CVE-2014-3482
Fixed in a distro release EPSS 4%
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.
Products: rubyonrails rails, rubyonrails ruby_on_rails
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | activerecord | 3.2.19 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | rails | 2:4.1.4-1 |
| Debian 13 | rails | 2:4.1.4-1 |
| Debian 14 | rails | 2:4.1.4-1 |
| Debian 7 | ruby-activerecord-3.2 | 3.2.6-5+deb7u1 |
| Red Hat rhel software collections 1 | ruby193-rubygem-activerecord | 1:3.2.8-8.2.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-activerecord | 1:3.2.8-8.2.el7 |
| Red Hat rhel software collections 1 | ruby193-rubygem-activerecord-doc | 1:3.2.8-8.2.el6 |
| Red Hat rhel software collections 1 | ruby193-rubygem-activerecord-doc | 1:3.2.8-8.2.el7 |