CVE-2012-6496
Fixed in a distro release EPSS 5%
SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.
Products: rubyonrails rails, rubyonrails ruby_on_rails
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | activerecord | 3.0.18 |
| RubyGems | activerecord | 3.1.9 |
| RubyGems | activerecord | 3.2.10 |
| RubyGems | activerecord | 2.3.15 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | rails | 2.3.14.1 |
| Debian 13 | rails | 2.3.14.1 |
| Debian 14 | rails | 2.3.14.1 |
| Debian 6.0 | rails | 2.3.5-1.2+squeeze4 |
| Red Hat openshift 1 | jenkins | 0:1.498-1.1.el6op |
| Red Hat openshift 1 | libmongodb | 0:2.0.2-6.el6op |
| Red Hat openshift 1 | mongodb | 0:2.0.2-6.el6op |
| Red Hat openshift 1 | mongodb-debuginfo | 0:2.0.2-6.el6op |
| Red Hat openshift 1 | mongodb-devel | 0:2.0.2-6.el6op |
| Red Hat openshift 1 | mongodb-server | 0:2.0.2-6.el6op |
| Red Hat openshift 1 | openshift-console | 0:0.0.13-2.el6op |
| Red Hat openshift 1 | openshift-origin-broker | 0:1.0.10-1.el6op |
| Red Hat openshift 1 | openshift-origin-broker-util | 0:1.0.14-1.el6op |
| Red Hat openshift 1 | openshift-origin-cartridge-haproxy-1.4 | 0:1.0.3-1.el6op |
| Red Hat openshift 1 | openshift-origin-cartridge-ruby-1.8 | 0:1.0.5-1.el6op |
| Red Hat openshift 1 | openshift-origin-cartridge-ruby-1.9-scl | 0:1.0.5-1.el6op |
| Red Hat openshift 1 | openshift-origin-msg-node-mcollective | 0:1.0.2-1.el6op |
| Red Hat openshift 1 | openshift-origin-node-util | 0:1.0.7-1.el6op |
| Red Hat openshift 1 | openshift-origin-port-proxy | 0:1.0.3-1.el6op |
| Red Hat openshift 1 | rhc | 0:1.3.2-1.3.el6op |
| Red Hat openshift 1 | ruby193-mod_passenger | 0:3.0.12-21.el6op |
| Red Hat openshift 1 | ruby193-rubygem-activerecord | 1:3.2.8-2.el6 |
| Red Hat openshift 1 | ruby193-rubygem-activerecord-doc | 1:3.2.8-2.el6 |
| Red Hat openshift 1 | ruby193-rubygem-passenger | 0:3.0.12-21.el6op |
| Red Hat openshift 1 | ruby193-rubygem-passenger-debuginfo | 0:3.0.12-21.el6op |
| Red Hat openshift 1 | ruby193-rubygem-passenger-devel | 0:3.0.12-21.el6op |
| Red Hat openshift 1 | ruby193-rubygem-passenger-doc | 0:3.0.12-21.el6op |
| Red Hat openshift 1 | ruby193-rubygem-passenger-native | 0:3.0.12-21.el6op |
| Red Hat openshift 1 | ruby193-rubygem-passenger-native-libs | 0:3.0.12-21.el6op |
| Red Hat openshift 1 | rubygem-activerecord | 1:3.0.13-3.el6op |
| Red Hat openshift 1 | rubygem-openshift-origin-auth-remote-user | 0:1.0.4-2.el6op |
| Red Hat openshift 1 | rubygem-openshift-origin-common | 0:1.0.2-1.el6op |
| Red Hat openshift 1 | rubygem-openshift-origin-console | 0:1.0.6-1.el6op |
| Red Hat openshift 1 | rubygem-openshift-origin-console-doc | 0:1.0.6-1.el6op |
| Red Hat openshift 1 | rubygem-openshift-origin-controller | 0:1.0.11-1.el6op |
| Red Hat openshift 1 | rubygem-openshift-origin-dns-bind | 0:1.0.2-1.el6op |
| Red Hat openshift 1 | rubygem-openshift-origin-msg-broker-mcollective | 0:1.0.4-1.el6op |
| Red Hat openshift 1 | rubygem-openshift-origin-node | 0:1.0.10-6.el6op |