Ruby on Rails Receives a SQL Injection Vulnerability Patch

Ruby on Rails Receives a SQL Injection Vulnerability Patch

The open-source Ruby on Rails web development framework has been in the spotlight this month after two SQL injection vulnerabilities were found, and subsequently patched.

The team blog meanwhile concentrates on an announcement that the security patches introduced a regression on the PostgreSQL Range feature. This regression was only introduced to Rails 4.x. Rails 3.2 users are not impacted.

The team writes, “Rails 3.2.19, 4.0.7, and 4.1.3 have been released! These three releases contain important security fixes, so please upgrade as soon as possible! In order to make upgrading as smooth as possible, we’ve only included commits directly related to each security issue.”

Although the vulnerabilities impact differing versions, the two flaws share a common DNA in some way and are in fact related. In terms of how they manifest themselves, both allow malicious attackers to insert arbitrary SQL code into queries using specially crafted values.

According to the Ruby on Rails team, “The only feasible workaround for this issue is to not allow user-controlled values to be used in queries with the affected data types. Given the difficulty of ensuring this, upgrading is strongly advised.”

COMMENTS (3)
Reply

Suspendisse rhoncus facilisis adipiscing. Vestibulum eu ligula lorem. Vivamus orci sem, consectetur ut vestibulum a, semper ac dui. Aenean tellus nisl, commodo eu aliquet ut, pulvinar ut sapien. Proin vulputate aliquam mi nec hendrerit. Sed fermentum velit vel ipsum bibendum tristique. Ut sem lacus, porttitor et aliquam eget, iaculis id lacus. Praesent sollicitudin, nibh nec mattis lobortis, dui massa eleifend magna, eget consequat risus felis dignissim ligula orbi a libero eget erat auctor cursus vitae id tortor. Suspendisse rhoncus facilisis adipiscing. Vestibulum eu ligula lorem.

Suspendisse rhoncus facilisis adipiscing. Vestibulum eu ligula lorem. Vivamus orci sem, consectetur ut vestibulum a, semper ac dui. Aenean tellus nisl, commodo eu aliquet ut, pulvinar ut sapien. Proin vulputate aliquam mi nec hendrerit. Sed fermentum velit vel ipsum bibendum tristique. Ut sem lacus, porttitor et aliquam eget, iaculis id lacus. Praesent sollicitudin, nibh nec mattis lobortis, dui massa eleifend magna, eget consequat risus felis dignissim ligula orbi a libero eget erat auctor cursus vitae id tortor. Suspendisse rhoncus facilisis adipiscing. Vestibulum eu ligula lorem.

Reply

no comment.. amazing theme.. keep up the good work.. cool to make it so cool… cool.. :)

Leave a Comment to Dan Philibin Cancel Comment

Name (required)
Email (required)
Comment (required)

You may use these HTML tags and attributes: <a href="" title=""> <abbr title=""> <acronym title=""> <b> <blockquote cite=""> <cite> <code> <del datetime=""> <em> <i> <q cite=""> <strike> <strong>