Oval Definition:	oval:com.ubuntu.trusty:def:201717919000
Revision Date: 2017-12-29 Version: 1 Title: CVE-2017-17919 on Ubuntu 14.04 LTS (trusty) - low. Description: ** DISPUTED ** SQL injection vulnerability in the 'order' method in Ruby on Rails 5.1.4 and earlier allows remote attackers to execute arbitrary SQL commands via the 'id desc' parameter. NOTE: The vendor disputes this issue because the documentation states that this method is not intended for use with untrusted input. Family: unix Class: vulnerability Status: Reference(s): CVE-2017-17919 Platform(s): Ubuntu 14.04 LTS Product(s): Definition Synopsis Ubuntu 14.04 LTS (trusty) is installed. AND Package Information NOT While related to the CVE in some way, the 'rails' package in trusty is not affected (note: 'contains no code'). OR The vulnerability of the 'rails-4.0' package in trusty is not known (status: 'needs-triage'). It is pending evaluation. OR The vulnerability of the 'ruby-actionpack-3.2' package in trusty is not known (status: 'needs-triage'). It is pending evaluation. OR The vulnerability of the 'ruby-activemodel-3.2' package in trusty is not known (status: 'needs-triage'). It is pending evaluation. OR The vulnerability of the 'ruby-activerecord-3.2' package in trusty is not known (status: 'needs-triage'). It is pending evaluation. OR The vulnerability of the 'ruby-activesupport-3.2' package in trusty is not known (status: 'needs-triage'). It is pending evaluation. OR The vulnerability of the 'ruby-rails-3.2' package in trusty is not known (status: 'needs-triage'). It is pending evaluation.
BACK