Ruby on Rails 3.2.10 Released to Address SQL Injection Vulnerability

Ruby on Rails 3.2.10, 3.1.9, and 3.0.18 have been released to address an SQL Injection vulnerability in Active Record that affects all versions. According to the developers, the release comes so close to the holidays because the details of the exploit have already been publicly disclosed. “Due to the way dynamic finders in Active Record extract options from method parameters, a method parameter can mistakenly be used as a scope. Carefully crafted requests can use the scope to inject arbitrary SQL,” the developers explained . Considering the risks posed by this serious vulnerability, users are advised to update as soon as possible. In order to make the upgrading process as easy as possible, the number of changes in each of the releases has been kept at a minimum.

Full article: http://news.softpedia.com/news/Ruby-on-Rails-3-2-10-Relea...

Tweets

@ajohn76 » 04 Jan '13, 1am
RT @CyberCrimeNEWS: Ruby on Rails 3.2.10 Released to Address SQL Injection Vulnerability [link] #ccureit
@LawLibNC » 03 Jan '13, 9pm
RT @CyberExaminer: #cybersecurity Ruby on Rails 3.2.10 Released to Address SQL Injection Vulnerability [link] #infosec
@Interactive22 » 03 Jan '13, 8pm
#security Ruby on Rails 3.2.10 Released to Address SQL Injection Vulnerability [link]
@Balmich » 03 Jan '13, 3pm
RT @SecMash: #InfoSec Ruby on Rails 3.2.10 Released to Address SQL Injection Vulnerability [link] #CyberSecurity
@EduardKovacs » 03 Jan '13, 1pm
Ruby on Rails updated to fix SQL Injection vulnerability. Update now [link]
@RealBelahzur » 03 Jan '13, 1pm
Ruby on Rails 3.2.10 Released to Address SQL Injection Vulnerability [link] via @softpedia
@SecMash » 03 Jan '13, 12pm
#InfoSec Ruby on Rails 3.2.10 Released to Address SQL Injection Vulnerability [link] #CyberSecurity
@CyberCrimeNEWS » 03 Jan '13, 12pm
Ruby on Rails 3.2.10 Released to Address SQL Injection Vulnerability [link] #ccureit
@starkeymagazine » 03 Jan '13, 12pm
#News Ruby on Rails 3.2.10 Released to Address SQL Injection Vulnerability [link] #Softpedia
@AnonNewsVL » 03 Jan '13, 2pm
Ruby on Rails 3.2.10 Released to Address SQL Injection Vulnerability [link]
@AnonNewsEU » 03 Jan '13, 2pm
Ruby on Rails 3.2.10 Released to Address SQL Injection Vulnerability [link]
@CcureIT » 03 Jan '13, 12pm
Ruby on Rails 3.2.10 Released to Address SQL Injection Vulnerability [link] #ccureit