{"id":"MGASA-2014-0303","summary":"Updated ruby-actionpack packages fix security issues","details":"Updated ruby-actionpack and ruby-activerecord packages fix security\nvulnerabilities:\n\nDirectory traversal vulnerability in actionpack/lib/abstract_controller/base.rb\nin the implicit-render implementation in Ruby on Rails before 4.0.5, when\ncertain route globbing configurations are enabled, allows remote attackers to\nread arbitrary files via a crafted request (CVE-2014-0130).\n\nPostgreSQL supports a number of unique data types which are not present in\nother supported databases.  A bug in the SQL quoting code in ActiveRecord in\nRuby on Rails before 4.0.7 can allow an attacker to inject arbitrary SQL using\ncarefully crafted values (CVE-2014-3483).\n\nThe associated Ruby on Rails packages have been updated to version 4.0.8, to\naddress these and other issues.\n","modified":"2026-04-16T06:25:06.797705834Z","published":"2014-07-26T13:09:43Z","upstream":["CVE-2014-0130","CVE-2014-3483"],"references":[{"type":"ADVISORY","url":"https://advisories.mageia.org/MGASA-2014-0303.html"},{"type":"WEB","url":"http://weblog.rubyonrails.org/2014/5/6/Rails_3_2_18_4_0_5_and_4_1_1_have_been_released/"},{"type":"WEB","url":"http://weblog.rubyonrails.org/2014/6/26/Rails-4-1-2-and-4-0-6-has-been-released/"},{"type":"WEB","url":"http://weblog.rubyonrails.org/2014/7/2/Rails_3_2_19_4_0_7_and_4_1_3_have_been_released/"},{"type":"WEB","url":"http://weblog.rubyonrails.org/2014/7/2/Rails_4_0_8_and_4_1_4_have_been_released/"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=13659"},{"type":"REPORT","url":"https://bugs.mageia.org/show_bug.cgi?id=13339"}],"affected":[{"package":{"name":"ruby-actionmailer","ecosystem":"Mageia:4","purl":"pkg:rpm/mageia/ruby-actionmailer?arch=source&distro=mageia-4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga4"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2014-0303.json"}},{"package":{"name":"ruby-actionpack","ecosystem":"Mageia:4","purl":"pkg:rpm/mageia/ruby-actionpack?arch=source&distro=mageia-4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga4"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2014-0303.json"}},{"package":{"name":"ruby-activemodel","ecosystem":"Mageia:4","purl":"pkg:rpm/mageia/ruby-activemodel?arch=source&distro=mageia-4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga4"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2014-0303.json"}},{"package":{"name":"ruby-activerecord","ecosystem":"Mageia:4","purl":"pkg:rpm/mageia/ruby-activerecord?arch=source&distro=mageia-4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga4"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2014-0303.json"}},{"package":{"name":"ruby-activesupport","ecosystem":"Mageia:4","purl":"pkg:rpm/mageia/ruby-activesupport?arch=source&distro=mageia-4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga4"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2014-0303.json"}},{"package":{"name":"ruby-rails","ecosystem":"Mageia:4","purl":"pkg:rpm/mageia/ruby-rails?arch=source&distro=mageia-4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga4"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2014-0303.json"}},{"package":{"name":"ruby-railties","ecosystem":"Mageia:4","purl":"pkg:rpm/mageia/ruby-railties?arch=source&distro=mageia-4"},"ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"4.0.8-1.mga4"}]}],"ecosystem_specific":{"section":"core"},"database_specific":{"source":"https://advisories.mageia.org/MGASA-2014-0303.json"}}],"schema_version":"1.7.5","credits":[{"name":"Mageia","contact":["https://wiki.mageia.org/en/Packages_Security_Team"],"type":"COORDINATOR"}]}