VDB
Sign up
MEDIUM

GHSA-3crr-9vmg-864v

Active Record Improper Input Validation

Quick fix

GHSA-3crr-9vmg-864v — activerecord: upgrade to the fixed version with the command below.

bundle update activerecord

Details

The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/activerecord
Introduced in: 2.3.0Fixed in: 2.3.18
Fixbundle update activerecord
RubyGems/activerecord
Introduced in: 3.1.0Fixed in: 3.1.12
Fixbundle update activerecord
RubyGems/activerecord
Introduced in: 3.2.0Fixed in: 3.2.13
Fixbundle update activerecord

References