Skip to main content
cve.nowby Sazabi
← RubyGems
RubyGemsPackage

activerecord

23 known vulnerabilities (1 critical, 1 high, 1 low), with the versions each affects and the releases that fix them.

Latest release
Not known: cve.now hasn't read this package's releases
Newest unaffected release
Not known without release data
Advisories
23 · 1 critical, 1 high, 1 low
Registry
RubyGems

Advisories 23

  • Active Record logging vulnerable to ANSI escape injection

    Affected: from 8.0, fixed in 8.0.2.1; from 7.2, fixed in 7.2.2.2; fixed in 7.1.5.2.

  • A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments.

    Affected: from 6.0.0, fixed in 6.0.6.1; from 6.1.0, fixed in 6.1.7.1; from 7.0.0, fixed in 7.0.4.1.

  • A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1.

    Affected: fixed in 6.1.7.1; from 7.0.0, fixed in 7.0.4.1.

  • CVE-2022-32224Critical 9.8

    A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and…

    Affected: from 7.0.0, fixed in 7.0.3.1; from 6.1.0, fixed in 6.1.6.1; from 6.0.0, fixed in 6.0.5.1; fixed in 5.2.8.1.

  • The PostgreSQL adapter in Active Record before 6.1.2.1, 6.0.3.5, 5.2.4.5 suffers from a regular expression denial of service (REDoS)…

    Affected: from 5.0.0, fixed in 5.2.4.5; from 6.0.0, fixed in 6.0.3.5; from 6.1.0, fixed in 6.1.2.1.

  • Action Record in Ruby on Rails 4.2.x before 4.2.7.1 does not properly consider differences in parameter handling between the Active Record…

    Affected: from 4.2.0, fixed in 4.2.7.1.

  • activerecord/lib/active_record/nested_attributes.rb in Active Record in Ruby on Rails 3.1.x and 3.2.x before 3.2.22.1, 4.0.x and 4.1.x…

    Affected: from 3.1.0, fixed in 3.2.22.1; from 4.0.0, fixed in 4.1.14.1; from 4.2.0, fixed in 4.2.5.1; from 5.0.0.beta1, fixed in 5.0.0.beta1.1.

  • activerecord/lib/active_record/relation/query_methods.rb in Active Record in Ruby on Rails 4.0.x before 4.0.9 and 4.1.x before 4.1.5…

    Affected: from 4.0.0, fixed in 4.0.9; from 4.1.0, fixed in 4.1.5.

  • SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in the PostgreSQL adapter for…

    Affected: from 4.0.0, fixed in 4.0.7; from 4.1.0, fixed in 4.1.3.

  • SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for…

    Affected: from 2.0.0, fixed in 3.2.19.

  • SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails…

    Affected: from 4.0.0, fixed in 4.0.3; from 4.1.0.beta1, fixed in 4.1.0.beta2.

  • The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x, and 3.2.x does not ensure that the declared data type of a database…

    Affected: fixed in 4.2.0.

  • The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries…

    Affected: from 2.3.0, fixed in 2.3.18; from 3.1.0, fixed in 3.1.12; from 3.2.0, fixed in 3.2.13.

  • ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary…

    Affected: fixed in 2.3.17; from 3.0.0, fixed in 3.1.0.

  • ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the…

    Affected: fixed in 2.3.17; from 3.1.0, fixed in 3.1.11; from 3.2.0, fixed in 3.2.12.

Show all 23 advisoriesShow fewer advisories

  • Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter…

    Affected: from 3.0.0, fixed in 3.0.19; from 3.1.0, fixed in 3.1.10; from 3.2.0, fixed in 3.2.11.

  • SQL injection vulnerability in the Active Record component in Ruby on Rails before 3.0.18, 3.1.x before 3.1.9, and 3.2.x before 3.2.10…

    Affected: from 3.0.0.beta, fixed in 3.0.18; from 3.1.0, fixed in 3.1.9; from 3.2.0, fixed in 3.2.10; fixed in 2.3.15.

  • The Active Record component in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly implement the…

    Affected: from 3.0.0.beta, fixed in 3.0.14; from 3.1.0, fixed in 3.1.6; from 3.2.0, fixed in 3.2.6; fixed in 2.3.15.

  • The Active Record component in Ruby on Rails 3.0.x before 3.0.13, 3.1.x before 3.1.5, and 3.2.x before 3.2.4 does not properly implement…

    Affected: from 3.0.0, fixed in 3.0.13; from 3.1.0, fixed in 3.1.5; from 3.2.0, fixed in 3.2.4.

  • Multiple SQL injection vulnerabilities in the quote_table_name method in the ActiveRecord adapters in…

    Affected: from 2.0.0, fixed in 2.3.13; from 3.0.0.beta, fixed in 3.0.10; from 3.1.0.beta1, fixed in 3.1.0.rc5.

  • Ruby on Rails 3.0.x before 3.0.4 does not ensure that arguments to the limit function specify integer values, which makes it easier for…

    Affected: from 3.0.0, fixed in 3.0.4.

  • Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by…

    Affected: from 2.3.9, fixed in 2.3.10; from 3.0.0, fixed in 3.0.1.

  • Multiple SQL injection vulnerabilities in Ruby on Rails before 2.1.1 allow remote attackers to execute arbitrary SQL commands via the (1)…

    Affected: fixed in 2.1.1.