Skip to content

Commit c2f8e4a

Browse files
committed
Minor - Note Rails 3.1.11 patch in Description.
1 parent 1f881d7 commit c2f8e4a

File tree

1 file changed

+5
-4
lines changed

1 file changed

+5
-4
lines changed

modules/auxiliary/admin/http/rails_devise_pass_reset.rb

Lines changed: 5 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -27,9 +27,9 @@ def initialize(info = {})
2727
2828
Affects Devise < v2.2.3, 2.1.3, 2.0.5 and 1.5.4 when backed by any database
2929
except PostgreSQL or SQLite3. Tested with v2.2.2, 2.1.2, and 2.0.4 on Rails
30-
3.2.11. Patch applied to Rails 3.2.12 should prevent exploitation of this
31-
vulnerability, by quoting numeric values when comparing them with non numeric
32-
values.
30+
3.2.11. Patch applied to Rails 3.2.12 and 3.1.11 should prevent exploitation
31+
of this vulnerability, by quoting numeric values when comparing them with
32+
non numeric values.
3333
},
3434
'Author' =>
3535
[
@@ -44,7 +44,8 @@ def initialize(info = {})
4444
[ 'BID', '57577' ],
4545
[ 'URL', 'http://blog.plataformatec.com.br/2013/01/security-announcement-devise-v2-2-3-v2-1-3-v2-0-5-and-v1-5-3-released/'],
4646
[ 'URL', 'http://www.phenoelit.org/blog/archives/2013/02/05/mysql_madness_and_rails/index.html'],
47-
[ 'URL', 'https://github.com/rails/rails/commit/921a296a3390192a71abeec6d9a035cc6d1865c8' ]
47+
[ 'URL', 'https://github.com/rails/rails/commit/921a296a3390192a71abeec6d9a035cc6d1865c8' ],
48+
[ 'URL', 'https://github.com/rails/rails/commit/26e13c3ca71cbc7859cc4c51e64f3981865985d8']
4849
],
4950
'DisclosureDate' => 'Jan 28 2013'
5051
))

0 commit comments

Comments
 (0)