Vulnerability advisory

GHSA-q34c-48gc-m9g8

actionpack allows remote attackers to bypass database-query restrictions, perform NULL checks via crafted request

Published Oct 24, 2017Updated Jan 20, 2025OSV record ↗

Also known as CVE-2012-2694

Severity

Severity not reported.

Affected versions

actionpack RubyGems

All actionpack advisories →

Affected	Fixed in
`3.0.13` to before 3.0.14	`3.0.14`Advisories →
Also listed as affected (1) `3.0.13`
`3.1.0` to before 3.1.6	`3.1.6`Advisories →
Also listed as affected (13) `3.1.0` `3.1.1` `3.1.1.rc1` `3.1.1.rc2` `3.1.1.rc3` `3.1.2` `3.1.2.rc1` `3.1.2.rc2` `3.1.3` `3.1.4` `3.1.4.rc1` `3.1.5` `3.1.5.rc1`
`3.2.0` to before 3.2.6	`3.2.6`Advisories →
Also listed as affected (10) `3.2.0` `3.2.1` `3.2.2` `3.2.2.rc1` `3.2.3` `3.2.3.rc1` `3.2.3.rc2` `3.2.4` `3.2.4.rc1` `3.2.5`

Description

actionpack/lib/action_dispatch/http/request.rb in Ruby on Rails before 3.0.14, 3.1.x before 3.1.6, and 3.2.x before 3.2.6 does not properly consider differences in parameter handling between the Active Record component and the Rack interface, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks via a crafted request, as demonstrated by certain ['xyz', nil] values, a related issue to CVE-2012-2660.

GHSA-q34c-48gc-m9g8

Affected versions

actionpack RubyGems

Description

References