A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.
CVSS Details
- CVSS 3.1 Base Score: 8.8
- CVSS 3.1 Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H)
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Centos_linux | — | Upgrade rubygem-unf_extUpgrade rubygem-mime-types-dataUpgrade satellite-cliUpgrade rubygem-oauth-ttyUpgrade rubygem-http-cookieUpgrade rubygem-mime-typesUpgrade rubygem-http-acceptUpgrade rubygem-unicode-debugsourceUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-hammer_cliUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_ansibleUpgrade satellite-cloneUpgrade rubygem-amazing_printUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-unfUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-multi_jsonUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-unicodeUpgrade python39-pulp_manifestUpgrade rubygem-ffiUpgrade rubygem-localeUpgrade rubygem-apipie-bindingsUpgrade rubygem-fast_gettextUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-domain_nameUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-powerbarUpgrade rubygem-version_gemUpgrade rubygem-clampUpgrade rubygem-hashieUpgrade rubygem-unicode-display_widthUpgrade rubygem-loggingUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-gssapiUpgrade rubygem-oauthUpgrade rubygem-rest-clientUpgrade rubygem-snaky_hashUpgrade rubygem-netrcUpgrade rubygem-jwtUpgrade rubygem-highlineUpgrade rubygem-foreman_maintainUpgrade foreman-cliUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-ffi-debugsourceUpgrade rubygem-hammer_cli_foreman_templatesUpgrade satellite-maintainUpgrade rubygem-little-plugger | Nov 13, 2023 | Feb 9, 2023 |
| Debian | — | Upgrade rails | Mar 14, 2023 | Feb 9, 2023 |
| Redhat_linux | — | Upgrade rubygem-clampUpgrade rubygem-highlineUpgrade rubygem-http-acceptUpgrade rubygem-hammer_cli_foremanUpgrade rubygem-hashieUpgrade foreman-cliUpgrade rubygem-loggingUpgrade satellite-maintainUpgrade rubygem-hammer_cli_foreman_discoveryUpgrade rubygem-hammer_cli_foreman_tasksUpgrade rubygem-version_gemUpgrade rubygem-netrcUpgrade rubygem-unicode-display_widthUpgrade rubygem-hammer_cli_foreman_webhooksUpgrade rubygem-snaky_hashUpgrade rubygem-ffi-debugsourceUpgrade rubygem-multi_jsonUpgrade rubygem-mime-typesUpgrade rubygem-hammer_cli_foreman_adminUpgrade rubygem-hammer_cli_foreman_templatesUpgrade rubygem-jwtUpgrade rubygem-unf_ext-debugsourceUpgrade rubygem-foreman_maintainUpgrade rubygem-domain_nameUpgrade rubygem-unicode-debugsourceUpgrade satellite-cloneUpgrade python39-pulp_manifestUpgrade rubygem-oauthUpgrade rubygem-mime-types-dataUpgrade rubygem-apipie-bindingsUpgrade rubygem-unicode-debuginfoUpgrade rubygem-hammer_cliUpgrade satellite-cliUpgrade rubygem-hammer_cli_foreman_remote_executionUpgrade rubygem-localeUpgrade rubygem-hammer_cli_foreman_azure_rmUpgrade rubygem-rest-clientUpgrade rubygem-ffiUpgrade rubygem-little-pluggerUpgrade rubygem-oauth-ttyUpgrade rubygem-hammer_cli_katelloUpgrade rubygem-unf_ext-debuginfoUpgrade rubygem-http-cookieUpgrade rubygem-gssapiUpgrade rubygem-hammer_cli_foreman_googleUpgrade rubygem-unicodeUpgrade rubygem-amazing_printUpgrade rubygem-ffi-debuginfoUpgrade rubygem-hammer_cli_foreman_openscapUpgrade rubygem-hammer_cli_foreman_bootdiskUpgrade rubygem-fast_gettextUpgrade rubygem-unf_extUpgrade rubygem-unfUpgrade rubygem-powerbarUpgrade rubygem-hammer_cli_foreman_virt_who_configureUpgrade rubygem-hammer_cli_foreman_ansible | Nov 13, 2023 | Feb 9, 2023 |
| Rocky_linux | — | Upgrade libdb-debuginfoUpgrade libdb-utils-debuginfoUpgrade libdb-sql-debuginfoUpgrade libdb-cxxUpgrade libdb-cxx-debuginfoUpgrade libdb-debugsourceUpgrade libdb-sql-devel-debuginfo | Mar 5, 2024 | Feb 9, 2023 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub