Oval Definition:oval:com.ubuntu.precise:def:20130155000
Revision Date:2013-01-13Version:1
Title:CVE-2013-0155 on Ubuntu 12.04 LTS (precise) - high.
Description:Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider differences in parameter handling between the Active Record component and the JSON implementation, which allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to CVE-2012-2660 and CVE-2012-2694.
Family:unixClass:vulnerability
Status:Reference(s):CVE-2013-0155
Platform(s):Ubuntu 12.04 LTS
Product(s):
Definition Synopsis
  • Ubuntu 12.04 LTS (precise) is installed.
  • AND Package Information
  • NOT While related to the CVE in some way, the 'rails' package in precise is not affected (note: 'contains no code').
  • OR NOT While related to the CVE in some way, the 'ruby-actionpack-2.3' package in precise is not affected.
  • OR The 'ruby-activerecord-2.3' package in precise was vulnerable but has been fixed (note: '2.3.14-1ubuntu0.12.04.1').
    • BACK