Rails SQL injection vulnerability 3 Jan 13

A security problem affecting all versions of Rails has been discovered. The vulnerability affects apps which use dynamic finders with Active Record.

The original bug report has more detail about this vulnerability – CVE-2012-5664.

Customers who are able to, should upgrade to one of the new versions of Rails listed in the bug report (3.2.10, 3.1.9, or 3.0.18). Otherwise, you should audit your apps’ code for instances of dynamic finders, with a view to applying the workaround.

Posted 3 January 2013 by

1 Comment

  1. 5 months ago Rails JSON and XML security bugs | Brightbox Ruby Blog said:

    [...] JSON and XML security bugsRails SQL injection vulnerabilityNew Relic Agent vulnerabilityPassenger 3.0.17 and NGINX 1.2.3 packages for UbuntuPassenger 3.0.14 [...]

Comments are now closed.