Skip to content
OpenAdvisories
Critical · 9.8 Public exploit CVE-2022-32224 EUVD-2022-6218GHSA-3hhc-qp5v-9p2j

Active Record RCE bug with Serialized Columns

Published Dec 5, 2022 · Updated May 11, 2026 · Assigned by hackerone

Package: activerecord Package: rails Package: rails Ecosystem: Debian Ecosystem: RubyGems Ecosystem: Ubuntu

Description

A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE.

Affected products

VendorProductAffectedFixed
— https://github.com/rails/rails 7.0.3.1, 6.1.6.1, 6.0.5.1, 5.2.8.1 —

Fixed in Linux distributions

Distributions backport fixes, so the version that fixes this vulnerability differs per release — upgrade to at least the version shown. From the distributions' security trackers and advisories.

Debian

Security tracker ↗
ReleasePackageFixed inAdvisory
Debian 14 rails 2:6.1.6.1+dfsg-1 —
Debian 13 rails 2:6.1.6.1+dfsg-1 —
Debian 12 rails 2:6.1.6.1+dfsg-1 —

Ubuntu

Security tracker ↗
ReleasePackageFixed inAdvisory
Ubuntu 26.10 rails No fix yet —
Ubuntu 26.04 LTS rails No fix yet —
Ubuntu 25.10 rails No fix yet —
Ubuntu 24.04 LTS rails No fix yet —
Show 4 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Ubuntu Pro 22.04 LTS rails No fix yet —
Ubuntu Pro 20.04 LTS rails No fix yet —
Ubuntu Pro 18.04 LTS rails No fix yet —
Ubuntu Pro 16.04 LTS rails No fix yet —

Red Hat

Security tracker ↗
ReleasePackageFixed inAdvisory
Red Hat Satellite Utils 6 foreman +1 3.1.1.26-1.el7sat RHSA-2023:1151, RHSA-2023:0261
Red Hat Satellite Utils 6 satellite +1 6.11.5-1.el7sat RHSA-2023:1151, RHSA-2023:0261
Red Hat Satellite Maintenance 6 rubygem-foreman_maintain 1:1.0.19-1.el7sat RHSA-2023:1151
Red Hat Satellite Maintenance 6 satellite-clone 3.1.1-2.el7sat RHSA-2023:1151, RHSA-2023:0261
Red Hat Satellite Capsule 6 ansible-collection-redhat-satellite 3.9.0-2.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 ansible-collection-redhat-satellite_operations 1.3.0-2.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 ansible-lint 5.0.8-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 ansible-runner +1 2.2.1-3.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 ansiblerole-foreman_scap_client 0.2.0-2.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 ansiblerole-insights-client 1.7.1-2.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 cjson 1.7.14-5.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 createrepo_c +3 0.20.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 dynflow-utils 1.6.3-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 foreman +1 3.1.1.26-1.el7sat RHSA-2023:2097, RHSA-2023:1151, RHSA-2023:0261
Red Hat Satellite Capsule 6 foreman-bootloaders-redhat +1 202102220000-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 foreman-discovery-image 1:4.1.0-10.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 foreman-discovery-image-service +1 1.0.0-4.1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 foreman-installer +1 1:3.5.2.1-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 foreman-proxy +1 3.5.1-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 katello +3 4.7.0-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 katello-certs-tools 2.9.0-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 katello-client-bootstrap 1.7.9-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 libcomps +2 0.1.18-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 libdb-cxx 5.3.28-42.el8_4 RHSA-2023:2097
Red Hat Satellite Capsule 6 libsodium 1.0.17-3.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 libsolv +2 0.7.22-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 libwebsockets 2.4.2-2.el8 RHSA-2023:2097
Red Hat Satellite Capsule 6 mosquitto 2.0.14-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 pulpcore-selinux 1.3.2-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 puppet-agent 7.12.1-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 puppet-agent-oauth 0.5.10-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 puppet-foreman_scap_client 0.4.0-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 puppetlabs-stdlib 5.2.0-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 puppetserver 7.9.3-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python-aiodns +1 3.0.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-aiofiles +1 22.1.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-aiohttp +1 3.8.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-aiohttp-xmlrpc +1 1.5.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-aioredis +1 2.0.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-aiosignal +1 1.2.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-ansible-builder +1 1.0.1-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-asgiref +1 3.5.2-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-async-lru +1 1.0.3-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-async-timeout +1 4.0.2-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-asyncio-throttle +1 1.0.2-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-attrs +1 21.4.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-backoff +1 2.1.2-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-bindep +1 2.11.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-bleach +1 3.3.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-bleach-allowlist +1 1.0.3-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-bracex +1 2.2.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-brotli +1 1.0.9-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-cchardet +1 2.1.7-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-certifi +1 2020.6.20-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-cffi +1 1.15.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-chardet +1 5.0.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-charset-normalizer +1 2.1.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-click +1 8.1.3-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-click-shell +1 2.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-colorama +1 0.4.4-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-commonmark +1 0.9.1-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-contextlib2 +1 21.6.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-cryptography +1 3.4.8-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-daemon +1 2.3.1-1.1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python-dataclasses +1 0.8-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-dateutil +1 2.8.2-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-debian +1 0.1.43-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-defusedxml +1 0.7.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-deprecated +1 1.2.13-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-diff-match-patch +1 20200713-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-distro +1 1.7.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-django +1 3.2.18-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-django-currentuser +1 0.5.3-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-django-filter +1 22.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-django-guid +1 3.3.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-django-import-export +1 2.8.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-django-lifecycle +1 1.0.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-djangorestframework +1 3.13.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-djangorestframework-queryfields +1 1.0.0-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-docutils +1 0.19-1.1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python-drf-access-policy +1 1.1.2-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-drf-nested-routers +1 0.93.4-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-drf-spectacular +1 0.23.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-dynaconf +1 3.1.9-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-ecdsa +1 0.14.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-enrich +1 1.2.6-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-et-xmlfile +1 1.1.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-flake8 +1 3.9.2-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-frozenlist +1 1.3.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-future +1 0.18.2-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-galaxy-importer +1 0.4.5-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-gitdb +1 4.0.9-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-gitpython +1 3.1.26-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-gnupg +1 0.5.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-gunicorn +1 20.1.0-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-idna +1 3.3-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-idna-ssl +1 1.1.0-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-importlib-metadata +1 4.10.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-inflection +3 0.5.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-iniparse +1 0.4-35.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-jinja2 +1 3.1.2-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-jsonschema +1 4.9.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-lockfile +1 0.12.2-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python-lxml +1 4.7.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-markdown +1 3.3.6-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-markuppy +1 1.14-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-markupsafe +1 2.0.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-mccabe +1 0.6.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-multidict +1 6.0.2-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-naya +1 1.1.1-1.1.el8pc RHSA-2023:2097, RHSA-2023:1151
Red Hat Satellite Capsule 6 python-odfpy +1 1.4.1-6.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-openpyxl +1 3.0.9-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-packaging +1 21.3-1.1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python-parsley +1 1.3-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pbr +1 5.8.0-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pexpect +1 4.8.0-2.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python-productmd +1 1.33-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-protobuf +1 4.21.6-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-psycopg2 +1 2.9.3-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-ptyprocess +1 0.7.0-1.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pulp-ansible +1 1:0.15.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pulp-certguard +1 1.5.5-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pulp-cli +1 0.14.0-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pulp-container +1 2.9.9-1.el8pc RHSA-2023:2097, RHSA-2023:1151, RHSA-2023:0261
Red Hat Satellite Capsule 6 python-pulp-deb +1 2.20.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pulp-file +1 1.11.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pulp-rpm +1 3.18.9-1.el8pc RHSA-2023:2097, RHSA-2023:0261
Red Hat Satellite Capsule 6 python-pulpcore +1 3.16.15-1.el8pc RHSA-2023:2097, RHSA-2023:1151, RHSA-2023:0261
Red Hat Satellite Capsule 6 python-pyOpenSSL +1 19.1.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pycairo +1 1.20.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pycares +1 4.1.2-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pycodestyle +1 2.7.0-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pycparser +1 2.21-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pycryptodomex +1 3.14.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pyflakes +1 2.3.1-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pygments +1 2.11.2-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pygobject +1 1:3.40.1-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pygtrie +1 2.5.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pyjwkest +1 1.4.2-6.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pyjwt +1 2.5.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pyparsing +1 2.4.7-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pyrsistent +1 0.18.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pytz +1 2022.2.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-pyyaml +1 5.4.1-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-qpid +1 1.37.0-1.el8 RHSA-2023:2097
Red Hat Satellite Capsule 6 python-redis +1 4.3.4-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-requests +1 2.28.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-requirements-parser +1 0.2.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-rhsm +1 1.19.2-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-rich +1 10.12.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-ruamel-yaml +1 0.17.20-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-ruamel-yaml-clib +1 0.2.6-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-schema +1 0.7.5-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-semantic-version +1 2.10.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-six +1 1.16.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-smmap +1 5.0.0-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-sqlparse +1 0.4.2-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-tablib +1 3.2.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-tenacity +1 7.0.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-toml +1 0.10.2-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-types-cryptography +1 3.3.23-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-typing-extensions +1 3.10.0.2-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-uritemplate +1 4.1.1-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-url-normalize +1 1.4.3-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-urllib3 +1 1.26.8-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-urlman +1 2.0.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-wcmatch +1 8.3-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-whitenoise +1 6.0.0-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-wrapt +1 1.14.1-1.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-xlrd +1 2.0.1-5.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-xlwt +1 1.3.0-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-yarl 1.7.2-2.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python-zipp 3.4.0-4.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python2-qpid-qmf 1.39.0-7.el8amq RHSA-2023:2097
Red Hat Satellite Capsule 6 python2-saslwrapper 0.22-6.el8sat RHSA-2023:2097
Red Hat Satellite Capsule 6 python3-qpid-proton 0.33.0-4.el8 RHSA-2023:2097
Red Hat Satellite Capsule 6 python39-naya +2 1.1.1-3.el8pc RHSA-2023:2097
Red Hat Satellite Capsule 6 python39-pulp-container 2.10.10-1.el8pc RHSA-2023:2097, RHSA-2023:0261
Red Hat Satellite Capsule 6 python39-pulpcore 3.18.11-1.el8pc RHSA-2023:2097, RHSA-2023:0261
Red Hat Satellite Capsule 6 rubygem-foreman_maintain 1:1.0.19-1.el7sat RHSA-2023:1151
Red Hat Satellite Capsule 6 rubygem-smart_proxy_container_gateway 1.0.7-1.el8sat RHSA-2023:1151, RHSA-2023:0261
Red Hat Satellite Capsule 6 satellite +2 6.11.5-1.el7sat RHSA-2023:1151, RHSA-2023:0261
Red Hat Satellite Capsule 6 tfm-pulpcore-python-naya +1 1.1.1-1.1.el7pc RHSA-2023:1151
Red Hat Satellite Capsule 6 tfm-pulpcore-python-pulp-container +1 2.9.9-1.el7pc RHSA-2023:1151
Red Hat Satellite Capsule 6 tfm-pulpcore-python-pulpcore +1 3.16.15-1.el7pc RHSA-2023:1151
Red Hat Satellite Capsule 6 tfm-rubygem-smart_proxy_container_gateway 1.0.7-1.el7sat RHSA-2023:1151
Show 1 more (older releases, extended support, other products)
ReleasePackageFixed inAdvisory
Red Hat Satellite 6 candlepin +1 4.1.18-1.el8sat RHSA-2023:1151, RHSA-2023:0261
Red Hat Satellite 6 foreman +13 3.1.1.26-1.el7sat RHSA-2023:1151, RHSA-2023:0261
Red Hat Satellite 6 python-naya +1 1.1.1-1.1.el8pc RHSA-2023:1151
Red Hat Satellite 6 python-pulp-container +1 2.9.9-1.el8pc RHSA-2023:1151, RHSA-2023:0261
Red Hat Satellite 6 python-pulp-rpm +1 3.18.9-1.el8pc RHSA-2023:0261
Red Hat Satellite 6 python-pulpcore +1 3.16.15-1.el8pc RHSA-2023:1151, RHSA-2023:0261
Red Hat Satellite 6 python39-pulp-container 2.10.10-1.el8pc RHSA-2023:0261
Red Hat Satellite 6 python39-pulpcore 3.18.11-1.el8pc RHSA-2023:0261
Red Hat Satellite 6 rubygem-activesupport 6.0.6-1.el8sat RHSA-2023:1151, RHSA-2023:0261
Red Hat Satellite 6 rubygem-foreman_maintain 1:1.0.19-1.el7sat RHSA-2023:1151
Red Hat Satellite 6 rubygem-foreman_rh_cloud 5.0.44-1.el8sat RHSA-2023:1151, RHSA-2023:0261
Red Hat Satellite 6 rubygem-foreman_theme_satellite 9.0.0.12-1.el8sat RHSA-2023:1151
Red Hat Satellite 6 rubygem-foreman_webhooks 3.0.5-1.1.el8sat RHSA-2023:0261
Red Hat Satellite 6 rubygem-katello 4.3.0.52-1.el8sat RHSA-2023:1151, RHSA-2023:0261
Red Hat Satellite 6 rubygem-rails +11 6.0.6-2.el8sat RHSA-2023:1151, RHSA-2023:0261
Red Hat Satellite 6 rubygem-smart_proxy_container_gateway 1.0.7-1.el8sat RHSA-2023:1151, RHSA-2023:0261
Red Hat Satellite 6 satellite +2 6.11.5-1.el7sat RHSA-2023:1151, RHSA-2023:0261
Red Hat Satellite 6 tfm-pulpcore-python-naya +1 1.1.1-1.1.el7pc RHSA-2023:1151
Red Hat Satellite 6 tfm-pulpcore-python-pulp-container +1 2.9.9-1.el7pc RHSA-2023:1151
Red Hat Satellite 6 tfm-pulpcore-python-pulpcore +1 3.16.15-1.el7pc RHSA-2023:1151
Red Hat Satellite 6 tfm-rubygem-activesupport 6.0.6-1.el7sat RHSA-2023:1151
Red Hat Satellite 6 tfm-rubygem-foreman_rh_cloud 5.0.44-1.el7sat RHSA-2023:1151
Red Hat Satellite 6 tfm-rubygem-foreman_theme_satellite 9.0.0.12-1.el7sat RHSA-2023:1151
Red Hat Satellite 6 tfm-rubygem-katello 4.3.0.52-1.el7sat RHSA-2023:1151
Red Hat Satellite 6 tfm-rubygem-rails +11 6.0.6-2.el7sat RHSA-2023:1151
Red Hat Satellite 6 tfm-rubygem-smart_proxy_container_gateway 1.0.7-1.el7sat RHSA-2023:1151

SUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
SUSE Package Hub 15 SP4 rubygem-activerecord-5.2 5.2.3-bp154.2.3.1 openSUSE-SU-2023:0009-1

openSUSE

Security tracker ↗
ReleasePackageFixed inAdvisory
openSUSE Tumbleweed ruby3.2-rubygem-activerecord-7.0 7.0.4.3-1.1 openSUSE-SU-2024:12879-1
openSUSE Tumbleweed rubygem-activerecord-7.0 7.0.3.1-1.1 openSUSE-SU-2025:15112-1, openSUSE-SU-2024:14069-1, openSUSE-SU-2024:12244-1
openSUSE Leap 15.4 rubygem-activerecord-5.2 5.2.3-bp154.2.3.1 openSUSE-SU-2023:0009-1

Public exploits

Exploit or proof-of-concept code for this vulnerability is publicly available, which lowers the bar for attackers. Treat it as a reason to patch sooner.

Third-party code, not reviewed by us. Public PoCs are sometimes fake or contain malware. Read the code first and run it only in an isolated lab, against systems you are authorised to test.

GitHub 1 repository

Sources: PoC-in-GitHub, Metasploit Framework, Exploit-DB — updated daily. Only links are listed; no exploit code is hosted here.

Affected packages

EcosystemPackageAffectedFixedRecord
RubyGems activerecord >= 7.0.0, < 7.0.3.1 7.0.3.1 GHSA-3hhc-qp5v-9p2j
RubyGems activerecord >= 6.1.0, < 6.1.6.1 6.1.6.1 GHSA-3hhc-qp5v-9p2j
RubyGems activerecord >= 6.0.0, < 6.0.5.1 6.0.5.1 GHSA-3hhc-qp5v-9p2j
RubyGems activerecord < 5.2.8.1 5.2.8.1 GHSA-3hhc-qp5v-9p2j

Advisories 10

References