CVE-2013-0156: Input Validation
First published: Tue Jan 08 2013(Updated: )
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| redhat/rubygem-actionpack | <1:3.0.10-11.el6cf | 1:3.0.10-11.el6cf |
| redhat/rubygem-activerecord | <1:3.0.10-8.el6cf | 1:3.0.10-8.el6cf |
| redhat/rubygem-activesupport | <1:3.0.10-5.el6cf | 1:3.0.10-5.el6cf |
| redhat/ruby193-rubygem-actionpack | <1:3.2.8-2.el6 | 1:3.2.8-2.el6 |
| redhat/ruby193-rubygem-activesupport | <1:3.2.8-3.el6 | 1:3.2.8-3.el6 |
| redhat/rubygem-actionpack | <1:3.0.13-2.1.el6 | 1:3.0.13-2.1.el6 |
| redhat/rubygem-activesupport | <1:3.0.13-2.el6 | 1:3.0.13-2.el6 |
| Rubyonrails Rails | >=3.2.0<3.2.11 | |
| Rubyonrails Ruby On Rails | <2.3.15 | |
| Rubyonrails Ruby On Rails | >=3.0.0<3.0.19 | |
| Rubyonrails Ruby On Rails | >=3.1.0<3.1.10 | |
| Debian Debian Linux | =6.0 | |
| Debian Debian Linux | =7.0 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A
- http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
- http://rhn.redhat.com/errata/RHSA-2013-0153.html
- http://rhn.redhat.com/errata/RHSA-2013-0154.html
- http://rhn.redhat.com/errata/RHSA-2013-0155.html
- http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/
- http://www.debian.org/security/2013/dsa-2604
- http://www.fujitsu.com/global/support/software/security/products-f/sw-sv-rcve-ror201301e.html
- http://www.insinuator.net/2013/01/rails-yaml/
- http://www.kb.cert.org/vuls/id/380039
- http://www.kb.cert.org/vuls/id/628463
- https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156
- https://groups.google.com/group/rubyonrails-security/msg/c1432d0f8c70e89d?dmode=source&output=gplain
- https://puppet.com/security/cve/cve-2013-0156
- https://access.redhat.com/security/cve/CVE-2013-0156
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=674509&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=674509&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=674510&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=674510&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=674511&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=674511&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=674512&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=674512&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=893188
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675064&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675064&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675066&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675066&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675067&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675067&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675068&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675068&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675069&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675069&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675070&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675070&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675071&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675071&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675072&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675072&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675077&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675077&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675078&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675078&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675079&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675079&action=edit
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675080&action=diff
- https://bugzilla.redhat.com/show_bug.cgi/attachment.cgi?id=675080&action=edit
- https://access.redhat.com/security/cve/CVE-2012-0156
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=893189
- https://groups.google.com/forum/#!topic/rubyonrails-security/61bkgvnSGTQ/discussion
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=847202
- https://bugzilla.redhat.com/show_bug.cgi/show_bug.cgi?id=893281
- https://access.redhat.com/knowledge/node/290903
- https://rhn.redhat.com/errata/RHSA-2013-0154.html
- https://rhn.redhat.com/errata/RHSA-2013-0153.html
- https://rhn.redhat.com/errata/RHSA-2013-0155.html
- https://bugzilla.redhat.com/show_bug.cgi?id=892870
- https://www.cve.org/CVERecord?id=CVE-2013-0156 https://nvd.nist.gov/vuln/detail/CVE-2013-0156
- https://access.redhat.com/errata/RHSA-2013:0155
- https://access.redhat.com/errata/RHSA-2013:0154
- https://access.redhat.com/errata/RHSA-2013:0153
Parent vulnerabilities
(Appears in the following advisories)
- collector/redhat-bugzilla
- alias/CVE-2013-0156
- collector/redhat-cve
- collector/nvd-index
- agent/weakness
- agent/author
- agent/type
- agent/description
- agent/event
- agent/softwarecombine
- agent/last-modified-date
- agent/first-publish-date
- agent/tags
- agent/severity
- agent/references
- collector/mitre-cve
- source/MITRE
- package-manager/redhat
- vendor/rubyonrails
- canonical/rubyonrails rails
- version/rubyonrails rails/3.2.0
- canonical/rubyonrails ruby on rails
- version/rubyonrails ruby on rails/3.0.0
- version/rubyonrails ruby on rails/3.1.0
- vendor/debian
- canonical/debian debian linux
- version/debian debian linux/6.0
- version/debian debian linux/7.0