CVE-2012-2694

UNKNOWN

actionpack/lib/action_dispatch/http/request

Published Jun 22, 2012

Modified 1 years ago

Details

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain "['xyz', nil]" values, a related issue to CVE-2012-2660.

References

ADVISORY

http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html

ADVISORY

http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html

ADVISORY

http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html

ADVISORY

http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html

ADVISORY

http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html

ADVISORY