Overly broad permissions can turn one compromised account into a much larger security problem. Learn how to reduce unnecessary access, review privileges, and apply least privilege across modern Linux systems. Review Linux Privileges×

Alerts This Week
Warning Icon 1 542
Alerts This Week
Warning Icon 1 542

SUSE: 2013:0606-1 Important: Ruby on Rails SQL Injection Threat

suse
Calendar Grey April 3, 2013
Scroller Suse
Important SUSE patch for Ruby on Rails addresses various security flaws and offers guidance for implementation.
An update that solves 5 vulnerabilities and has one errata An update that solves 5 vulnerabilities and has one errata An update that solves 5 vulnerabilities and has one errata is ...

Summary

The Ruby on Rails stack has been updated to 2.3.17 to fix various security issues and bugs. The rails gems were updated to fix: * Unsafe Query Generation Risk in Ruby on Rails (CVE-2013-0155) * Multiple vulnerabilities in parameter parsing in Action Pack (CVE-2013-0156) * SQL Injection Vulnerability in Active Record (CVE-2012-5664) * rails: Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 (CVE-2013-0333) * activerecord: Circumvention of attr_protected (CVE-2013-0276) * activerecord: Serialized Attributes YAML Vulnerability with Rails 2.3 and 3.0 (CVE-2013-0277) Security Issue references: * CVE-2012-5664 * CVE-2013-0155 * CVE-2013-0156

Topics%20covered

Topics Covered

security advisory SQL Injection web application SUSE Ruby on Rails parameter parsing patch instructions

References

#796712 #797449 #797452 #800320 #803336 #803339

Cross- CVE-2012-5664 CVE-2013-0155 CVE-2013-0156

CVE-2013-0276 CVE-2013-0333

Affected Products:

WebYaST 1.2

SUSE Studio Standard Edition 1.2

SUSE Studio Onsite 1.2

SUSE Studio Extension for System z 1.2

https://www.suse.com/security/cve/CVE-2012-5664.html

https://www.suse.com/security/cve/CVE-2013-0155.html

https://www.suse.com/security/cve/CVE-2013-0156.html

https://www.suse.com/security/cve/CVE-2013-0276.html

https://www.suse.com/security/cve/CVE-2013-0333.html

Severity
important
Lowest
Low
Medium
High
Critical

Announcement ID: SUSE-SU-2013:0606-1
Rating: important

Topics%20covered

Topics Covered

security advisory SQL Injection web application SUSE Ruby on Rails parameter parsing patch instructions

Get the latest News and Insights

Get the latest Linux and open source security news straight to your inbox.