSS] · [OSV Package Vulnerability Database] · [Red Hat security advisories and VEX] · [SUSE security advisories and VEX]