Tell HN: SQL Injection Vulnerability in latest Ruby on Rails

From the Rails Security List:

There is a SQL injection vulnerability in Active Record, version 3.0 and later. This vulnerability has been assigned the CVE identifier CVE-2012-2661.

Versions Affected: 3.0.0 and ALL later versions

Not affected: 2.3.14

Fixed Versions: 3.2.4, 3.1.5, 3.0.13

Impact

------

Due to the way Active Record handles nested query parameters, an attacker can use a specially crafted request to inject some forms of SQL into your application's SQL queries.

All users running an affected release should upgrade immediately.

Impacted code directly passes request params to the `where` method of an ActiveRecord class like this:

   Post.where(:id => params[:id]).all

An attacker can make a request that causes `params[:id]` to return a specially crafted hash that will cause the WHERE clause of the SQL statement to query an arbitrary table with some value.

Releases

--------

The FIXED releases are available at the normal locations.

Workarounds

-----------

This issue can be mitigated by casting the parameter to an expected value. For example, change this:

   Post.where(:id => params[:id]).all

to this:

   Post.where(:id => params[:id].to_s).all