SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 02:08
Type | Values Removed | Values Added |
---|---|---|
References | () http://openwall.com/lists/oss-security/2014/07/02/5 - | |
References | () http://rhn.redhat.com/errata/RHSA-2014-0876.html - | |
References | () http://secunia.com/advisories/59973 - | |
References | () http://secunia.com/advisories/60214 - | |
References | () http://secunia.com/advisories/60763 - | |
References | () http://www.debian.org/security/2014/dsa-2982 - | |
References | () http://www.securityfocus.com/bid/68343 - | |
References | () https://groups.google.com/forum/message/raw?msg=rubyonrails-security/wDxePLJGZdI/WP7EasCJTA4J - |
Information
Published : 2014-07-07 11:01
Updated : 2024-11-21 02:08
NVD link : CVE-2014-3482
Mitre link : CVE-2014-3482
CVE.ORG link : CVE-2014-3482
JSON object : View
Products Affected
rubyonrails
- rails
- ruby_on_rails
CWE
CWE-89
Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')