A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE.
CVSS Details
- CVSS 3.1 Base Score: 9.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-foreman_maintainUpgrade foreman-cliUpgrade satellite-cliUpgrade satellite-clone | Jan 19, 2023 | Dec 5, 2022 |
| Debian | — | Upgrade rails | Sep 6, 2022 | Sep 6, 2022 |
| Gentoo Linux | — | Upgrade dev-ruby/rails. | Aug 12, 2024 | Dec 5, 2022 |
| Redhat_linux | — | Upgrade rubygem-clampUpgrade rubygem-http-cookieUpgrade rubygem-unicode-display_widthUpgrade foreman-cliUpgrade rubygem-mime-types-dataUpgrade rubygem-hashieUpgrade python39-pulp_manifestUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-version_gemUpgrade rubygem-foreman_maintainUpgrade rubygem-highlineUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade satellite-cliUpgrade rubygem-unf_extUpgrade rubygem-oauthUpgrade rubygem-domain_nameUpgrade rubygem-rest-clientUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-netrcUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-fast_gettextUpgrade rubygem-jwtUpgrade satellite-cloneUpgrade rubygem-oauth-ttyUpgrade rubygem-unicodeUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cliUpgrade rubygem-apipie-bindingsUpgrade rubygem-multi_jsonUpgrade rubygem-localeUpgrade rubygem-mime-typesUpgrade rubygem-snaky_hashUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-ffi-debugsourceUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-ffiUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-http-acceptUpgrade rubygem-unfUpgrade rubygem-little-pluggerUpgrade rubygem-amazing_printUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-logging | Jan 19, 2023 | Dec 5, 2022 |
| Rocky_linux | — | Upgrade libdb-utils-debuginfoUpgrade libdb-cxx-debuginfoUpgrade libdb-cxxUpgrade libdb-sql-debuginfoUpgrade libdb-debugsourceUpgrade libdb-debuginfoUpgrade libdb-sql-devel-debuginfo | Mar 12, 2024 | Dec 5, 2022 |
| Suse | — | Upgrade ruby2.5-rubygem-activerecord-doc-5.2Upgrade ruby2.5-rubygem-activerecord-5.2 | Jan 12, 2023 | Dec 5, 2022 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub