Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 516084 (CVE-2014-3482) - <dev-ruby/rails-{3.2.19,4.0.8,4.1.4}: Two Active Record SQL Injection Vulnerabilities Affecting PostgreSQL (CVE-2014-{3482,3483})
Summary: <dev-ruby/rails-{3.2.19,4.0.8,4.1.4}: Two Active Record SQL Injection Vulnera...
Status: RESOLVED FIXED
Alias: CVE-2014-3482
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial (vote)
Assignee: Gentoo Security
URL: http://seclists.org/oss-sec/2014/q3/5
Whiteboard: ~3 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2014-07-02 17:19 UTC by Kristian Fiskerstrand (RETIRED)
Modified: 2014-07-16 00:03 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Kristian Fiskerstrand (RETIRED) gentoo-dev 2014-07-02 17:19:02 UTC
From ${URL}:
There are two distinct but related vulnerabilities in PostgreSQL
adapter for Active Record. These vulnerabilities have been assigned
the CVE identifiers CVE-2014-3482 and CVE-2014-3483.

Versions Affected:  All Versions > 2.0
Not affected:       Databases other than PostgreSQL
Fixed Versions:     3.2.19, 4.0.7 & 4.1.3

Impact
------
PostgreSQL supports a number of unique data types which are not
present in other supported databases.  A bug in the SQL quoting code
in ActiveRecord can allow an attacker to inject arbitrary SQL using
carefully crafted values.

Only applications which query against either bitstring or range types
are vulnerable. The particular data types affected depend on the
version of Rails you're using, but the vulnerable code will look the
same.  Vulnerable code will take either take the form of:

  Model.where(bitstring: params[:some_value])
  Model.where(range: params[:from]..params[:to])

The specific versions affected is included below, however all users
running an affected release should upgrade immediately.

SQL Injection Vulnerability in 'bitstring' quoting
==================================================
Versions Affected: 2.0.0-3.2.18
Not Affected: 4.0 and Later
Identifier: CVE-2014-3482

SQL Injection Vulnerability in 'range' quoting
==============================================
Versions Affected: 4.0.0-4.1.2
Not Affected: All versions prior to 4.0.0
Identifier: CVE-2014-3483

Releases
--------
The 3.2.19, 4.0.7 & 4.1.3 releases are available at the normal locations.

Workarounds
-----------
The only feasible workaround for this issue is to not allow user
controlled values to be used in queries with the affected data types.
Given the difficulty of ensuring this, upgrading is strongly advised.

Patches
-------
To aid users who aren't able to upgrade immediately we have provided
patches for the two supported release series and the last major
release series.  They are in git-am format and consist of a single
changeset.

* 4-1-postgres-sqli.patch - Patch for 4.1 series
* 4-0-postgres-sqli.patch - Patch for 4.0 series
* 3-2-postgres-sqli.patch - Patch for 3.2 series

Please note that only the 4.0.x and 4.1.x series receive regular
security updates at present.  Users of earlier unsupported releases
are advised to upgrade as soon as possible as we cannot guarantee the
continued availability of security fixes for earlier releases.

Credits
-------

Thanks to Sean Griffin of thoughtbot for reporting the vulnerability
to us, and to Jeff Jarmoc of Matasano and Charlie Somerville of GitHub
for working with us to review the patches and advisories.
Comment 1 Hans de Graaff gentoo-dev 2014-07-03 06:21:41 UTC
Rails 3.2.19, 4.0.8, and 4.0.9 are now in the tree.
Comment 2 Hans de Graaff gentoo-dev 2014-07-03 06:22:11 UTC
(In reply to Hans de Graaff from comment #1)
> Rails 3.2.19, 4.0.8, and 4.0.9 are now in the tree.

That should be 3.2.19, 4.0.8, and 4.1.4...
Comment 3 Agostino Sarubbo gentoo-dev 2014-07-03 09:31:58 UTC
Thanks.

Closing as noglsa.
Comment 4 Kristian Fiskerstrand (RETIRED) gentoo-dev 2014-07-03 10:16:14 UTC
Re-opening for cleanup

@maintainers: Thanks for adding the ebuild, as this package does not need stabilization we're mostly done, but please remove all vulnerable versions.
Comment 5 Hans de Graaff gentoo-dev 2014-07-12 07:03:36 UTC
Vulnerable versions have been removed.
Comment 6 Yury German Gentoo Infrastructure gentoo-dev 2014-07-16 00:02:57 UTC
Maintainer(s), Thank you for cleanup!

No GLSA - Closing Bug as Resolved
Comment 7 GLSAMaker/CVETool Bot gentoo-dev 2014-07-16 00:03:59 UTC
CVE-2014-3483 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3483):
  SQL injection vulnerability in
  activerecord/lib/active_record/connection_adapters/postgresql/quoting.rb in
  the PostgreSQL adapter for Active Record in Ruby on Rails 4.x before 4.0.7
  and 4.1.x before 4.1.3 allows remote attackers to execute arbitrary SQL
  commands by leveraging improper range quoting.

CVE-2014-3482 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2014-3482):
  SQL injection vulnerability in
  activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in
  the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before
  3.2.19 allows remote attackers to execute arbitrary SQL commands by
  leveraging improper bitstring quoting.