CVE-2014-3514

Related Files

Red Hat Security Advisory 2014-1102-01

Posted Aug 27, 2014

Authored by Red Hat | Site access.redhat.com

Red Hat Security Advisory 2014-1102-01 - Ruby on Rails is a model-view-controller framework for web application development. Active Record implements object-relational mapping for accessing database entries using objects. It was discovered that Active Record's create_with method failed to properly check attributes passed to it. A remote attacker could possibly use this flaw to bypass the strong parameter protection and modify arbitrary model attributes via mass assignment if an application using Active Record called create_with with untrusted values. All ror40-rubygem-activerecord users are advised to upgrade to these updated packages, which contain a backported patch to correct this issue.

tags | advisory, remote, web, arbitrary, ruby

systems | linux, redhat

advisories | CVE-2014-3514

SHA-256 | 2cd25f0dba5c66d9dc2d6f4a7e6c235747fedffc056844c7ef6d7252249588e3

Download | Favorite | View