SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.

The remote Redhat Enterprise Linux 6 / 7 host has packages installed that are affected by a vulnerability as referenced in the RHSA-2014:0877 advisory.

  - rubygem-activerecord: SQL injection vulnerability in 'range' quoting (CVE-2014-3483)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

Fix for CVE-2014-3483 rubygem-activerecord: SQL injection vulnerability in 'range' quoting and its regression

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

Sean Griffin discovered two vulnerabilities in the PostgreSQL adapter for Active Record which could lead to SQL injection.

ID	Name	Product	Family	Severity
194005	RHEL 6 / 7 : ror40-rubygem-activerecord (RHSA-2014:0877)	Nessus	Red Hat Local Security Checks	critical
77345	Fedora 20 : rubygem-activerecord-4.0.0-4.fc20 (2014-8065)	Nessus	Fedora Local Security Checks	high
76605	Debian DSA-2982-1 : ruby-activerecord-3.2 - security update	Nessus	Debian Local Security Checks	high

Detections

Analytics

CVE-2014-3483

critical

Tenable Plugins

critical

high

high