Gentoo Websites Logo
Go to: Gentoo Home Documentation Forums Lists Bugs Planet Store Wiki Get Gentoo!
Bug 572954 (CVE-2015-7577) - <dev-ruby/activerecord-{3.2.22.2,4.1.15,4.2.6}: Nested attributes rejection proc bypass
Summary: <dev-ruby/activerecord-{3.2.22.2,4.1.15,4.2.6}: Nested attributes rejection p...
Status: RESOLVED FIXED
Alias: CVE-2015-7577
Product: Gentoo Security
Classification: Unclassified
Component: Vulnerabilities (show other bugs)
Hardware: All Linux
: Normal trivial
Assignee: Gentoo Security
URL: http://www.openwall.com/lists/oss-sec...
Whiteboard: ~4 [noglsa]
Keywords:
Depends on:
Blocks:
 
Reported: 2016-01-26 09:01 UTC by Agostino Sarubbo
Modified: 2016-06-05 12:22 UTC (History)
1 user (show)

See Also:
Package list:
Runtime testing required: ---


Attachments

Note You need to log in before you can comment on or make changes to this bug.
Description Agostino Sarubbo gentoo-dev 2016-01-26 09:01:25 UTC
From ${URL} :

Nested attributes rejection proc bypass in Active Record.

There is a vulnerability in how the nested attributes feature in Active Record
handles updates in combination with destroy flags when destroying records is
disabled. This vulnerability has been assigned the CVE identifier CVE-2015-7577.

Versions Affected:  3.1.0 and newer
Not affected:       3.0.x and older
Fixed Versions:     5.0.0.beta1.1, 4.2.5.1, 4.1.14.1, 3.2.22.1

Impact
------
When using the nested attributes feature in Active Record you can prevent the
destruction of associated records by passing the `allow_destroy: false` option
to the `accepts_nested_attributes_for` method. However due to a change in the
commit [a9b4b5d][1] the `_destroy` flag prevents the `:reject_if` proc from
being called because it assumes that the record will be destroyed anyway.

However this isn't true if `:allow_destroy` is false so this leads to changes
that would have been rejected being applied to the record. Attackers could use
this do things like set attributes to invalid values and to clear all of the
attributes amongst other things. The severity will be dependent on how the
application has used this feature.




@maintainer(s): since the fixed version is already in the tree, please remove the affected versions.
Comment 1 Hans de Graaff gentoo-dev Security 2016-02-07 17:48:57 UTC
Vulnerable versions for Rails 3.2, 4.1, and 4.2 have been removed.
Comment 2 Aaron Bauman (RETIRED) gentoo-dev 2016-06-05 12:22:06 UTC
Cleanup complete per previous comments.