CVE-2015-7577
Fixed in a distro release EPSS 4%
activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, which allows remote attackers to bypass intended change restrictions by leveraging use of the nested attributes feature.
Products: rubyonrails rails, rubyonrails ruby_on_rails
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | activerecord | 3.2.22.1 |
| RubyGems | activerecord | 4.1.14.1 |
| RubyGems | activerecord | 4.2.5.1 |
| RubyGems | activerecord | 5.0.0.beta1.1 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | rails | 2:4.2.5.1-1 |
| Debian 13 | rails | 2:4.2.5.1-1 |
| Debian 14 | rails | 2:4.2.5.1-1 |
| Debian 7 | ruby-activerecord-3.2 | 3.2.6-5+deb7u2 |
| Debian 8 | rails | 2:4.1.8-1+deb8u1 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-actionpack | 1:4.1.5-3.el6 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-actionpack | 1:4.1.5-3.el7 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-actionpack-doc | 1:4.1.5-3.el6 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-actionpack-doc | 1:4.1.5-3.el7 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-actionview | 0:4.1.5-4.el6 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-actionview | 0:4.1.5-4.el7 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-actionview-doc | 0:4.1.5-4.el6 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-actionview-doc | 0:4.1.5-4.el7 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-activemodel | 0:4.1.5-2.el7 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-activemodel | 0:4.1.5-2.el6 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-activemodel-doc | 0:4.1.5-2.el6 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-activemodel-doc | 0:4.1.5-2.el7 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-activerecord | 1:4.1.5-2.el7 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-activerecord | 1:4.1.5-2.el6 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-activerecord-doc | 1:4.1.5-2.el7 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-activerecord-doc | 1:4.1.5-2.el6 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-activesupport | 1:4.1.5-3.el6 |
| Red Hat rhel software collections 2 | rh-ror41-rubygem-activesupport | 1:4.1.5-3.el7 |
| Red Hat rhel software collections 2 | ror40-rubygem-actionpack | 1:4.0.2-7.el7 |
| Red Hat rhel software collections 2 | ror40-rubygem-actionpack | 1:4.0.2-7.el6 |
| Red Hat rhel software collections 2 | ror40-rubygem-actionpack-doc | 1:4.0.2-7.el6 |
| Red Hat rhel software collections 2 | ror40-rubygem-actionpack-doc | 1:4.0.2-7.el7 |
| Red Hat rhel software collections 2 | ror40-rubygem-activerecord | 1:4.0.2-6.el7 |
| Red Hat rhel software collections 2 | ror40-rubygem-activerecord | 1:4.0.2-6.el6 |
| Red Hat rhel software collections 2 | ror40-rubygem-activerecord-doc | 1:4.0.2-6.el6 |
| Red Hat rhel software collections 2 | ror40-rubygem-activerecord-doc | 1:4.0.2-6.el7 |
| Red Hat rhel software collections 2 | ror40-rubygem-activesupport | 1:4.0.2-4.el7 |
| Red Hat rhel software collections 2 | ror40-rubygem-activesupport | 1:4.0.2-4.el6 |
| Red Hat rhel software collections 2 | ruby193-rubygem-actionpack | 1:3.2.8-16.el7 |
| Red Hat rhel software collections 2 | ruby193-rubygem-actionpack | 1:3.2.8-16.el6 |
| Red Hat rhel software collections 2 | ruby193-rubygem-actionpack-doc | 1:3.2.8-16.el6 |
| Red Hat rhel software collections 2 | ruby193-rubygem-actionpack-doc | 1:3.2.8-16.el7 |
| Red Hat rhel software collections 2 | ruby193-rubygem-activerecord | 1:3.2.8-11.el7 |
| Red Hat rhel software collections 2 | ruby193-rubygem-activerecord | 1:3.2.8-11.el6 |
| Red Hat rhel software collections 2 | ruby193-rubygem-activerecord-doc | 1:3.2.8-11.el6 |
| Red Hat rhel software collections 2 | ruby193-rubygem-activerecord-doc | 1:3.2.8-11.el7 |
| Red Hat rhel software collections 2 | ruby193-rubygem-activesupport | 1:3.2.8-6.el6 |
| Red Hat rhel software collections 2 | ruby193-rubygem-activesupport | 1:3.2.8-6.el7 |
| SUSE Enterprise Storage 2.1 | rubygem-activerecord-4_2 | 4.2.2-5.1 |
| SUSE Lifecycle Management Server 1.3 | rubygem-activerecord-3_2 | 3.2.12-0.15.1 |
| SUSE Linux Enterprise Module for Containers 12 | portus | 2.0.3-2.4 |
| SUSE Linux Enterprise Software Development Kit 11 SP4 | rubygem-activerecord-3_2 | 3.2.12-0.15.1 |
| SUSE OpenStack Cloud 5 | rubygem-activerecord-4_1 | 4.1.9-9.1 |
| SUSE Studio Onsite 1.3 | libjansson | 2.2.1-0.9.11.6 |
| SUSE Studio Onsite 1.3 | qemu-ext2 | 0.1.1-0.9.4.19 |
| SUSE Studio Onsite 1.3 | rubygem-activerecord-3_2 | 3.2.12-0.15.1 |
| SUSE Studio Onsite 1.3 | rubygem-bundler19 | 1.7.0-0.13.10 |
| SUSE Studio Onsite 1.3 | studio-help | 1.3.20-0.6.9 |
| SUSE Studio Onsite 1.3 | susestudio | 1.3.14-52.1 |
| SUSE Studio Onsite Runner 1.3 | libjansson | 2.2.1-0.9.11.6 |
| SUSE Studio Onsite Runner 1.3 | qemu-ext2 | 0.1.1-0.9.4.19 |
| SUSE Studio Onsite Runner 1.3 | rubygem-bundler19 | 1.7.0-0.13.10 |
| SUSE Studio Onsite Runner 1.3 | studio-help | 1.3.20-0.6.9 |
| SUSE Studio Onsite Runner 1.3 | susestudio | 1.3.14-52.1 |
| SUSE WebYast 1.3 | rubygem-activerecord-3_2 | 3.2.12-0.15.1 |