Red Hat Security AdvisoryRHSA-2014:1102
ror40-rubygem-activerecord security update
Released 2014-08-27 · Red Hat rating Important · View on Red Hat →
Fixed in
- Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) ror40-rubygem-activerecord-1:4.0.2-2.3.el6, ror40-rubygem-activerecord-doc-1:4.0.2-2.3.el6
- Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7) ror40-rubygem-activerecord-1:4.0.2-2.3.el7, ror40-rubygem-activerecord-doc-1:4.0.2-2.3.el7
- Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4) ror40-rubygem-activerecord-1:4.0.2-2.3.el6, ror40-rubygem-activerecord-doc-1:4.0.2-2.3.el6
- Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6) ror40-rubygem-activerecord-1:4.0.2-2.3.el6, ror40-rubygem-activerecord-doc-1:4.0.2-2.3.el6
- Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 7) ror40-rubygem-activerecord-1:4.0.2-2.3.el7, ror40-rubygem-activerecord-doc-1:4.0.2-2.3.el7
Fixes 1 record
Priority LOW 38
activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafte…
CVSS 2.0HIGH 7.5· Network · No auth · Interaction — · EPSS 0.02797 · Published 2014-08-20 · Fixed in 4.0.9, 4.1.5 CWE-264
