Note: This is a public test instance of Red Hat Bugzilla. The data contained within is a snapshot of the live data so any changes you make will not be reflected in the production Bugzilla. Email is disabled so feel free to test any aspect of the site that you want. File any problems you find or give feedback at bugzilla.redhat.com.

Bug 744706 (CVE-2010-3933)

Summary:	CVE-2010-3933 rubygem-activerecord: Improper nested attributes management
Product:	[Other] Security Response	Reporter:	Jan Lieskovsky <jlieskov>
Component:	vulnerability	Assignee:	Red Hat Product Security <security-response-team>
Status:	CLOSED ERRATA	QA Contact:
Severity:	medium	Docs Contact:
Priority:	medium
Version:	unspecified	CC:	hbrock, mastahnke, mtasaka, sseago, vanmeeuwen+fedora, vondruch
Target Milestone:	---	Keywords:	Security
Target Release:	---
Hardware:	All
OS:	Linux
Whiteboard:
Fixed In Version:		Doc Type:	Bug Fix
Doc Text:		Story Points:	---
Clone Of:		Environment:
Last Closed:	2021-10-19 21:49:56 UTC	Type:	---
Regression:	---	Mount Type:	---
Documentation:	---	CRM:
Verified Versions:		Category:	---
oVirt Team:	---	RHEL 7.3 requirements from Atomic Host:
Cloudforms Team:	---	Target Upstream Version:
Embargoed:

Description Jan Lieskovsky 2011-10-10 09:10:51 UTC

Common Vulnerabilities and Exposures assigned an identifier CVE-2010-3933 to
the following vulnerability:

Ruby on Rails 2.3.9 and 3.0.0 does not properly handle nested attributes, which allows remote attackers to modify arbitrary records by changing the names of parameters for form inputs. 

References:
[1] http://weblog.rubyonrails.org/2010/10/15/security-vulnerability-in-nested-attributes-code-in-ruby-on-rails-2-3-9-and-3-0-0
[2] http://securitytracker.com/id?1024624
[3] http://secunia.com/advisories/41930
[4] http://www.vupen.com/english/advisories/2010/2719
[5] https://bugs.gentoo.org/show_bug.cgi?id=386377

Comment 1 Jan Lieskovsky 2011-10-10 09:13:22 UTC

This issue did not affect the versions of the rubygem-activerecord package, as shipped with Fedora release of 14 and 15 (the current rubygem-activerecord package versions in these releases already contain relevant upstream patches).

--

This issue did not affect the version of the rubygem-activerecord package, as present within EPEL-5 repository. That rubygem-activerecord package version does not contain affected code part yet.

Comment 3 Fedora Update System 2014-11-16 04:17:10 UTC

rubygem-actionpack-2.3.18-1.el5, rubygem-activerecord-2.3.18-1.el5, rubygem-activesupport-2.3.18-1.el5 has been pushed to the Fedora EPEL 5 stable repository.  If problems still persist, please make note of it in this bug report.