The open-source Ruby on Rails web development framework has been in the spotlight this month after two SQL injection vulnerabilities were found, and subsequently patched.
The team blog meanwhile concentrates on an announcement that the security patches introduced a regression on the PostgreSQL Range feature. This regression was only introduced to Rails 4.x. Rails 3.2 users are not impacted.
The team writes, "Rails 3.2.19, 4.0.7, and 4.1.3 have been released! These three releases contain important security fixes, so please upgrade as soon as possible! In order to make upgrading as smooth as possible, we've only included commits directly related to each security issue."
Although the vulnerabilities impact differing versions, the two flaws share a common DNA in some way and are in fact related. In terms of how they manifest themselves, both allow malicious attackers to insert arbitrary SQL code into queries using specially crafted values.
According to the Ruby on Rails team, "The only feasible workaround for this issue is to not allow user-controlled values to be used in queries with the affected data types. Given the difficulty of ensuring this, upgrading is strongly advised."
