CVE-2013-0277: Critical severity ruby on rails vulnerability
Published Feb 13, 2013
·Updated
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
Affected Software
61 affected componentsFixes available
rubygems/activerecord>=3.0.0<3.1.0
3.1.0
rubygems/activerecord<2.3.17
2.3.17
rubyonrails Rails=3.0.0
rubyonrails Rails=3.0.0-beta
rubyonrails Rails=3.0.0-beta2
rubyonrails Rails=3.0.0-beta3
rubyonrails Rails=3.0.0-beta4
rubyonrails Rails=3.0.0-rc
rubyonrails Rails=3.0.0-rc2
rubyonrails Rails=3.0.1
rubyonrails Rails=3.0.1-pre
rubyonrails Rails=3.0.2
rubyonrails Rails=3.0.2-pre
rubyonrails Rails=3.0.3
rubyonrails Rails=3.0.4-rc1
rubyonrails Rails=3.0.5
rubyonrails Rails=3.0.5-rc1
rubyonrails Rails=3.0.6
rubyonrails Rails=3.0.6-rc1
rubyonrails Rails=3.0.6-rc2
rubyonrails Rails=3.0.7
rubyonrails Rails=3.0.7-rc1
rubyonrails Rails=3.0.7-rc2
rubyonrails Rails=3.0.8
rubyonrails Rails=3.0.8-rc1
rubyonrails Rails=3.0.8-rc2
rubyonrails Rails=3.0.8-rc3
rubyonrails Rails=3.0.8-rc4
rubyonrails Rails=3.0.9
rubyonrails Rails=3.0.9-rc1
rubyonrails Rails=3.0.9-rc2
rubyonrails Rails=3.0.9-rc3
rubyonrails Rails=3.0.9-rc4
rubyonrails Rails=3.0.9-rc5
rubyonrails Rails=3.0.10
rubyonrails Rails=3.0.10-rc1
rubyonrails Rails=3.0.11
rubyonrails Rails=3.0.12
rubyonrails Rails=3.0.12-rc1
rubyonrails Rails=3.0.13
rubyonrails Rails=3.0.13-rc1
rubyonrails Rails=3.0.14
rubyonrails Rails=3.0.16
rubyonrails Rails=3.0.17
rubyonrails Rails=3.0.18
rubyonrails Rails=3.0.19
rubyonrails Rails=3.0.20
rubyonrails ruby on Rails=3.0.4
rubyonrails Rails=2.3.0
rubyonrails Rails=2.3.1
rubyonrails Rails=2.3.2
rubyonrails Rails=2.3.3
rubyonrails Rails=2.3.4
rubyonrails Rails=2.3.9
rubyonrails Rails=2.3.10
rubyonrails Rails=2.3.11
rubyonrails Rails=2.3.12
rubyonrails Rails=2.3.13
rubyonrails Rails=2.3.14
rubyonrails Rails=2.3.15
rubyonrails Rails=2.3.16
Remediation
Patch Available
Event History
Feb 13, 2013
CVE Published
via MITRE·01:00 AM
Data Sourced
via MITRE·01:00 AM
Description
Oct 24, 2017
Advisory Published
06:33 PM
Frequently Asked Questions
1
What is the severity of CVE-2013-0277?
CVE-2013-0277 has a severity level that allows for denial of service and the potential execution of arbitrary code.
2
How do I fix CVE-2013-0277?
To fix CVE-2013-0277, upgrade ActiveRecord to version 2.3.17 or 3.1.0 or later.
3
Which versions of ActiveRecord are affected by CVE-2013-0277?
CVE-2013-0277 affects ActiveRecord versions prior to 2.3.17 and 3.0.x versions before 3.1.0.
4
When was CVE-2013-0277 discovered?
CVE-2013-0277 was discovered and published in early 2013.
5
What kind of attack does CVE-2013-0277 enable?
CVE-2013-0277 enables remote attackers to conduct denial of service attacks or execute arbitrary code through crafted serialized attributes.