CVE-2014-3483: SQL Injection

Q: What is the severity of CVE-2014-3483?

CVE-2014-3483 has been classified as a high severity vulnerability due to its potential for allowing arbitrary SQL command execution.

Q: How do I fix CVE-2014-3483?

To fix CVE-2014-3483, upgrade to Active Record version 4.1.3 or 4.0.7 or later.

Q: What versions of Active Record are affected by CVE-2014-3483?

CVE-2014-3483 affects Active Record versions prior to 4.0.7 and 4.1.x prior to 4.1.3.

Q: What kind of vulnerability is CVE-2014-3483?

CVE-2014-3483 is an SQL injection vulnerability that allows attackers to execute arbitrary SQL commands.

Q: Who is impacted by CVE-2014-3483?

Any application using affected versions of Active Record with PostgreSQL as the database backend is vulnerable to CVE-2014-3483.

Published Jul 7, 2014

Updated

SQL injection vulnerability in activerecord/lib/activerecord/connectionadapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.

Affected Software

26 affected componentsFixes available

rubygems/activerecord>=4.1.0<4.1.3

4.1.3

rubygems/activerecord>=4.0.0<4.0.7

4.0.7

rubyonrails Rails=4.0.0

rubyonrails Rails=4.0.0-beta

rubyonrails Rails=4.0.0-rc1

rubyonrails Rails=4.0.0-rc2

rubyonrails Rails=4.0.1

rubyonrails Rails=4.0.1-rc1

rubyonrails Rails=4.0.1-rc2

rubyonrails Rails=4.0.1-rc3

rubyonrails Rails=4.0.1-rc4

rubyonrails Rails=4.0.2

rubyonrails Rails=4.0.3

rubyonrails Rails=4.0.4

rubyonrails Rails=4.0.5

rubyonrails Rails=4.0.6

rubyonrails Rails=4.0.6-rc1

rubyonrails Rails=4.0.6-rc2

rubyonrails Rails=4.0.6-rc3

rubyonrails Rails=4.1.0

rubyonrails Rails=4.1.0-beta1

rubyonrails Rails=4.1.1

rubyonrails Rails=4.1.2

rubyonrails Rails=4.1.2-rc1

rubyonrails Rails=4.1.2-rc2

rubyonrails Rails=4.1.2-rc3

Event History

Jul 7, 2014

CVE Published

via MITRE·10:00 AM

Data Sourced

via MITRE·10:00 AM

Description

Oct 24, 2017

Advisory Published

06:33 PM

Frequently Asked Questions

What is the severity of CVE-2014-3483?

CVE-2014-3483 has been classified as a high severity vulnerability due to its potential for allowing arbitrary SQL command execution.

How do I fix CVE-2014-3483?

To fix CVE-2014-3483, upgrade to Active Record version 4.1.3 or 4.0.7 or later.

What versions of Active Record are affected by CVE-2014-3483?