Bug 1114425 (CVE-2014-3482) - CVE-2014-3482 rubygem-activerecord: SQL injection vulnerability in 'bitstring' quoting
Summary: CVE-2014-3482 rubygem-activerecord: SQL injection vulnerability in 'bitstring...
Keywords:
Status: CLOSED ERRATA
Alias: CVE-2014-3482
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
medium
medium
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
URL:
Whiteboard:
Depends On: 1115332 1115334 1115628 1115629 1115775 1115776 1143801
Blocks: 1114429
TreeView+ depends on / blocked
 
Reported: 2014-06-30 04:44 UTC by Murray McAllister
Modified: 2023-05-12 04:06 UTC (History)
54 users (show)

Fixed In Version: rubygem-activerecord 3.2.19, rubygem-activerecord 4.0.0
Clone Of:
Environment:
Last Closed: 2014-11-06 09:45:46 UTC
Embargoed:

Attachments (Terms of Use)
patch from upstream (2.24 KB, patch)
2014-06-30 04:49 UTC, Murray McAllister 		no flags Details | Diff
View All


Links
System ID Private Priority Status Summary Last Updated
Red Hat Product Errata RHSA-2014:0876 0 normal SHIPPED_LIVE Moderate: ruby193-rubygem-activerecord security update 2014-07-14 20:15:08 UTC

Description Murray McAllister 2014-06-30 04:44:27 UTC 
An SQL injection flaw was found in the PostgreSQL adapter for Active Record. An attacker could possibly perform SQL injection attacks if a Ruby on Rails application performed queries against the bitstring type.

This issue affects versions 2.0.0-3.2.18 and newer. It is reported that versions 4.0 and newer are not affected.

Acknowledgements:

Red Hat would like to thank the Ruby on Rails project for reporting this issue. Upstream acknowledges Sean Griffin of thoughtbot as the original reporter.
Comment 2 Murray McAllister 2014-06-30 04:49:24 UTC 
Created attachment 913247 [details]
patch from upstream
Comment 4 Kurt Seifried 2014-07-02 17:37:07 UTC 
This is now public:
https://groups.google.com/forum/#!topic/rubyonrails-security/wDxePLJGZdI
Comment 6 Kurt Seifried 2014-07-02 19:49:27 UTC 
Statement:

This issue does not affect CloudForms 5 as it does not use the "bitstring" data type anywhere in the product.
Comment 7 Murray McAllister 2014-07-03 06:08:36 UTC 
Created rubygem-activerecord tracking bugs for this issue:

Affects: fedora-19 [bug 1115775]
Affects: epel-5 [bug 1115776]
Comment 8 Tomas Hoger 2014-07-03 06:52:18 UTC 
Upstream release announcement:
http://weblog.rubyonrails.org/2014/7/2/Rails_3_2_19_4_0_7_and_4_1_3_have_been_released/

Upstream 3.2.x commit:
https://github.com/rails/rails/commit/1f2192e46d78ee0ba2b06373f2c24caf8440ff5b

Fixed in ActiveRecord 3.2.19.  4.x versions were not affected according to upstream.
Comment 10 Martin Prpič 2014-07-14 09:26:39 UTC 
IssueDescription:

It was discovered that Active Record did not properly quote values of the bitstring type attributes when using the PostgreSQL database adapter. A remote attacker could possibly use this flaw to conduct an SQL injection attack against applications using Active Record.
Comment 11 errata-xmlrpc 2014-07-14 16:16:19 UTC 
This issue has been addressed in following products:

  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 6.4 EUS
  Red Hat Software Collections 1 for Red Hat Enterprise Linux 7

Via RHSA-2014:0876 https://rhn.redhat.com/errata/RHSA-2014-0876.html
Comment 12 Kurt Seifried 2014-09-18 03:31:53 UTC 
CFME doesn't use any bitstring fields in the database backend. But we should rebase activerecord at some point.
Comment 13 Kurt Seifried 2014-09-18 03:46:08 UTC 
SAM-1 doesn't use any bitstring fields in the database backend. But we should rebase activerecord at some point.
Note You need to log in before you can comment on or make changes to this bug.