CVE-2014-3482: SQL Injection
Published Jul 7, 2014
·Updated
SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresqladapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.
Affected Software
126 affected componentsFixes available
rubyonrails Rails=2.0.0
rubyonrails Rails=2.0.0-rc1
rubyonrails Rails=2.0.0-rc2
rubyonrails Rails=2.0.1
rubyonrails Rails=2.0.2
rubyonrails Rails=2.0.4
rubyonrails Rails=2.1.0
rubyonrails Rails=2.1.1
rubyonrails Rails=2.1.2
rubyonrails Rails=2.2.0
rubyonrails Rails=2.2.1
rubyonrails Rails=2.2.2
rubyonrails Rails=2.3.0
rubyonrails Rails=2.3.1
rubyonrails Rails=2.3.2
rubyonrails Rails=2.3.3
rubyonrails Rails=2.3.4
rubyonrails Rails=2.3.9
rubyonrails Rails=2.3.10
rubyonrails Rails=2.3.11
rubyonrails Rails=2.3.12
rubyonrails Rails=2.3.13
rubyonrails Rails=2.3.14
rubyonrails Rails=2.3.15
rubyonrails Rails=2.3.16
rubyonrails Rails=2.3.18
rubyonrails Rails=3.0.0
rubyonrails Rails=3.0.0-beta
rubyonrails Rails=3.0.0-beta2
rubyonrails Rails=3.0.0-beta3
rubyonrails Rails=3.0.0-beta4
rubyonrails Rails=3.0.0-rc
rubyonrails Rails=3.0.0-rc2
rubyonrails Rails=3.0.1
rubyonrails Rails=3.0.1-pre
rubyonrails Rails=3.0.2
rubyonrails Rails=3.0.2-pre
rubyonrails Rails=3.0.3
rubyonrails Rails=3.0.4-rc1
rubyonrails Rails=3.0.5
rubyonrails Rails=3.0.5-rc1
rubyonrails Rails=3.0.6
rubyonrails Rails=3.0.6-rc1
rubyonrails Rails=3.0.6-rc2
rubyonrails Rails=3.0.7
rubyonrails Rails=3.0.7-rc1
rubyonrails Rails=3.0.7-rc2
rubyonrails Rails=3.0.8
rubyonrails Rails=3.0.8-rc1
rubyonrails Rails=3.0.8-rc2
rubyonrails Rails=3.0.8-rc3
rubyonrails Rails=3.0.8-rc4
rubyonrails Rails=3.0.9
rubyonrails Rails=3.0.9-rc1
rubyonrails Rails=3.0.9-rc2
rubyonrails Rails=3.0.9-rc3
rubyonrails Rails=3.0.9-rc4
rubyonrails Rails=3.0.9-rc5
rubyonrails Rails=3.0.10
rubyonrails Rails=3.0.10-rc1
rubyonrails Rails=3.0.11
rubyonrails Rails=3.0.12
rubyonrails Rails=3.0.12-rc1
rubyonrails Rails=3.0.13
rubyonrails Rails=3.0.13-rc1
rubyonrails Rails=3.0.14
rubyonrails Rails=3.0.16
rubyonrails Rails=3.0.17
rubyonrails Rails=3.0.18
rubyonrails Rails=3.0.19
rubyonrails Rails=3.0.20
rubyonrails Rails=3.1.0
rubyonrails Rails=3.1.0-beta1
rubyonrails Rails=3.1.0-rc1
rubyonrails Rails=3.1.0-rc2
rubyonrails Rails=3.1.0-rc3
rubyonrails Rails=3.1.0-rc4
rubyonrails Rails=3.1.0-rc5
rubyonrails Rails=3.1.0-rc6
rubyonrails Rails=3.1.0-rc7
rubyonrails Rails=3.1.0-rc8
rubyonrails Rails=3.1.1
rubyonrails Rails=3.1.1-rc1
rubyonrails Rails=3.1.1-rc2
rubyonrails Rails=3.1.1-rc3
rubyonrails Rails=3.1.2
rubyonrails Rails=3.1.2-rc1
rubyonrails Rails=3.1.2-rc2
rubyonrails Rails=3.1.3
rubyonrails Rails=3.1.4
rubyonrails Rails=3.1.4-rc1
rubyonrails Rails=3.1.5
rubyonrails Rails=3.1.5-rc1
rubyonrails Rails=3.1.6
rubyonrails Rails=3.1.7
rubyonrails Rails=3.1.8
rubyonrails Rails=3.1.9
rubyonrails Rails=3.1.10
rubyonrails Rails=3.2.0
rubyonrails Rails=3.2.0-rc1
rubyonrails Rails=3.2.0-rc2
rubyonrails Rails=3.2.1
rubyonrails Rails=3.2.2
rubyonrails Rails=3.2.2-rc1
rubyonrails Rails=3.2.3
rubyonrails Rails=3.2.3-rc1
rubyonrails Rails=3.2.3-rc2
rubyonrails Rails=3.2.4
rubyonrails Rails=3.2.4-rc1
rubyonrails Rails=3.2.5
rubyonrails Rails=3.2.6
rubyonrails Rails=3.2.7
rubyonrails Rails=3.2.8
rubyonrails Rails=3.2.9
rubyonrails Rails=3.2.10
rubyonrails Rails=3.2.11
rubyonrails Rails=3.2.12
rubyonrails Rails=3.2.13-rc1
rubyonrails Rails=3.2.13-rc2
rubyonrails Rails=3.2.15-rc3
rubyonrails Rails=3.2.16
rubyonrails Rails=3.2.17
rubyonrails Rails=3.2.18
rubyonrails ruby on Rails=2.3.17
rubyonrails ruby on Rails=3.0.4
rubygems/activerecord>=2.0.0<3.2.19
3.2.19
Event History
Jul 7, 2014
CVE Published
via MITRE·10:00 AM
Data Sourced
via MITRE·10:00 AM
Description
Oct 24, 2017
Advisory Published
via GitHub·06:33 PM
Frequently Asked Questions
1
What is the severity of CVE-2014-3482?
CVE-2014-3482 has been classified as a high severity vulnerability due to its potential for remote SQL injection attacks.
2
How do I fix CVE-2014-3482?
To fix CVE-2014-3482, upgrade to Ruby on Rails version 3.2.19 or later.
3
What systems are affected by CVE-2014-3482?
CVE-2014-3482 affects Ruby on Rails versions 2.x and 3.x prior to 3.2.19, specifically when using the PostgreSQL adapter.
4
What kind of attack can exploit CVE-2014-3482?
CVE-2014-3482 allows attackers to execute arbitrary SQL commands through SQL injection due to improper bitstring quoting.
5
Is CVE-2014-3482 still a risk for users of Ruby on Rails?
Yes, users of vulnerable versions of Ruby on Rails who have not updated may still be at risk from CVE-2014-3482.