CVE-2014-3483: SQL Injection
First published: Mon Jul 07 2014(Updated: )
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| rubygems/activerecord | >=4.1.0<4.1.3 | 4.1.3 |
| rubygems/activerecord | >=4.0.0<4.0.7 | 4.0.7 |
| Ruby on Rails | =4.0.0 | |
| Ruby on Rails | =4.0.0-beta | |
| Ruby on Rails | =4.0.0-rc1 | |
| Ruby on Rails | =4.0.0-rc2 | |
| Ruby on Rails | =4.0.1 | |
| Ruby on Rails | =4.0.1-rc1 | |
| Ruby on Rails | =4.0.1-rc2 | |
| Ruby on Rails | =4.0.1-rc3 | |
| Ruby on Rails | =4.0.1-rc4 | |
| Ruby on Rails | =4.0.2 | |
| Ruby on Rails | =4.0.3 | |
| Ruby on Rails | =4.0.4 | |
| Ruby on Rails | =4.0.5 | |
| Ruby on Rails | =4.0.6 | |
| Ruby on Rails | =4.0.6-rc1 | |
| Ruby on Rails | =4.0.6-rc2 | |
| Ruby on Rails | =4.0.6-rc3 | |
| Ruby on Rails | =4.1.0 | |
| Ruby on Rails | =4.1.0-beta1 | |
| Ruby on Rails | =4.1.1 | |
| Ruby on Rails | =4.1.2 | |
| Ruby on Rails | =4.1.2-rc1 | |
| Ruby on Rails | =4.1.2-rc2 | |
| Ruby on Rails | =4.1.2-rc3 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2014-3483
- http://openwall.com/lists/oss-security/2014/07/02/5
- http://rhn.redhat.com/errata/RHSA-2014-0877.html
- http://www.debian.org/security/2014/dsa-2982
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2014-3483.yml
- https://groups.google.com/forum/message/raw?msg=rubyonrails-security/wDxePLJGZdI/WP7EasCJTA4J
- https://web.archive.org/web/20200228150648/http://www.securityfocus.com/bid/68341
- https://github.com/advisories/GHSA-r8fh-hq2p-7qhq (Advisory)
- http://secunia.com/advisories/59971
- http://secunia.com/advisories/60214
- http://www.securityfocus.com/bid/68341
Frequently Asked Questions
What is the severity of CVE-2014-3483?
CVE-2014-3483 has been classified as a high severity vulnerability due to its potential for allowing arbitrary SQL command execution.
How do I fix CVE-2014-3483?
To fix CVE-2014-3483, upgrade to Active Record version 4.1.3 or 4.0.7 or later.
What versions of Active Record are affected by CVE-2014-3483?
CVE-2014-3483 affects Active Record versions prior to 4.0.7 and 4.1.x prior to 4.1.3.
What kind of vulnerability is CVE-2014-3483?
CVE-2014-3483 is an SQL injection vulnerability that allows attackers to execute arbitrary SQL commands.
Who is impacted by CVE-2014-3483?
Any application using affected versions of Active Record with PostgreSQL as the database backend is vulnerable to CVE-2014-3483.
- collector/github-advisory-latest
- alias/GHSA-r8fh-hq2p-7qhq
- alias/CVE-2014-3483
- collector/github-advisory
- agent/author
- agent/type
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/references
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/first-publish-date
- agent/event
- agent/description
- agent/trending
- agent/source
- agent/tags
- collector/nvd-cve
- agent/software-canonical-lookup-request
- collector/nvd-index
- package-manager/rubygems
- vendor/rubyonrails
- canonical/ruby on rails
- version/ruby on rails/4.0.0
- version/ruby on rails/4.0.0-beta
- version/ruby on rails/4.0.0-rc1
- version/ruby on rails/4.0.0-rc2
- version/ruby on rails/4.0.1
- version/ruby on rails/4.0.1-rc1
- version/ruby on rails/4.0.1-rc2
- version/ruby on rails/4.0.1-rc3
- version/ruby on rails/4.0.1-rc4
- version/ruby on rails/4.0.2
- version/ruby on rails/4.0.3
- version/ruby on rails/4.0.4
- version/ruby on rails/4.0.5
- version/ruby on rails/4.0.6
- version/ruby on rails/4.0.6-rc1
- version/ruby on rails/4.0.6-rc2
- version/ruby on rails/4.0.6-rc3
- version/ruby on rails/4.1.0
- version/ruby on rails/4.1.0-beta1
- version/ruby on rails/4.1.1
- version/ruby on rails/4.1.2
- version/ruby on rails/4.1.2-rc1
- version/ruby on rails/4.1.2-rc2
- version/ruby on rails/4.1.2-rc3