Stay Secure with the Latest Linux Advisories
Refine advisories
X Clear Filters
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Loading...
Explore Latest Linux Security advisories
We found -4 articles for you...
89
security advisorycritical issuesecurity updateFedora 30: FEDORA-2019-1cfe24db5c Critical: Active Record Code Execution
Update Ruby on Rails to 5.2.3. Fixes CVE-2019-5418 CVE-2019-5419 CVE-2019-5420.. --------------------------------------------------------------------------------Fedora Update Notification FEDORA-2019-1cfe24db5c 2019-05-10 00:46:38.157347 --------------------------------------------------------------------------------Name : rubygem-activerecord Product : Fedora 30 Version : 5.2.3 Release : 1.fc30 URL : https://rubyonrails.org/ Summary : Object-relational mapper framework (part of Rails) Description : Implements the ActiveRecord pattern (Fowler, PoEAA) for ORM. It ties database tables and classes together for business objects, like Customer or Subscription, that can find, save, and destroy themselves without resorting to manual SQL. --------------------------------------------------------------------------------Update Information: Update Ruby on Rails to 5.2.3. Fixes CVE-2019-5418 CVE-2019-5419 CVE-2019-5420. --------------------------------------------------------------------------------ChangeLog: * Thu Mar 28 2019 Pavel Valena - 1:5.2.3-1 - Update to Active Record 5.2.3. * Thu Mar 14 2019 Pavel Valena - 1:5.2.2.1-1 - Update to Active Record 5.2.2.1. --------------------------------------------------------------------------------References: [ 1 ] Bug #1689161 - CVE-2019-5418 CVE-2019-5419 rubygem-actionview: various flaws [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1689161 [ 2 ] Bug #1689155 - CVE-2019-5420 rubygem-rails: Weak secret token leading to possible code execution [fedora-all] https://bugzilla.redhat.com/show_bug.cgi?id=1689155 --------------------------------------------------------------------------------This update can be installed with the "dnf" update program. Use su -c 'dnf upgrade --advisory FEDORA-2019-1cfe24db5c' at the command line. For more information, refer to the dnf documentation available at https://dnf.readthedocs.io/en/latest/command_ref.html All packages are signed with theFedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ --------------------------------------------------------------------------------_______________________________________________ package-announce mailing list --
May 09, 2019
•Critical
Fedora
98
security advisorysecurity updatered hatRed Hat Software Collections: RHSA-2014:1102-01 Important Active Record Fix
Updated ror40-rubygem-activerecord packages that fix one security issue are now available for Red Hat Software Collections 1. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which. -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 ==================================================================== Red Hat Security Advisory Synopsis: Important: ror40-rubygem-activerecord security update Advisory ID: RHSA-2014:1102-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2014:1102.html Issue date: 2014-08-27 CVE Names: CVE-2014-3514 ==================================================================== 1. Summary: Updated ror40-rubygem-activerecord packages that fix one security issue are now available for Red Hat Software Collections 1. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) - noarch Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7) - noarch Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4) - noarch Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6) - noarch Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 7) - noarch 3. Description: Ruby on Rails is a model-view-controller (MVC) framework for web application development. Active Record implements object-relational mapping for accessing database entries using objects. It was discovered that Active Record's create_with method failed to properly check attributes passed to it. A remote attacker could possibly use this flaw to bypass the strong parameterprotection and modify arbitrary model attributes via mass assignment if an application using Active Record called create_with with untrusted values. (CVE-2014-3514) All ror40-rubygem-activerecord users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1131240 - CVE-2014-3514 rubygem-activerecord: Strong Parameter bypass with create_with 6. Package List: Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6): Source: ror40-rubygem-activerecord-4.0.2-2.3.el6.src.rpm noarch: ror40-rubygem-activerecord-4.0.2-2.3.el6.noarch.rpm ror40-rubygem-activerecord-doc-4.0.2-2.3.el6.noarch.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4): Source: ror40-rubygem-activerecord-4.0.2-2.3.el6.src.rpm noarch: ror40-rubygem-activerecord-4.0.2-2.3.el6.noarch.rpm ror40-rubygem-activerecord-doc-4.0.2-2.3.el6.noarch.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6): Source: ror40-rubygem-activerecord-4.0.2-2.3.el6.src.rpm noarch: ror40-rubygem-activerecord-4.0.2-2.3.el6.noarch.rpm ror40-rubygem-activerecord-doc-4.0.2-2.3.el6.noarch.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7): Source: ror40-rubygem-activerecord-4.0.2-2.3.el7.src.rpm noarch: ror40-rubygem-activerecord-4.0.2-2.3.el7.noarch.rpm ror40-rubygem-activerecord-doc-4.0.2-2.3.el7.noarch.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 7): Source: ror40-rubygem-activerecord-4.0.2-2.3.el7.src.rpm noarch: ror40-rubygem-activerecord-4.0.2-2.3.el7.noarch.rpm ror40-rubygem-activerecord-doc-4.0.2-2.3.el7.noarch.rpm Thesepackages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are available from https://access.redhat.com/security/team/key/#package 7. References: https://access.redhat.com/security/cve/CVE-2014-3514 https://access.redhat.com/security/updates/classification/#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact/ Copyright 2014 Red Hat, Inc. -----BEGIN PGP SIGNATURE----- Version: GnuPG v1 iD8DBQFT/essXlSAg2UNWIIRAnRtAJwO/bVMwfsjnC4jNqOFw8xgeMP18ACgqeeZ QrU4rqoVm+ElHHGmf8QFOO0=N8hH -----END PGP SIGNATURE----- -- Enterprise-watch-list mailing list
Aug 27, 2014
•Important
Red Hat
98
security advisoryremote exploitred hatRed Hat Software Collections: RHSA-2014:1102-01 Important ActiveRecord Fix
Updated ror40-rubygem-activerecord packages that fix one security issue are now available for Red Hat Software Collections 1. Red Hat Product Security has rated this update as having Important security [More...]. ==================================================================== Red Hat Security Advisory Synopsis: Important: ror40-rubygem-activerecord security update Advisory ID: RHSA-2014:1102-01 Product: Red Hat Software Collections Advisory URL: https://access.redhat.com/errata/RHSA-2014:1102.html Issue date: 2014-08-27 CVE Names: CVE-2014-3514 ==================================================================== 1. Summary: Updated ror40-rubygem-activerecord packages that fix one security issue are now available for Red Hat Software Collections 1. Red Hat Product Security has rated this update as having Important security impact. A Common Vulnerability Scoring System (CVSS) base score, which gives a detailed severity rating, is available from the CVE link in the References section. 2. Relevant releases/architectures: Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6) - noarch Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7) - noarch Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4) - noarch Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6) - noarch Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 7) - noarch 3. Description: Ruby on Rails is a model-view-controller (MVC) framework for web application development. Active Record implements object-relational mapping for accessing database entries using objects. It was discovered that Active Record's create_with method failed to properly check attributes passed to it. A remote attacker could possibly use this flaw to bypass the strong parameter protection and modify arbitrary model attributes via mass assignment if an application using Active Record calledcreate_with with untrusted values. (CVE-2014-3514) All ror40-rubygem-activerecord users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue. 4. Solution: Before applying this update, make sure all previously released errata relevant to your system have been applied. This update is available via the Red Hat Network. Details on how to use the Red Hat Network to apply this update are available at https://access.redhat.com/articles/11258 5. Bugs fixed (https://bugzilla.redhat.com/): 1131240 - CVE-2014-3514 rubygem-activerecord: Strong Parameter bypass with create_with 6. Package List: Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 6): Source: ror40-rubygem-activerecord-4.0.2-2.3.el6.src.rpm noarch: ror40-rubygem-activerecord-4.0.2-2.3.el6.noarch.rpm ror40-rubygem-activerecord-doc-4.0.2-2.3.el6.noarch.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Server EUS (v. 6.4): Source: ror40-rubygem-activerecord-4.0.2-2.3.el6.src.rpm noarch: ror40-rubygem-activerecord-4.0.2-2.3.el6.noarch.rpm ror40-rubygem-activerecord-doc-4.0.2-2.3.el6.noarch.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 6): Source: ror40-rubygem-activerecord-4.0.2-2.3.el6.src.rpm noarch: ror40-rubygem-activerecord-4.0.2-2.3.el6.noarch.rpm ror40-rubygem-activerecord-doc-4.0.2-2.3.el6.noarch.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Server (v. 7): Source: ror40-rubygem-activerecord-4.0.2-2.3.el7.src.rpm noarch: ror40-rubygem-activerecord-4.0.2-2.3.el7.noarch.rpm ror40-rubygem-activerecord-doc-4.0.2-2.3.el7.noarch.rpm Red Hat Software Collections 1 for Red Hat Enterprise Linux Workstation (v. 7): Source: ror40-rubygem-activerecord-4.0.2-2.3.el7.src.rpm noarch: ror40-rubygem-activerecord-4.0.2-2.3.el7.noarch.rpm ror40-rubygem-activerecord-doc-4.0.2-2.3.el7.noarch.rpm These packages are GPG signed by Red Hat for security. Our key and details on how to verify the signature are availablefrom https://access.redhat.com/security/team/key#package 7. References: https://access.redhat.com/security/cve/CVE-2014-3514 https://access.redhat.com/security/updates/classification#important 8. Contact: The Red Hat security contact is . More contact details at https://access.redhat.com/security/team/contact Copyright 2014 Red Hat, Inc. . Red Hat releases a vital security alert concerning the ror40-rubygem-activemodel update to enhance critical safeguarding.. Rubygem ActiveRecord, Red Hat Advisory, Software Update. . Severity: Important. LinuxSecurity.com Team
Aug 27, 2014
•Important
Red Hat
87
security advisorymoderatedebianDebian 7 Wheezy DSA-2982-1 Moderate: ActiveRecord SQL Injection Risk
Sean Griffin discovered two vulnerabilities in the PostgreSQL adapter for Active Record which could lead to SQL injection. For the stable distribution (wheezy), these problems have been fixed in . -----BEGIN PGP SIGNED MESSAGE----- Hash: SHA1 - ------------------------------------------------------------------------- Debian Security Advisory DSA-2982-1
Jul 19, 2014
Debian
91
security advisoryupdategentooGentoo: GLSA 202302-18 Moderate: Enhanced Metadata Exposure Vulnerability
A vulnerability in Active Record could allow a remote attacker to inject SQL commands.. - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Gentoo Linux Security Advisory GLSA 201401-22 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - https://security.gentoo.org/ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Severity: Low Title: Active Record: SQL injection Date: January 21, 2014 Bugs: #449826 ID: 201401-22 - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - Synopsis ======= A vulnerability in Active Record could allow a remote attacker to inject SQL commands. Background ========= Active Record is a Ruby gem that allows database entries to be manipulated as objects. Affected packages ================ ------------------------------------------------------------------- Package / Vulnerable / Unaffected ------------------------------------------------------------------- 1 dev-ruby/activerecord < 2.3.14-r1 > = 2.3.14-r1 Description ========== An Active Record method parameter can mistakenly be used as a scope. Impact ===== A remote attacker could use specially crafted input to execute arbitrary SQL statements. Workaround ========= The vulnerability may be mitigated by converting the input to an expected value. This is accomplished by changing instances of 'Post.find_by_id(params[:id])' in code using Active Record to 'Post.find_by_id(params[:id].to_s)' Resolution ========= All Active Record users should upgrade to the latest version: # emerge --sync # emerge --ask --oneshot -v "> =dev-ruby/activerecord-2.3.14-r1" References ========= [ 1 ] CVE-2012-6496 http://nvd.nist.gov/nvd.cfm?cvename=CVE-2012-6496 Availability =========== This GLSA and any updates to it are available for viewing at the Gentoo Security Website: https://security.gentoo.org/glsa/201401-22 Concerns? ======== Security is a primary focus of Gentoo Linux and ensuring the confidentiality and security of our users' machines is of utmost importance to us. Any security concerns should be addressed to
Jan 21, 2014
•Low
Gentoo
Get the latest News and Insights
Get the latest Linux and open source security news straight to your inbox.
Community Poll
What got you started with Linux?
Search Topics
Powered By
Linux Security - Your source for Top Linux News, Advisories, HOWTOs and Feature Releases
QUICK LINKS
subscribe to newsletters!
Like staying secure? So do we.
Sign up for updates, tips, and alerts!