CVE-2014-3482

EPSS 1.5%

ruby-activerecord-3.2 - security update

發布日:2017/10/24修改日:2026/3/9

也稱為:GHSA-mhwp-qhpc-h3jm DSA-2982-1DEBIAN-CVE-2014-3482

描述

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.

受影響套件(3)

Debian/railsfrom 0, < 2:4.1.4-1
Debian/ruby-activerecord-3.2from 0, < 3.2.6-5+deb7u1
RubyGems/activerecord>= 2.0.0, < 3.2.19

參考連結(8)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2014-3482
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2014-3482
PATCHhttps://github.com/rails/rails
WEBhttp://openwall.com/lists/oss-security/2014/07/02/5
WEBhttp://rhn.redhat.com/errata/RHSA-2014-0876.html
WEBhttps://github.com/rails/rails/commit/1f2192e46d78ee0ba2b06373f2c24caf8440ff5b
WEBhttps://groups.google.com/g/rubyonrails-security/c/wDxePLJGZdI
WEBhttp://www.debian.org/security/2014/dsa-2982