Description
activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5 allows remote attackers to bypass the strong parameters protection mechanism via crafted input to an application that makes create_with calls.
Fixed in Linux distributions
Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.
Debian
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| Debian 14 | rails | 2:4.1.5-1 | — |
| Debian 13 | rails | 2:4.1.5-1 | — |
| Debian 12 | rails | 2:4.1.5-1 | — |
Red Hat
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| RHEL 1 | ror40-rubygem-activerecord +1 | 1:4.0.2-2.3.el6 | RHSA-2014:1102 |
openSUSE
Security tracker ↗| Release | Package | Fixed in | Advisory |
|---|---|---|---|
| openSUSE Tumbleweed | rubygem-railties-4_2 | 5.0.0.1-1.1 | openSUSE-SU-2024:10207-1 |
Affected packages
| Ecosystem | Package | Affected | Fixed | Record |
|---|---|---|---|---|
| RubyGems | activerecord | >= 4.0.0, < 4.0.9 | 4.0.9 | GHSA-9rf5-jm6f-2fmm |
| RubyGems | activerecord | >= 4.1.0, < 4.1.5 | 4.1.5 | GHSA-9rf5-jm6f-2fmm |
Advisories 2
- RHSA-2014:1102 Red Hat Security Advisory: ror40-rubygem-activerecord security update Red Hat Security Advisories (RHSA) · Jun 29, 2026
- openSUSE-SU-2024:10207-1 ruby2.2-rubygem-railties-4_2-4.2.7.1-1.1 on GA media SUSE / openSUSE Security Updates · Feb 4, 2026
References
- [rubyonrails-security] 20140818 [Ruby on Rails] [CVE-2014-3514] Strong Parameter bypass with create_with mailing-list
- 60347 third-party-advisory
- [oss-security] 20140814 [Ruby on Rails] [CVE-2014-3514] Strong Parameter bypass with create_with mailing-list
- RHSA-2014:1102 vendor-advisory