Description
SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10 allows remote attackers to execute arbitrary SQL commands via a crafted request that leverages incorrect behavior of dynamic finders in applications that can use unexpected data types in certain find_by_ method calls.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rails | 2.3.14.1 | — |
| Debian 13 | rails | 2.3.14.1 | — |
| Debian 12 | rails | 2.3.14.1 | — |
| Debian 6.0 | rails | 2.3.5-1.2+squeeze4 | DSA-2597-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Red Hat OpenShift 1 | jenkins | 1.498-1.1.el6op | RHSA-2013:0220 |
| Red Hat OpenShift 1 | mongodb +3 | 2.0.2-6.el6op | RHSA-2013:0220 |
| Red Hat OpenShift 1 | openshift-console | 0.0.13-2.el6op | RHSA-2013:0220 |
| Red Hat OpenShift 1 | openshift-origin-broker | 1.0.10-1.el6op | RHSA-2013:0220 |
| Red Hat OpenShift 1 | openshift-origin-broker-util | 1.0.14-1.el6op | RHSA-2013:0220 |
| Red Hat OpenShift 1 | openshift-origin-cartridge-ruby-1.8 +1 | 1.0.5-1.el6op | RHSA-2013:0220 |
| Red Hat OpenShift 1 | openshift-origin-node-util | 1.0.7-1.el6op | RHSA-2013:0220 |
| Red Hat OpenShift 1 | openshift-origin-port-proxy +1 | 1.0.3-1.el6op | RHSA-2013:0220 |
| Red Hat OpenShift 1 | rhc | 1.3.2-1.3.el6op | RHSA-2013:0220 |
| Red Hat OpenShift 1 | ruby193-mod_passenger +5 | 3.0.12-21.el6op | RHSA-2013:0220 |
| Red Hat OpenShift 1 | ruby193-rubygem-activerecord +1 | 1:3.2.8-2.el6 | RHSA-2013:0220 |
| Red Hat OpenShift 1 | rubygem-activerecord | 1:3.0.13-3.el6op | RHSA-2013:0220 |
| Red Hat OpenShift 1 | rubygem-openshift-origin-auth-remote-user | 1.0.4-2.el6op | RHSA-2013:0220 |
| Red Hat OpenShift 1 | rubygem-openshift-origin-common +2 | 1.0.2-1.el6op | RHSA-2013:0220 |
| Red Hat OpenShift 1 | rubygem-openshift-origin-console +1 | 1.0.6-1.el6op | RHSA-2013:0220 |
| Red Hat OpenShift 1 | rubygem-openshift-origin-controller | 1.0.11-1.el6op | RHSA-2013:0220 |
| Red Hat OpenShift 1 | rubygem-openshift-origin-msg-broker-mcollective | 1.0.4-1.el6op | RHSA-2013:0220 |
| Red Hat OpenShift 1 | rubygem-openshift-origin-node | 1.0.10-6.el6op | RHSA-2013:0220 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | activerecord | >= 3.0.0.beta, < 3.0.18 | 3.0.18 | GHSA-gh2w-j7cx-2664 |
| RubyGems | activerecord | >= 3.1.0, < 3.1.9 | 3.1.9 | GHSA-gh2w-j7cx-2664 |
| RubyGems | activerecord | >= 3.2.0, < 3.2.10 | 3.2.10 | GHSA-gh2w-j7cx-2664 |
| RubyGems | activerecord | < 2.3.15 | 2.3.15 | GHSA-gh2w-j7cx-2664 |
Advisories 2
- RHSA-2013:0220 Red Hat Security Advisory: Red Hat OpenShift Enterprise 1.1 update Red Hat Security Advisories (RHSA) · Jun 28, 2026
- DSA-2597-1 rails - input validation error Debian Security (DSA / DLA) · Mar 9, 2026
References
- https://bugzilla.redhat.com/show_bug.cgi?id=889649
- RHSA-2013:0155 vendor-advisory
- http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/
- RHSA-2013:0220 vendor-advisory
- GLSA-201401-22 vendor-advisory
- RHSA-2013:0154 vendor-advisory
- [rubyonrails-security] 20130102 SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664) mailing-list
- 57084 vdb-entry
- RHSA-2013:0544 vendor-advisory