Описание
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.
Отчет
Not vulnerable. This issue did not affect the versions of rubygem-activerecord as shipped with CloudForms, OpenShift Enterprise 1 and 2, Red Hat Enterprise Linux OpenStack Platform 3 and 4, Red Hat Software Collections 1 and Subscription Asset Manager as they did not include the vulnerable code.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| CloudForms Management Engine 5 | ruby193-rubygem-activerecord | Not affected | ||
| OpenShift Enterprise 1 | ruby193-rubygem-activerecord | Not affected | ||
| Red Hat OpenStack Platform 3 | ruby193-rubygem-activerecord | Not affected | ||
| Red Hat OpenStack Platform 4 | ruby193-rubygem-activerecord | Not affected | ||
| Red Hat Satellite 6 | ruby193-rubygem-activerecord | Not affected | ||
| Red Hat Software Collections | ror40-rubygem-activerecord | Not affected | ||
| Red Hat Software Collections | ruby193-rubygem-activerecord | Not affected | ||
| Red Hat Subscription Asset Manager | ruby193-rubygem-activerecord | Not affected |
Показывать по
Дополнительная информация
Статус:
EPSS
4.3 Medium
CVSS2
Связанные уязвимости
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.
SQL injection vulnerability in activerecord/lib/active_record/connecti ...
EPSS
4.3 Medium
CVSS2