Updated advisory posts against rubysec/ruby-advisory-db@8ba0f94

Author: jasnow

advisories/_posts/2013-04-21-CVE-2013-3221.md

@@ -0,0 +1,46 @@
+---
+layout: advisory
+title: 'CVE-2013-3221 (activerecord): Data-type injection vulnerability'
+comments: false
+categories:
+- activerecord
+- rails
+advisory:
+  gem: activerecord
+  framework: rails
+  cve: 2013-3221
+  ghsa: f57c-hx33-hvh8
+  url: https://nvd.nist.gov/vuln/detail/CVE-2013-3221
+  title: Data-type injection vulnerability
+  date: 2013-04-21
+  description: |
+    The Active Record component in Ruby on Rails 2.3.x, 3.0.x, 3.1.x,
+    and 3.2.x does not ensure that the declared data type of a database
+    column is used during comparisons of input values to stored values
+    in that column, which makes it easier for remote attackers to
+    conduct data-type injection attacks against Ruby on Rails applications
+    via a crafted value, as demonstrated by unintended interaction
+    between the "typed XML" feature and a MySQL database.
+
+    ## RELEASE INFO
+    - Phrack writeup says that 'couple of days after the advisory the
+      issue was "fixed" in Rails 3.2.12 as by the following commit' 921a296.
+      But "Indeed the vector is completely fixed as of Rails 4.2 almost
+      two years after the original advisory."
+  cvss_v2: 6.4
+  patched_versions:
+  - ">= 4.2.0"
+  related:
+    url:
+    - https://nvd.nist.gov/vuln/detail/CVE-2013-3221
+    - https://github.com/rails/rails/commit/c9909db9f2f81575ef2ea2ed3b4e8743c8d6f1b9
+    - https://github.com/rails/rails/commit/921a296a3390192a71abeec6d9a035cc6d1865c8
+    - https://groups.google.com/group/rubyonrails-security/msg/1f3bc0b88a60c1ce
+    - http://pl.reddit.com/r/netsec/comments/17yajp/mysql_madness_and_rails
+    - http://openwall.com/lists/oss-security/2013/02/06/7
+    - http://openwall.com/lists/oss-security/2013/04/24/7
+    - https://gist.github.com/marianposaceanu/5442275
+    - https://web.archive.org/web/20160307143147/http://www.phenoelit.org/blog/archives/2013/02/index.html
+    - https://github.com/advisories/GHSA-f57c-hx33-hvh8
+    - https://phrack.org/issues/69/12
+---