CVE-2012-2660
First published: Fri Jun 01 2012(Updated: )
`actionpack/lib/action_dispatch/http/request.rb` in Ruby on Rails before 2.3.16, 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain `[nil]` values, a related issue to CVE-2012-2694.
Credit: secalert@redhat.com secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/rubygem-actionpack | <3.0.13 | 3.0.13 |
| redhat/rubygem-actionpack | <3.1.5 | 3.1.5 |
| redhat/rubygem-actionpack | <3.2.4 | 3.2.4 |
| rubygems/actionpack | <2.3.16 | 2.3.16 |
| rubygems/actionpack | >=3.0.0.beta<3.0.13 | 3.0.13 |
| rubygems/actionpack | >=3.2.0<3.2.4 | 3.2.4 |
| rubygems/actionpack | >=3.1.0<3.1.5 | 3.1.5 |
| rubyonrails Rails | =3.0.0 | |
| rubyonrails Rails | =3.0.0-beta | |
| rubyonrails Rails | =3.0.0-beta2 | |
| rubyonrails Rails | =3.0.0-beta3 | |
| rubyonrails Rails | =3.0.0-beta4 | |
| rubyonrails Rails | =3.0.0-rc | |
| rubyonrails Rails | =3.0.0-rc2 | |
| rubyonrails Rails | =3.0.1 | |
| rubyonrails Rails | =3.0.1-pre | |
| rubyonrails Rails | =3.0.2 | |
| rubyonrails Rails | =3.0.2-pre | |
| rubyonrails Rails | =3.0.3 | |
| rubyonrails Rails | =3.0.4-rc1 | |
| rubyonrails Rails | =3.0.5 | |
| rubyonrails Rails | =3.0.5-rc1 | |
| rubyonrails Rails | =3.0.6 | |
| rubyonrails Rails | =3.0.6-rc1 | |
| rubyonrails Rails | =3.0.6-rc2 | |
| rubyonrails Rails | =3.0.7 | |
| rubyonrails Rails | =3.0.7-rc1 | |
| rubyonrails Rails | =3.0.7-rc2 | |
| rubyonrails Rails | =3.0.8 | |
| rubyonrails Rails | =3.0.8-rc1 | |
| rubyonrails Rails | =3.0.8-rc2 | |
| rubyonrails Rails | =3.0.8-rc3 | |
| rubyonrails Rails | =3.0.8-rc4 | |
| rubyonrails Rails | =3.0.9 | |
| rubyonrails Rails | =3.0.9-rc1 | |
| rubyonrails Rails | =3.0.9-rc2 | |
| rubyonrails Rails | =3.0.9-rc3 | |
| rubyonrails Rails | =3.0.9-rc4 | |
| rubyonrails Rails | =3.0.9-rc5 | |
| rubyonrails Rails | =3.0.10 | |
| rubyonrails Rails | =3.0.10-rc1 | |
| rubyonrails Rails | =3.0.11 | |
| rubyonrails Rails | =3.0.12 | |
| rubyonrails Rails | =3.0.12-rc1 | |
| rubyonrails Rails | =3.0.13-rc1 | |
| Ruby on Rails | =3.0.4 | |
| rubyonrails Rails | =3.1.0 | |
| rubyonrails Rails | =3.1.0-beta1 | |
| rubyonrails Rails | =3.1.0-rc1 | |
| rubyonrails Rails | =3.1.0-rc2 | |
| rubyonrails Rails | =3.1.0-rc3 | |
| rubyonrails Rails | =3.1.0-rc4 | |
| rubyonrails Rails | =3.1.0-rc5 | |
| rubyonrails Rails | =3.1.0-rc6 | |
| rubyonrails Rails | =3.1.0-rc7 | |
| rubyonrails Rails | =3.1.0-rc8 | |
| rubyonrails Rails | =3.1.1 | |
| rubyonrails Rails | =3.1.1-rc1 | |
| rubyonrails Rails | =3.1.1-rc2 | |
| rubyonrails Rails | =3.1.1-rc3 | |
| rubyonrails Rails | =3.1.2 | |
| rubyonrails Rails | =3.1.2-rc1 | |
| rubyonrails Rails | =3.1.2-rc2 | |
| rubyonrails Rails | =3.1.3 | |
| rubyonrails Rails | =3.1.4 | |
| rubyonrails Rails | =3.1.4-rc1 | |
| rubyonrails Rails | =3.1.5-rc1 | |
| rubyonrails Rails | =3.2.0 | |
| rubyonrails Rails | =3.2.0-rc1 | |
| rubyonrails Rails | =3.2.0-rc2 | |
| rubyonrails Rails | =3.2.1 | |
| rubyonrails Rails | =3.2.2 | |
| rubyonrails Rails | =3.2.2-rc1 | |
| rubyonrails Rails | =3.2.3 | |
| rubyonrails Rails | =3.2.3-rc1 | |
| rubyonrails Rails | =3.2.3-rc2 | |
| rubyonrails Rails | =3.2.4-rc1 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2012-2660
- https://groups.google.com/group/rubyonrails-security/msg/d890f8d58b5fbf32?dmode=source&output=gplain
- http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00002.html
- http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00014.html
- http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00016.html
- http://lists.opensuse.org/opensuse-security-announce/2012-08/msg00017.html
- http://lists.opensuse.org/opensuse-updates/2012-08/msg00046.html
- http://rhn.redhat.com/errata/RHSA-2013-0154.html
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/actionpack/CVE-2012-2660.yml
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2012-2660.yml
- https://groups.google.com/g/rubyonrails-security/c/8SA-M3as7A8/m/Mr9fi9X4kNgJ
- https://github.com/advisories/GHSA-hgpp-pp89-4fgf (Advisory)
- http://groups.google.com/group/rubyonrails-security/browse_thread/thread/f1203e3376acec0f
- http://groups.google.com/group/rubyonrails-security/attach/d890f8d58b5fbf32/3-0-null_param.patch?part=3
- http://groups.google.com/group/rubyonrails-security/attach/d890f8d58b5fbf32/3-1-null_param.patch?part=5
- http://groups.google.com/group/rubyonrails-security/attach/d890f8d58b5fbf32/3-2-null_param.patch?part=4
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=827364
- https://rhn.redhat.com/errata/RHSA-2012-1542.html
- https://rhn.redhat.com/errata/RHSA-2013-0154.html
- https://rhn.redhat.com/errata/RHSA-2013-0582.html
- https://bugzilla.redhat.com/show_bug.cgi?id=827353
- https://github.com/rails/rails/commit/61eed87ce32caf534bf1f52dd8134097b4ad9e1b
Frequently Asked Questions
What is the severity of CVE-2012-2660?
CVE-2012-2660 has a medium severity level as it allows potential remote code execution due to inadequate parameter handling in Ruby on Rails.
How do I fix CVE-2012-2660?
To fix CVE-2012-2660, upgrade Ruby on Rails to version 2.3.16, 3.0.13, 3.1.5, or 3.2.4 or later.
Which versions of Ruby on Rails are affected by CVE-2012-2660?
CVE-2012-2660 affects Ruby on Rails versions before 2.3.16, 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4.
What could happen if I do not address CVE-2012-2660?
Failing to address CVE-2012-2660 may allow attackers to exploit the vulnerability to perform denial-of-service attacks or execute arbitrary code.
Are there any workaround solutions for CVE-2012-2660 until I can upgrade?
There are no recommended workaround solutions for CVE-2012-2660, so it is crucial to update to a patched version as soon as possible.
- collector/redhat-bugzilla
- alias/CVE-2012-2660
- agent/author
- agent/type
- agent/first-publish-date
- collector/github-advisory-latest
- source/GitHub
- alias/GHSA-hgpp-pp89-4fgf
- agent/software-canonical-lookup
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/references
- agent/description
- agent/event
- agent/source
- collector/nvd-cve
- source/NVD
- agent/software-canonical-lookup-request
- collector/nvd-index
- agent/tags
- agent/softwarecombine
- collector/github-advisory
- package-manager/redhat
- package-manager/rubygems
- vendor/rubyonrails
- canonical/rubyonrails rails
- version/rubyonrails rails/3.0.0
- version/rubyonrails rails/3.0.0-beta
- version/rubyonrails rails/3.0.0-beta2
- version/rubyonrails rails/3.0.0-beta3
- version/rubyonrails rails/3.0.0-beta4
- version/rubyonrails rails/3.0.0-rc
- version/rubyonrails rails/3.0.0-rc2
- version/rubyonrails rails/3.0.1
- version/rubyonrails rails/3.0.1-pre
- version/rubyonrails rails/3.0.2
- version/rubyonrails rails/3.0.2-pre
- version/rubyonrails rails/3.0.3
- version/rubyonrails rails/3.0.4-rc1
- version/rubyonrails rails/3.0.5
- version/rubyonrails rails/3.0.5-rc1
- version/rubyonrails rails/3.0.6
- version/rubyonrails rails/3.0.6-rc1
- version/rubyonrails rails/3.0.6-rc2
- version/rubyonrails rails/3.0.7
- version/rubyonrails rails/3.0.7-rc1
- version/rubyonrails rails/3.0.7-rc2
- version/rubyonrails rails/3.0.8
- version/rubyonrails rails/3.0.8-rc1
- version/rubyonrails rails/3.0.8-rc2
- version/rubyonrails rails/3.0.8-rc3
- version/rubyonrails rails/3.0.8-rc4
- version/rubyonrails rails/3.0.9
- version/rubyonrails rails/3.0.9-rc1
- version/rubyonrails rails/3.0.9-rc2
- version/rubyonrails rails/3.0.9-rc3
- version/rubyonrails rails/3.0.9-rc4
- version/rubyonrails rails/3.0.9-rc5
- version/rubyonrails rails/3.0.10
- version/rubyonrails rails/3.0.10-rc1
- version/rubyonrails rails/3.0.11
- version/rubyonrails rails/3.0.12
- version/rubyonrails rails/3.0.12-rc1
- version/rubyonrails rails/3.0.13-rc1
- canonical/ruby on rails
- version/ruby on rails/3.0.4
- version/rubyonrails rails/3.1.0
- version/rubyonrails rails/3.1.0-beta1
- version/rubyonrails rails/3.1.0-rc1
- version/rubyonrails rails/3.1.0-rc2
- version/rubyonrails rails/3.1.0-rc3
- version/rubyonrails rails/3.1.0-rc4
- version/rubyonrails rails/3.1.0-rc5
- version/rubyonrails rails/3.1.0-rc6
- version/rubyonrails rails/3.1.0-rc7
- version/rubyonrails rails/3.1.0-rc8
- version/rubyonrails rails/3.1.1
- version/rubyonrails rails/3.1.1-rc1
- version/rubyonrails rails/3.1.1-rc2
- version/rubyonrails rails/3.1.1-rc3
- version/rubyonrails rails/3.1.2
- version/rubyonrails rails/3.1.2-rc1
- version/rubyonrails rails/3.1.2-rc2
- version/rubyonrails rails/3.1.3
- version/rubyonrails rails/3.1.4
- version/rubyonrails rails/3.1.4-rc1
- version/rubyonrails rails/3.1.5-rc1
- version/rubyonrails rails/3.2.0
- version/rubyonrails rails/3.2.0-rc1
- version/rubyonrails rails/3.2.0-rc2
- version/rubyonrails rails/3.2.1
- version/rubyonrails rails/3.2.2
- version/rubyonrails rails/3.2.2-rc1
- version/rubyonrails rails/3.2.3
- version/rubyonrails rails/3.2.3-rc1
- version/rubyonrails rails/3.2.3-rc2
- version/rubyonrails rails/3.2.4-rc1