USN-7497-1: CarrierWave vulnerabilities
First published: Wed May 07 2025(Updated: )
Rikita Ishikawa discovered that CarrierWave did not correctly sanitize certain inputs. An attacker could possibly use this issue to execute arbitrary code. This issue only affected Ubuntu 18.04 LTS and Ubuntu 20.04 LTS. (CVE-2021-21305) Norihide Saito discovered that CarrierWave did not correctly sanitize certain inputs. An attacker could possibly use this issue to execute a cross-site scripting (XSS) attack. (CVE-2023-49090)
| Affected Software | Affected Version | How to fix |
|---|---|---|
| All of | ||
| ubuntu/ruby-carrierwave | <1.3.2-2ubuntu0.24.04.1~esm1 | 1.3.2-2ubuntu0.24.04.1~esm1 |
| Ubuntu | =24.04 | |
| All of | ||
| ubuntu/ruby-carrierwave | <1.3.2-2ubuntu0.22.04.1~esm1 | 1.3.2-2ubuntu0.22.04.1~esm1 |
| Ubuntu | =22.04 | |
| All of | ||
| ubuntu/ruby-carrierwave | <1.3.1-2ubuntu0.1~esm1 | 1.3.1-2ubuntu0.1~esm1 |
| Ubuntu | =20.04 | |
| All of | ||
| ubuntu/ruby-carrierwave | <1.2.2-1ubuntu0.1~esm1 | 1.2.2-1ubuntu0.1~esm1 |
| Ubuntu | =18.04 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
Frequently Asked Questions
What is the severity of USN-7497-1?
USN-7497-1 addresses a vulnerability in CarrierWave that could allow an attacker to execute arbitrary code.
How do I fix USN-7497-1?
To fix USN-7497-1, update the ruby-carrierwave package to the specified remedy version for your Ubuntu release.
Which versions of Ubuntu are affected by USN-7497-1?
USN-7497-1 affects Ubuntu 18.04 LTS, Ubuntu 20.04 LTS, and Ubuntu 22.04 LTS.
What is the cause of the vulnerability identified in USN-7497-1?
The vulnerability in USN-7497-1 is caused by CarrierWave not correctly sanitizing certain inputs.
Can USN-7497-1 lead to remote code execution?
Yes, the vulnerability in USN-7497-1 could potentially be exploited to execute arbitrary code remotely.
- agent/references
- agent/last-modified-date
- agent/weakness
- agent/title
- agent/softwarecombine
- agent/tags
- agent/source
- agent/type
- agent/description
- agent/first-publish-date
- agent/event
- collector/usn
- source/Ubuntu
- agent/software-canonical-lookup
- package-manager/ubuntu
- vendor/ubuntu
- canonical/ubuntu
- version/ubuntu/24.04
- version/ubuntu/22.04
- version/ubuntu/20.04
- version/ubuntu/18.04