Description
Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1) :limit and (2) :offset parameters, related to ActiveRecord, ActiveSupport, ActiveResource, ActionPack, and ActionMailer.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rails | 2.1.0-1 | — |
| Debian 13 | rails | 2.1.0-1 | — |
| Debian 12 | rails | 2.1.0-1 | — |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | activerecord | < 2.1.1 | 2.1.1 | GHSA-xf96-32q2-9rw2 |
References
- http://gist.github.com/8946
- rubyonrails-activerecord-sql-injection(45109) vdb-entry
- [oss-security] 20080913 CVE request: Ruby on Rails <2.1.1 :limit and :offset SQL injection mailing-list
- http://rails.lighthouseapp.com/projects/8994/tickets/964
- http://rails.lighthouseapp.com/projects/8994/tickets/288
- 31875 third-party-advisory
- SUSE-SR:2008:027 vendor-advisory
- 31910 third-party-advisory
- http://blog.innerewut.de/2008/6/16/why-you-should-upgrade-to-rails-2-1
- 1020871 vdb-entry
- http://www.rorsecurity.info/2008/09/08/sql-injection-issue-in-limit-and-offset-parameter/
- [oss-security] 20080915 Re: CVE request: Ruby on Rails <2.1.1 :limit and :offset SQL injection mailing-list
- 31176 vdb-entry
- 31909 third-party-advisory
- ADV-2008-2562 vdb-entry