CVE-2014-3514

EPSS 0.33%

Active Record subject to strong parameters protection bypass

發布日:2017/10/24修改日:2026/4/28

描述

activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.

受影響套件(2)

Debian/railsfrom 0, < 2:4.1.5-1
RubyGems/activerecord>= 4.0.0, < 4.0.9

參考連結(7)

ADVISORYhttps://nvd.nist.gov/vuln/detail/CVE-2014-3514
ADVISORYhttps://security-tracker.debian.org/tracker/CVE-2014-3514
WEBhttp://openwall.com/lists/oss-security/2014/08/18/10
WEBhttp://rhn.redhat.com/errata/RHSA-2014-1102.html
WEBhttps://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2014-3514.yml
WEBhttps://groups.google.com/forum/message/raw?msg=rubyonrails-security/M4chq5Sb540/CC1Fh0Y_NWwJ
WEBhttps://groups.google.com/forum/#!msg/rubyonrails-security/M4chq5Sb540/CC1Fh0Y_NWwJ