A vulnerability in ActiveRecord
État des correctifs par distribution
Paquets corrigés publiés par chaque distribution pour cette CVE
- Debian DEBIAN-CVE-2023-22794 rails Corrigé dans: 2:6.0.3.7+dfsg-2+deb11u1
- Ubuntu UBUNTU-CVE-2023-22794 rails
Description d'origine La description telle que publiée par la source (souvent en anglais).
A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the annotate query method, the optimizer_hints query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.
Source: OSV.dev (Open Source Vulnerabilities) NVD GitHub Advisory OSV
Références
- advisory github.com
- advisory nvd.nist.gov
- advisory security.netapp.com
- advisory debian.org
- web discuss.rubyonrails.org