Description
The Authlogic gem for Ruby on Rails, when used with certain versions before 3.2.10, makes potentially unsafe find_by_id method calls, which might allow remote attackers to conduct CVE-2012-6496 SQL injection attacks via a crafted parameter in environments that have a known secret_token value, as demonstrated by a value contained in secret_token.rb in an open-source product.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rails | 2.3.14.1 | — |
| Debian 13 | rails | 2.3.14.1 | — |
| Debian 12 | rails | 2.3.14.1 | — |
| Debian 6.0 | rails | 2.3.5-1.2+squeeze4 | DSA-2597-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | authlogic | < 3.3.0 | 3.3.0 | GHSA-rx7j-mw4c-76g9 |
Advisories 1
- DSA-2597-1 rails - input validation error Debian Security (DSA / DLA) · Mar 9, 2026
References
- http://blog.phusion.nl/2013/01/03/rails-sql-injection-vulnerability-hold-your-horses-here-are-the-facts/
- [oss-security] 20130103 Re: SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664) mailing-list
- http://phenoelit.org/blog/archives/2012/12/21/let_me_github_that_for_you/index.html
- 57084 vdb-entry