activerecord: Possible RCE escalation bug with Serialized Columns in Active Record

🗓️ 18 Jan 2023 14:55:53Reported by RedHatType

redhat🔗 access.redhat.com👁 13 Views

Active Record deserialization flaw using YAML.unsafe_load enables remote code execution via crafted data in the database.

Reporter	Title	Published	Views	Family All 62
attackerkb	CVE-2022-32224	5 Dec 202222:15	–	attackerkb
AstraLinux	Astra Linux – Vulnerability in Rails	5 Oct 202611:39	–	astralinux
Tenable Nessus	Rocky Linux 8 [CIQ] Security Update: libdb-cxx / libdb-cxx-debuginfo / libdb-debuginfo / etc Multiple Vulnerabilities (crlsa-2023_2097)	1 Oct 202600:00	–	nessus
Tenable Nessus	Debian dla-3093 : rails - security update	13 Sep 202200:00	–	nessus
Tenable Nessus	Debian dla-4578 : rails - security update	11 May 202600:00	–	nessus
Tenable Nessus	GLSA-202408-24 : Ruby on Rails: Remote Code Execution	11 Aug 202400:00	–	nessus
Tenable Nessus	openSUSE 15 Security Update : rubygem-activerecord-5.2 (openSUSE-SU-2023:0009-1)	12 Jan 202300:00	–	nessus
Tenable Nessus	RHEL 8 : Satellite 6.12.1 Async Security Update (Critical) (RHSA-2023:0261)	28 Apr 202400:00	–	nessus
Tenable Nessus	RHEL 7 / 8 : Satellite 6.11.5 Async Security Update (Critical) (RHSA-2023:1151)	28 Apr 202400:00	–	nessus
Tenable Nessus	RHEL 8 : Satellite 6.13 Release (Important) (RHSA-2023:2097)	28 Apr 202400:00	–	nessus

OS	OS Version	Architecture	Package	Package Version	Filename
Red Hat Enterprise Linux	8	noarch	rubygem-activerecord	6.0.6-2.el8sat	rubygem-activerecord-6.0.6-2.el8sat.noarch.rpm

Source	Link
access	www.access.redhat.com/security/cve/CVE-2022-32224
bugzilla	www.bugzilla.redhat.com/show_bug.cgi
discuss	www.discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017
nvd	www.nvd.nist.gov/vuln/detail/CVE-2022-32224
cve	www.cve.org/CVERecord

12 Oct 2026 14:13Current

7.3High risk

Vulners AI Score7.3

CVSS 3.19.8

EPSS0.02601

SSVC

Active Record Deserialization flaw Remote code execution Crafted data