CVE-2014-0080 rubygem-activerecord: PostgreSQL array data injection vulnerability
Published: February 18, 2014
SECURITY IDENTIFIERS
- CVE: CVE-2014-0080 (NVD)
- GHSA: GHSA-hqf9-rc9j-5fmj
- OSVDB: OSVDB-103438
GEM
FRAMEWORK
UNAFFECTED VERSIONS
< 3.2.0
~> 3.2.0
PATCHED VERSIONS
~> 4.0.3
>= 4.1.0.beta2
DESCRIPTION
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql/cast.rb in Active Record in Ruby on Rails 4.0.x before 4.0.3, and 4.1.0.beta1, when PostgreSQL is used, allows remote attackers to execute "add data" SQL commands via vectors involving \ (backslash) characters that are not properly handled in operations on array columns.