CVE-2023-22794

Name	CVE-2023-22794
Description	A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the `annotate` query method, the `optimizer_hints` query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.
Source	CVE (at NVD; CERT, LWN, oss-sec, fulldisc, Red Hat, Ubuntu, Gentoo, SUSE bugzilla/CVE, GitHub advisories/code/issues, web search, more)
References	DSA-5372-1
Debian Bugs	1030050

Vulnerable and fixed packages

The table below lists information on source packages.

Source Package	Release	Version	Status
rails (PTS)	bullseye (security), bullseye	2:6.0.3.7+dfsg-2+deb11u2	fixed
	bookworm	2:6.1.7.3+dfsg-2~deb12u1	fixed
	sid, trixie	2:6.1.7.3+dfsg-4	fixed

The information below is based on the following data on fixed versions.

Package	Type	Release	Fixed Version	Origin	Debian Bugs
rails	source	buster	(not affected)
rails	source	bullseye	2:6.0.3.7+dfsg-2+deb11u1	DSA-5372-1
rails	source	(unstable)	2:6.1.7.3+dfsg-1		1030050

Notes

[buster] - rails <not-affected> (Only affects 6.x and later)
https://discuss.rubyonrails.org/t/cve-2023-22794-sql-injection-vulnerability-via-activerecord-comments/82117
https://github.com/rails/rails/commit/048e9fc05e18c91838a44e60175e475de8b2aad5 (6-1-stable)