Date: Thu, 03 Jan 2013 13:30:52 +0100 From: Carlos Alberto Lopez Perez <clopez@...lia.com> To: oss-security@...ts.openwall.com CC: Aaron Patterson <tenderlove@...y-lang.org>, rubyonrails-security@...glegroups.com Subject: Re: SQL Injection Vulnerability in Ruby on Rails (CVE-2012-5664) On 02/01/13 22:22, Aaron Patterson wrote: > There is a SQL injection vulnerability in Active Record in ALL versions. This vulnerability has been assigned the CVE identifier CVE-2012-5664. CVE-2012-5664 literally says: "SQL injection vulnerability in the Authlogic gem for Ruby on Rails allows remote attackers to execute arbitrary SQL commands via a crafted parameter in conjunction with a secret_token value, related to certain behavior of find_by_id and other find_by_ methods." However in your description of the bug I don't see any references to the Authlogic gem. This rather seems to be a generic RoR issue. And both Debian and Ubuntu have marked this CVE as NOT-FOR-US because of this (they don't ship Authlogic gem). Could you please clarify this? Thanks! Download attachment "signature.asc" of type "application/pgp-signature" (901 bytes)
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.