GitHub Advisoryadvisory · RubyGems

GHSA-hqf9-rc9j-5fmj Array data injection vulnerability in activerecord

MEDIUM Published 2017-10-24 Modified 2023-07-05 Official page ↗
Aliases
CVE-2014-0080
Ecosystem
RubyGems
Packages
activerecord
Severity
Moderate
Weaknesses
CWE-89
Reviewed
2020-06-16

Affected packages

• RubyGems activerecord: >= 4.0.0, < 4.0.3 → fixed in 4.0.3 • RubyGems activerecord: >= 4.1.0.beta1, < 4.1.0.beta2 → fixed in 4.1.0.beta2

Description

SQL injection vulnerability in `activerecord/lib/active_record/connection_adapters/postgresql/cast.rb` in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving `\` (backslash) characters that are not properly handled in operations on array columns.

Related

Alias · CVE (1)

  • CVE-2014-0080 SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails… vulnerability

Weakness · CWE (1)

  • CWE-89 Improper Neutralization of Special Elements used in an SQL Command weakness

References