Array data injection vulnerability in activerecord

2017-10-2418:33:36

Google

osv.dev

0.004 Low

EPSS

Percentile

74.0%

JSON

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute “add data” SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.

CPENameOperatorVersion
activerecordeq4.0.1.rc2
activerecordeq4.0.1.rc3
activerecordeq4.0.1
activerecordeq4.0.1.rc4
activerecordeq4.1.0.beta1
activerecordeq4.0.2
activerecordeq4.0.0
activerecordeq4.0.1.rc1

Name	Operator	Version
activerecord	eq	4.0.1.rc2
activerecord	eq	4.0.1.rc3
activerecord	eq	4.0.1
activerecord	eq	4.0.1.rc4
activerecord	eq	4.1.0.beta1
activerecord	eq	4.0.2
activerecord	eq	4.0.0
activerecord	eq	4.0.1.rc1