{ "document" : { "aggregate_severity" : { "text" : "hoch" }, "category" : "csaf_base", "csaf_version" : "2.0", "distribution" : { "tlp" : { "label" : "WHITE", "url" : "https://www.first.org/tlp/" } }, "lang" : "de-DE", "notes" : [ { "category" : "legal_disclaimer", "text" : "Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen." }, { "category" : "description", "text" : "Ruby on Rails ist ein in der Programmiersprache Ruby geschriebenes und quelloffenes Web Application Framework.", "title" : "Produktbeschreibung" }, { "category" : "summary", "text" : "Ein entfernter Angreifer kann eine Schwachstelle in Ruby on Rails ausnutzen, um beliebigen Programmcode auszuführen.", "title" : "Angriff" }, { "category" : "general", "text" : "- Linux\n- Sonstiges\n- UNIX\n- Windows", "title" : "Betroffene Betriebssysteme" } ], "publisher" : { "category" : "other", "contact_details" : "csaf-provider@cert-bund.de", "name" : "Bundesamt für Sicherheit in der Informationstechnik", "namespace" : "https://www.bsi.bund.de" }, "references" : [ { "category" : "self", "summary" : "WID-SEC-W-2022-0662 - CSAF Version", "url" : "https://wid.cert-bund.de/.well-known/csaf/white/2022/wid-sec-w-2022-0662.json" }, { "category" : "self", "summary" : "WID-SEC-2022-0662 - Portal Version", "url" : "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2022-0662" }, { "category" : "external", "summary" : "Rails Security Announcement vom 2022-07-12", "url" : "https://discuss.rubyonrails.org/t/cve-2022-32224-possible-rce-escalation-bug-with-serialized-columns-in-active-record/81017" }, { "category" : "external", "summary" : "Rails Version Release vom 2022-07-12", "url" : "https://rubyonrails.org/2022/7/12/Rails-Versions-7-0-3-1-6-1-6-1-6-0-5-1-and-5-2-8-1-have-been-released" }, { "category" : "external", "summary" : "Debian Security Advisory DLA-3093 vom 2022-09-03", "url" : "https://lists.debian.org/debian-lts-announce/2022/09/msg00002.html" }, { "category" : "external", "summary" : "Red Hat Security Advisory RHSA-2023:0261 vom 2023-01-18", "url" : "https://access.redhat.com/errata/RHSA-2023:0261" }, { "category" : "external", "summary" : "Red Hat Security Advisory RHSA-2023:1151 vom 2023-03-08", "url" : "https://access.redhat.com/errata/RHSA-2023:1151" }, { "category" : "external", "summary" : "Gentoo Linux Security Advisory GLSA-202408-24 vom 2024-08-11", "url" : "https://security.gentoo.org/glsa/202408-24" }, { "category" : "external", "summary" : "openSUSE Security Update OPENSUSE-SU-2025:15112-1 vom 2025-05-18", "url" : "https://lists.opensuse.org/archives/list/security-announce@lists.opensuse.org/message/HY4OG4XVEU3VJA7BHFONYS4OFAKMFV4J/" }, { "category" : "external", "summary" : "Debian Security Advisory DLA-4578 vom 2026-05-11", "url" : "https://lists.debian.org/debian-lts-announce/2026/05/msg00022.html" } ], "source_lang" : "en-US", "title" : "Ruby on Rails: Schwachstelle ermöglicht Codeausführung", "tracking" : { "current_release_date" : "2026-05-11T22:00:00.000+00:00", "generator" : { "date" : "2026-05-12T08:11:04.287+00:00", "engine" : { "name" : "BSI-WID", "version" : "1.5.0" } }, "id" : "WID-SEC-W-2022-0662", "initial_release_date" : "2022-07-12T22:00:00.000+00:00", "revision_history" : [ { "date" : "2022-07-12T22:00:00.000+00:00", "number" : "1", "summary" : "Initiale Fassung" }, { "date" : "2022-09-04T22:00:00.000+00:00", "number" : "2", "summary" : "Neue Updates von Debian aufgenommen" }, { "date" : "2023-01-18T23:00:00.000+00:00", "number" : "3", "summary" : "Neue Updates von Red Hat aufgenommen" }, { "date" : "2023-03-08T23:00:00.000+00:00", "number" : "4", "summary" : "Neue Updates von Red Hat aufgenommen" }, { "date" : "2024-08-11T22:00:00.000+00:00", "number" : "5", "summary" : "Neue Updates von Gentoo aufgenommen" }, { "date" : "2025-05-18T22:00:00.000+00:00", "number" : "6", "summary" : "Neue Updates von openSUSE aufgenommen" }, { "date" : "2026-05-11T22:00:00.000+00:00", "number" : "7", "summary" : "Neue Updates von Debian aufgenommen" } ], "status" : "final", "version" : "7" } }, "product_tree" : { "branches" : [ { "branches" : [ { "category" : "product_name", "name" : "Debian Linux", "product" : { "name" : "Debian Linux", "product_id" : "2951", "product_identification_helper" : { "cpe" : "cpe:/o:debian:debian_linux:-" } } } ], "category" : "vendor", "name" : "Debian" }, { "branches" : [ { "category" : "product_name", "name" : "Gentoo Linux", "product" : { "name" : "Gentoo Linux", "product_id" : "T012167", "product_identification_helper" : { "cpe" : "cpe:/o:gentoo:linux:-" } } } ], "category" : "vendor", "name" : "Gentoo" }, { "branches" : [ { "branches" : [ { "category" : "product_version_range", "name" : "<7.0.3.1", "product" : { "name" : "Open Source Ruby on Rails <7.0.3.1", "product_id" : "T023825" } }, { "category" : "product_version", "name" : "7.0.3.1", "product" : { "name" : "Open Source Ruby on Rails 7.0.3.1", "product_id" : "T023825-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:rubyonrails:ruby_on_rails:7.0.3.1" } } }, { "category" : "product_version_range", "name" : "<6.1.6.1", "product" : { "name" : "Open Source Ruby on Rails <6.1.6.1", "product_id" : "T023826" } }, { "category" : "product_version", "name" : "6.1.6.1", "product" : { "name" : "Open Source Ruby on Rails 6.1.6.1", "product_id" : "T023826-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:rubyonrails:ruby_on_rails:6.1.6.1" } } }, { "category" : "product_version_range", "name" : "<6.0.5.1", "product" : { "name" : "Open Source Ruby on Rails <6.0.5.1", "product_id" : "T023827" } }, { "category" : "product_version", "name" : "6.0.5.1", "product" : { "name" : "Open Source Ruby on Rails 6.0.5.1", "product_id" : "T023827-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:rubyonrails:ruby_on_rails:6.0.5.1" } } }, { "category" : "product_version_range", "name" : "<5.2.8.1", "product" : { "name" : "Open Source Ruby on Rails <5.2.8.1", "product_id" : "T023828" } }, { "category" : "product_version", "name" : "5.2.8.1", "product" : { "name" : "Open Source Ruby on Rails 5.2.8.1", "product_id" : "T023828-fixed", "product_identification_helper" : { "cpe" : "cpe:/a:rubyonrails:ruby_on_rails:5.2.8.1" } } } ], "category" : "product_name", "name" : "Ruby on Rails" } ], "category" : "vendor", "name" : "Open Source" }, { "branches" : [ { "category" : "product_name", "name" : "Red Hat Enterprise Linux", "product" : { "name" : "Red Hat Enterprise Linux", "product_id" : "67646", "product_identification_helper" : { "cpe" : "cpe:/o:redhat:enterprise_linux:-" } } } ], "category" : "vendor", "name" : "Red Hat" }, { "branches" : [ { "category" : "product_name", "name" : "SUSE openSUSE", "product" : { "name" : "SUSE openSUSE", "product_id" : "T027843", "product_identification_helper" : { "cpe" : "cpe:/o:suse:opensuse:-" } } } ], "category" : "vendor", "name" : "SUSE" } ] }, "vulnerabilities" : [ { "cve" : "CVE-2022-32224", "product_status" : { "known_affected" : [ "T023825", "T023826", "2951", "67646", "T027843", "T012167", "T023827", "T023828" ] }, "release_date" : "2022-07-12T22:00:00.000+00:00", "title" : "CVE-2022-32224" } ] }