CVE-2014-0080 rubygem-activerecord: PostgreSQL array data injection vulnerability

2014-02-1720:00:00

RubySec

rubysec.com

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb
in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL
is used, allows remote attackers to execute “add data” SQL commands via vectors
involving \ (backslash) characters that are not properly handled in operations on
array columns.

CPENameOperatorVersion
activerecordlt3.2.0
activerecordle3.2.-1
activerecordge3.3.0
activerecordle4.0.2
activerecordge4.1.0
activerecordlt4.1.0.beta2

Name	Operator	Version
activerecord	lt	3.2.0
activerecord	le	3.2.-1
activerecord	ge	3.3.0
activerecord	le	4.0.2
activerecord	ge	4.1.0
activerecord	lt	4.1.0.beta2

References

nvd.nist.gov/vuln/detail/CVE-2014-0080

JSON

Related for RUBY:ACTIVERECORD-2014-0080-103438