Description
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7 and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL commands by leveraging improper range quoting.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rails | 2:4.1.4-1 | — |
| Debian 13 | rails | 2:4.1.4-1 | — |
| Debian 12 | rails | 2:4.1.4-1 | — |
| Debian 7 | ruby-activerecord-3.2 | 3.2.6-5+deb7u1 | DSA-2982-1 |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 1 | ror40-rubygem-activerecord +1 | 1:4.0.2-2.2.el6 | RHSA-2014:0877 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | activerecord | >= 4.0.0, < 4.0.7 | 4.0.7 | GHSA-r8fh-hq2p-7qhq |
| RubyGems | activerecord | >= 4.1.0, < 4.1.3 | 4.1.3 | GHSA-r8fh-hq2p-7qhq |
Advisories 2
- RHSA-2014:0877 Red Hat Security Advisory: ror40-rubygem-activerecord security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- DSA-2982-1 ruby-activerecord-3.2 - security update Debian Security (DSA / DLA) · Mar 9, 2026
References
- RHSA-2014:0877 vendor-advisory
- 59971 third-party-advisory
- [oss-security] 20140702 [CVE-2014-3482] [CVE-2014-3483] Ruby on Rails: Two Active Record SQL Injection Vulnerabilities Affecting PostgreSQL mailing-list
- [rubyonrails-security] 20140702 [CVE-2014-3482] [CVE-2014-3483] Two Active Record SQL Injection Vulnerabilities Affecting PostgreSQL mailing-list
- 60214 third-party-advisory
- DSA-2982 vendor-advisory
- 68341 vdb-entry