Bug 891794 (CVE-2012-6497) - CVE-2012-6497 rubygem-authlogic: potential unsafe find_by_id method calls
Summary: CVE-2012-6497 rubygem-authlogic: potential unsafe find_by_id method calls
Alias: CVE-2012-6497
Product: Security Response
Classification: Other
Component: vulnerability
Version: unspecified
Hardware: All
OS: Linux
Target Milestone: ---
Assignee: Red Hat Product Security
QA Contact:
Depends On: 891796
Blocks: 889650
TreeView+ depends on / blocked
Reported: 2013-01-04 02:34 UTC by Vincent Danen
Modified: 2019-09-29 12:58 UTC (History)
2 users (show)

Fixed In Version:
Doc Type: Bug Fix
Doc Text:
Clone Of:
Last Closed: 2014-06-24 22:51:18 UTC

Attachments (Terms of Use)

Description Vincent Danen 2013-01-04 02:34:56 UTC
Common Vulnerabilities and Exposures assigned an identifier CVE-2012-6497 to
the following vulnerability:

Name: CVE-2012-6497
URL: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-6497
Assigned: 20130103
Reference: http://openwall.com/lists/oss-security/2013/01/03/12
Reference: http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/
Reference: http://phenoelit.org/blog/archives/2012/12/21/let_me_github_that_for_you/index.html

The Authlogic gem for Ruby on Rails, when used with certain versions
before 3.2.10, makes potentially unsafe find_by_id method calls, which
might allow remote attackers to conduct CVE-2012-6496 SQL injection
attacks via a crafted parameter in environments that have a known
secret_token value, as demonstrated by a value contained in
secret_token.rb in an open-source product.

Comment 1 Vincent Danen 2013-01-04 02:43:48 UTC
Created rubygem-authlogic tracking bugs for this issue

Affects: fedora-all [bug 891796]

Note You need to log in before you can comment on or make changes to this bug.