CVE-2012-2661

UNKNOWN

The Active Record component in Ruby on Rails 3

Published Jun 22, 2012

Modified 1 years ago

Details

The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement the passing of request data to a where method in an ActiveRecord class, which allows remote attackers to conduct certain SQL injection attacks via nested query parameters that leverage unintended recursion, a related issue to CVE-2012-2695.

References

ADVISORY

http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html

ADVISORY

http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html

ADVISORY

http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html

ADVISORY

http://rhn.redhat.com/errata/RHSA-2013-0154.html

WEB

https://groups.google.com/group/rubyonrails-security/msg/fc2da6c627fc92df?dmode=source&output=gplain

ADVISORY