CVE-2014-3482: SQL Injection in Active Record

October 24, 2017 (updated March 31, 2025)

SQL injection vulnerability in activerecord/lib/active_record/connection_adapters/postgresql_adapter.rb in the PostgreSQL adapter for Active Record in Ruby on Rails 2.x and 3.x before 3.2.19 allows remote attackers to execute arbitrary SQL commands by leveraging improper bitstring quoting.

References

github.com/advisories/GHSA-mhwp-qhpc-h3jm
github.com/rails/rails
github.com/rails/rails/commit/1f2192e46d78ee0ba2b06373f2c24caf8440ff5b
groups.google.com/g/rubyonrails-security/c/wDxePLJGZdI
nvd.nist.gov/vuln/detail/CVE-2014-3482

Code Behaviors & Features

Detect and mitigate CVE-2014-3482 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →