CVE-2022-35956: Improper Neutralization of Special Elements used in an SQL Command ('SQL Injection')

August 12, 2022 (updated August 16, 2022)

This Rails gem adds two methods to the ActiveRecord::Base class that allow you to update many records on a single database hit, using a case sql statement for it. Before version 0.1.3 update_by_case gem used custom sql strings, and it was not sanitized, making it vulnerable to sql injection. Upgrade to version >= 0.1.3 that uses Arel instead to construct the resulting sql statement, with sanitized sql.

References

github.com/advisories/GHSA-33wh-w4m7-c6r8
github.com/camilova/activerecord-update-by-case/releases/tag/v0.1.3-stable
github.com/camilova/activerecord-update-by-case/security/advisories/GHSA-33wh-w4m7-c6r8
nvd.nist.gov/vuln/detail/CVE-2022-35956

Code Behaviors & Features

Detect and mitigate CVE-2022-35956 with GitLab Dependency Scanning

Secure your software supply chain by verifying that all open source dependencies used in your projects contain no disclosed vulnerabilities. Dependency Scanning using SBOM also detects vulnerabilities from proprietary advisories that this site does not include. Learn more about Dependency Scanning using SBOM →