Description
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rails | 2:4.1.4-1 | — |
| Debian 13 | rails | 2:4.1.4-1 | — |
| Debian 12 | rails | 2:4.1.4-1 | — |
| Debian 7 | ruby-activerecord-3.2 | 3.2.6-5+deb7u1 | DSA-2982-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 1 | ruby193-rubygem-activerecord +1 | 1:3.2.8-8.2.el6 | RHSA-2014:0876 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | activerecord | >= 2.0.0, < 3.2.19 | 3.2.19 | GHSA-mhwp-qhpc-h3jm |
Advisories 2
- RHSA-2014:0876 Red Hat Security Advisory: ruby193-rubygem-activerecord security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-2982-1 ruby-activerecord-3.2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- 68343 vdb-entry
- 59973 third-party-advisory
- [oss-security] 20140702 [CVE-2014-3482] [CVE-2014-3483] Ruby on Rails: Two Active Record SQL Injection Vulnerabilities Affecting PostgreSQL mailing-list
- [rubyonrails-security] 20140702 [CVE-2014-3482] [CVE-2014-3483] Two Active Record SQL Injection Vulnerabilities Affecting PostgreSQL mailing-list
- 60214 third-party-advisory
- 60763 third-party-advisory
- RHSA-2014:0876 vendor-advisory
- DSA-2982 vendor-advisory