CVE-2014-3482 SQL Injection in Active Record
Remote attackers can execute arbitrary SQL commands in Ruby on Rails applications via improper bitstring quoting in the PostgreSQL adapter.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2014-3482?
CVE-2014-3482 is a high-severity SQL injection vulnerability in Rubyonrails Rails, published on 7 Jul 2014. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.
Weakness: CWE-89
Which versions are affected by CVE-2014-3482?
2 open source packages ship an affected version, including activerecord. It affects 2 products.
| Package | Affected | Fixed in |
|---|---|---|
activerecord RubyGems | From 2.0.0 | 3.2.19 |
activerecord RubyGems | From 2.0.0 | 3.2.19 |
Linux distribution packages (4)
ruby193-rubygem-activerecord Red Hat:rhel_software_collections:1::el6 | All versions | 1:3.2.8-8.2.el6 |
ruby193-rubygem-activerecord-doc Red Hat:rhel_software_collections:1::el6 | All versions | 1:3.2.8-8.2.el6 |
ruby193-rubygem-activerecord Red Hat:rhel_software_collections:1::el7 | All versions | 1:3.2.8-8.2.el7 |
ruby193-rubygem-activerecord-doc Red Hat:rhel_software_collections:1::el7 | All versions | 1:3.2.8-8.2.el7 |
Products include Rubyonrails Rails, Rubyonrails Ruby on Rails.
How do I fix CVE-2014-3482?
Upgrade activerecord to 3.2.19 or later.
Use parameterised queries everywhere and never build SQL by joining strings. Upgrade affected software first; a web application firewall only buys time. More about SQL injection.
Is CVE-2014-3482 being exploited?
There is no known exploitation of CVE-2014-3482 in the wild and no public exploit code.
Other vulnerabilities in Rubyonrails Rails
- CVE-2013-0277 Active Record contains deserialization of arbitrary YAML
- CVE-2017-17916 SQL injection in n/a
- CVE-2017-17917 SQL injection in n/a
- CVE-2026-33195 Rails Active Storage has possible Path Traversal in DiskService
- CVE-2024-26142 Rails possible ReDoS vulnerability in Accept header parsing in Action Dispatch
Sources
Also known as DEBIAN-CVE-2014-3482, GHSA-mhwp-qhpc-h3jm, RHSA-2014:0876.