Active Record Improper Input Validation (GHSA-3crr-9vmg-864v)
Published: 2017-10-24T18:33:37Z
Aliases: CVE-2013-1854
Severity: MODERATE · CWE: CWE-20

The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.

Affected packages:
package: ecosystem: RubyGems
name: activerecord
ranges: type: ECOSYSTEM
events: introduced: 2.3.0
fixed: 2.3.18
package: ecosystem: RubyGems
name: activerecord
ranges: type: ECOSYSTEM
events: introduced: 3.1.0
fixed: 3.1.12
package: ecosystem: RubyGems
name: activerecord
ranges: type: ECOSYSTEM
events: introduced: 3.2.0
fixed: 3.2.13