CVE-2013-0155

Description

Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.

References

https://puppet.com/security/cve/cve-2013-0155

https://groups.google.com/group/rubyonrails-security/msg/bc6f13dafe130ee9?dmode=source&output=gplain

http://www.debian.org/security/2013/dsa-2609

http://support.apple.com/kb/HT5784

http://rhn.redhat.com/errata/RHSA-2013-0155.html

http://rhn.redhat.com/errata/RHSA-2013-0154.html

http://lists.opensuse.org/opensuse-updates/2014-01/msg00003.html

http://lists.opensuse.org/opensuse-updates/2013-12/msg00082.html

http://lists.opensuse.org/opensuse-updates/2013-12/msg00081.html

http://lists.opensuse.org/opensuse-updates/2013-12/msg00079.html

http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html

http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A

Details

Source: Mitre, NVD

Risk Information

CVSS v2

CVSS v3