MEDIUM

GHSA-gr44-7grc-37vq

ActiveRecord vulnerable to modification of protected model attributes

Quick fix

GHSA-gr44-7grc-37vq — activerecord: upgrade to the fixed version with the command below.

bundle update activerecord

Details

ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the `attr_protected` protection mechanism and modify protected model attributes via a crafted request.

Are you affected?

Enter the version of the package you're using.

Affected packages

RubyGems/activerecord

Introduced in: 0Fixed in: 2.3.17

Fixbundle update activerecord

RubyGems/activerecord

Introduced in: 3.1.0Fixed in: 3.1.11

Fixbundle update activerecord

RubyGems/activerecord

Introduced in: 3.2.0Fixed in: 3.2.12

Fixbundle update activerecord

References

https://nvd.nist.gov/vuln/detail/CVE-2013-0276[ADVISORY]
https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2013-0276.yml[WEB]
https://groups.google.com/group/rubyonrails-security/msg/bb44b98a73ef1a06?dmode=source&output=gplain[WEB]
https://web.archive.org/web/20130217055442/http://www.securityfocus.com/bid/57896[WEB]
http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html[WEB]
http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html[WEB]
http://rhn.redhat.com/errata/RHSA-2013-0686.html[WEB]
http://support.apple.com/kb/HT5784[WEB]
http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released[WEB]
http://www.debian.org/security/2013/dsa-2620[WEB]
http://www.openwall.com/lists/oss-security/2013/02/11/5[WEB]