CVE-2016-6317
1 advisory.
RubyGems/activerecord CVE-2016-6317: high 7.5, EPSS 3.90%
ActiveRecord in Ruby on Rails allows database-query bypass
Action: Upgrade activerecord to 4.2.7.1 or later.
bundle update activerecordAffected
| introduced | fixed | last affected |
|---|---|---|
| 4.2.0 | 4.2.7.1 | - |
Fixed versions
| 4.2.7.1 |
Sources
- osv: GHSA-pr3r-4wrp-r2pv
- https://nvd.nist.gov/vuln/detail/CVE-2016-6317
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2016-6317.yml
- https://groups.google.com/forum/#!topic/ruby-security-ann/WccgKSKiPZA
- https://groups.google.com/forum/#!topic/rubyonrails-security/rgO20zYW33s
- http://rhn.redhat.com/errata/RHSA-2016-1855.html
- http://weblog.rubyonrails.org/2016/8/11/Rails-5-0-0-1-4-2-7-2-and-3-2-22-3-have-been-released
- http://www.openwall.com/lists/oss-security/2016/08/11/4
CVE-2016-6317 · published · modified · JSON