SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in
    the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote
    attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting. (CVE-2014-3482)

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:0876 advisory.

    Ruby on Rails is a model-view-controller (MVC) framework for web     application development. Active Record implements object-relational mapping     for accessing database entries using objects.

    It was discovered that Active Record did not properly quote values of the     bitstring type attributes when using the PostgreSQL database adapter.
    A remote attacker could possibly use this flaw to conduct an SQL injection     attack against applications using Active Record. (CVE-2014-3482)

    Red Hat would like to thank the Ruby on Rails project for reporting this     issue. Upstream acknowledges Sean Griffin of thoughtbot as the original     reporter.

    All ruby193-rubygem-activerecord users are advised to upgrade to these     updated packages, which contain a backported patch to correct this issue.

Tenable has extracted the preceding description block directly from the Red Hat Enterprise Linux security advisory.

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Fix for CVE-2014-3482: SQL injection vulnerability in 'bitstring' quoting

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sean Griffin discovered two vulnerabilities in the PostgreSQL adapter for Active Record which could lead to SQL injection.

ID	Name	Product	Family	Severity
422553	SCA: security update for activerecord (GHSA-mhwp-qhpc-h3jm)	Tenable Cloud Security	SCA Checks	critical
422553	SCA: security update for activerecord (GHSA-mhwp-qhpc-h3jm)	Tenable Self-Hosted Container Security	SCA Checks	critical
210198	RHEL 6 / 7 : ruby193-rubygem-activerecord (RHSA-2014:0876)	Nessus	Red Hat Local Security Checks	critical
77346	Fedora 19 : rubygem-activerecord-3.2.13-2.fc19 (2014-8089)	Nessus	Fedora Local Security Checks	high
76605	Debian DSA-2982-1 : ruby-activerecord-3.2 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2014-3482

critical

Tenable Plugins

critical

critical

critical

high

high