A vulnerability in ActiveRecord
Fix status by distribution
Fixed packages published by each distribution for this CVE
- Debian DEBIAN-CVE-2023-22794 rails Fixed in: 2:6.0.3.7+dfsg-2+deb11u1
- Ubuntu UBUNTU-CVE-2023-22794 rails
Original description The description as published by the source.
A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the annotate query method, the optimizer_hints query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
References
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- advisory debian.org
- web discuss.rubyonrails.org