Red Hat Security Advisory

RHSA-2013:0155

Ruby on Rails security update

Released 2013-01-10 · Red Hat rating Critical · View on Red Hat →

Fixed in

CloudForms Cloud Engine for RHEL 6 Server rubygem-actionpack-1:3.0.10-11.el6cf, rubygem-activerecord-1:3.0.10-8.el6cf, rubygem-activesupport-1:3.0.10-5.el6cf
CloudForms System Engine for RHEL 6 Server rubygem-actionpack-1:3.0.10-11.el6cf, rubygem-activerecord-1:3.0.10-8.el6cf, rubygem-activesupport-1:3.0.10-5.el6cf

Fixes 3 records

TI-2013-00091 CVE-2013-0156 · GHSA-jmgw-6vjg-jjwg

active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before…

HIGH 78

active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attacke…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.98979 Published 2013-01-13 Fixed in 2.3.15, 3.0.19 +2 CWE-20

TI-2012-05214 CVE-2012-6496 · GHSA-gh2w-j7cx-2664

SQL injection vulnerability in the Active Record component in Ruby on Rails before…

MEDIUM 40

SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that…

CVSS 2.0HIGH 7.5 Network No auth Interaction — EPSS 0.04582 Published 2013-01-04 Partial fix · 3.0.18, 3.1.9 +2 CWE-89

TI-2013-00090 CVE-2013-0155 · GHSA-gppp-5xc5-wfpx

Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not…

LOW 39

Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows r…

CVSS 2.0MEDIUM 6.4 Network No auth Interaction — EPSS 0.08245 Published 2013-01-13 Fixed in 3.0.19, 3.1.10 +1 CWE-264