CVE-2014-0080

描述

SQL injection vulnerability in `activerecord/lib/active_record/connection_adapters/postgresql/cast.rb` in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving `\` (backslash) characters that are not properly handled in operations on array columns.

如何修補 CVE-2014-0080

要修補 CVE-2014-0080,請將受影響套件升級到下列已修補版本。

• RubyGems/activerecord—升級至 4.0.3 或更新版本

CVE-2014-0080 正在被利用嗎?

低 — EPSS 為 1.3%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• >= 4.0.0, < 4.0.3

參考連結(6)

• ADVISORYgithub.com/advisories/GHSA-hqf9-rc9j-5fmj
• ADVISORYnvd.nist.gov/vuln/detail/CVE-2014-0080
• PATCHgithub.com/rails/rails/tree/main/activerecord
• WEBopenwall.com/lists/oss-security/2014/02/18/9