GHSA-7phj-gmgx-2r66
Moderate severity vulnerability that affects activerecord
- Severity
- Medium
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- —
- No score published
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- —
- Not classified
- Fix
4.1.14.1- Upgrade activerecord to this version or later
Description
Withdrawn, accidental duplicate publish.
activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x before 4.1.14.1, 4.2.x before 4.2.5.1, and 5.x before 5.0.0.beta1.1 does not properly implement a certain destroy option, which allows remote attackers to bypass intended change restrictions by leveraging use of the nested attributes feature.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| activerecord | >= 4.0.0, < 4.1.14.1 |
4.1.14.1 |
| activerecord | >= 4.2.0, < 4.2.5.1 |
4.2.5.1 |
| activerecord | >= 3.0.0, < 3.2.22.1 |
3.2.22.1 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
activerecord RubyGems → 4.1.14.1
- bundler
bundle update activerecord # Gemfile: gem "activerecord", ">= 4.1.14.1"
References
Timeline
- Published
- Withdrawn
- Last updated by the source
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-76r7-hhxj-r776 Active Record logging vulnerable to ANSI escape injection | Medium | Also affects activerecord |
| GHSA-579w-22j4-4749 Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter | High | Also affects activerecord |
| GHSA-hq7p-j377-6v63 SQL Injection Vulnerability via ActiveRecord comments | High | Also affects activerecord |
| GHSA-3hhc-qp5v-9p2j Active Record RCE bug with Serialized Columns | Critical | Also affects activerecord |
| GHSA-f57c-hx33-hvh8 Active Record component in Ruby on Rails has a data-type injection vulnerability | Critical | Also affects activerecord |
| GHSA-8hc4-xxm3-5ppp Active Record subject to Regular Expression Denial-of-Service (ReDoS) | High | Also affects activerecord |
| GHSA-xf96-32q2-9rw2 Rails ActiveRecord gem vulnerable to SQL injection | High | Also affects activerecord |
| GHSA-jmm9-2p29-vh2w activerecord vulnerable to SQL Injection | High | Also affects activerecord |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor