Skip to content
OpenAdvisories
High WID-SEC-2023-0114 6 CVEs

Ruby on Rails: Mehrere Schwachstellen

Published Jan 17, 2023 · Updated Nov 25, 2025 · Revision 12 · de-DE

Vendor: Debian Vendor: Red Hat Vendor: SUSE Product: Enterprise Linux Product: Linux Product: Linux Product: openSUSE Platform: Linux Platform: Windows

Summary

Ein entfernter Angreifer kann mehrere Schwachstellen in Ruby on Rails ausnutzen, um einen Denial of Service Angriff durchzuführen, Daten zu manipulieren und Sicherheitsmaßnahmen zu umgehen.

Product

Ruby on Rails ist ein in der Programmiersprache Ruby geschriebenes und quelloffenes Web Application Framework.

Vulnerabilities 6

  • High 8.8
    CVE-2023-22794

    SQL Injection Vulnerability via ActiveRecord comments

    A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which auto…

    rails rails activerecord Debian Ubuntu RubyGems
  • High 7.5
    CVE-2022-44566

    Denial of Service Vulnerability in ActiveRecord's PostgreSQL adapter

    A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. …

    rails rails activerecord Debian Ubuntu RubyGems
  • High 7.5
    CVE-2023-22792

    ReDoS based DoS vulnerability in Action Dispatch

    A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastroph…

    rails rails actionpack Debian Ubuntu RubyGems
  • Medium 6.1
    CVE-2023-22797

    Open Redirect Vulnerability in Action Pack

    An open redirect vulnerability is fixed in Rails 7.0.4.1 with the new protection against open redirects from calling redirect_to with untrusted user input. In prior versions the developer was fully responsible for only providing trusted input. However the che…

    rails actionpack Ubuntu RubyGems
  • Low —
    CVE-2023-22795

    ReDoS based DoS vulnerability in Action Dispatch

    A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, whe…

    rails rails actionpack ruby Debian Ubuntu Azure Linux RubyGems
  • Low —
    CVE-2023-22796

    ReDoS based DoS vulnerability in Active Support's underscore

    A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process …

    rails rails activesupport ruby-activesupport Debian Ubuntu Alpine RubyGems

Revision history

  1. #12

    Neue Updates von Debian aufgenommen

  2. #11

    Neue Updates von openSUSE aufgenommen

  3. #10

    Neue Updates von Red Hat aufgenommen

  4. #9

    Neue Updates von Red Hat aufgenommen

  5. #8

    Neue Updates von Debian aufgenommen

  6. #7

    Neue Updates von SUSE aufgenommen

  7. #6

    Neue Updates von SUSE aufgenommen

  8. #5

    Neue Updates von SUSE aufgenommen

  9. #4

    Neue Updates von SUSE aufgenommen

  10. #3

    Neue Updates von SUSE aufgenommen

  11. #2

    Neue Updates von SUSE aufgenommen

  12. #1

    Initiale Fassung

References