[GHSA-3hhc-qp5v-9p2j] Active Record RCE bug with Serialized Columns

[levpachmanov]

Updates

• Affected products

Comments
Versions prior 3.1.0 doesn't even mention yaml -
https://github.com/rails/rails/blob/v3.0.20/activerecord/lib/active_record.rb

[shelbyc]

Hi @levpachmanov, I don't agree with setting a minimum vulnerable version based on the contents of https://github.com/rails/rails/blob/v3.0.20/activerecord/lib/active_record.rb. I found fix commits for versions 7.03.1, 6.1.6.1, 6.0.5.1, and 5.2.8.1, and of those, only the fix commits corresponding the the 7.1 and 7.0 branches made any changes to active_record.rb.

I think it's more likely that change in a different file would cause CVE-2022-32224. Can you find a change that's consistent with all of the fix commits and where the vulnerable code was introduced in the repo?