[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <50E579FC.2060302@igalia.com>
Date: Thu, 03 Jan 2013 13:30:52 +0100
From: Carlos Alberto Lopez Perez <clopez@...lia.com>
To: oss-security@...ts.openwall.com
CC: Aaron Patterson <tenderlove@...y-lang.org>,
rubyonrails-security@...glegroups.com
Subject: Re: SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664)
On 02/01/13 22:22, Aaron Patterson wrote:
> There is a SQL injection vulnerability in Active Record in ALL versions. This vulnerability has been assigned the CVE identifier CVE-2012-5664.
CVE-2012-5664 literally says:
"SQL injection vulnerability in the Authlogic gem for Ruby on Rails
allows remote attackers to execute arbitrary SQL commands via a crafted
parameter in conjunction with a secret_token value, related to certain
behavior of find_by_id and other find_by_ methods."
However in your description of the bug I don't see any references to the
Authlogic gem. This rather seems to be a generic RoR issue.
And both Debian and Ubuntu have marked this CVE as NOT-FOR-US because of
this (they don't ship Authlogic gem).
Could you please clarify this?
Thanks!
Download attachment "signature.asc" of type "application/pgp-signature" (901 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
