medium
5
CWE
20
Advisory Published
CVE Published
Advisory Published
Updated

CVE-2013-1854: Input Validation

First published: Thu Mar 14 2013(Updated: )

Symbol DoS vulnerability in Active Record There is a symbol DoS vulnerability in Active Record. This vulnerability has been assigned the CVE identifier <a href="https://access.redhat.com/security/cve/CVE-2013-1854">CVE-2013-1854</a>. Versions Affected: 3.2.x, 3.1.x, 2.3.x Not affected: 3.0.x Fixed Versions: 3.2.13, 3.1.12 Impact ------ When a hash is provided as the find value for a query, the keys of the hash may be converted to symbols. In this example, User.where(:name =&gt; { 'foo' =&gt; 'bar' }) the string 'foo' will be converted to a symbol. Impacted code will look something like this: User.where(:name =&gt; params[:name]) Carefully crafted requests can coerce `params[:name]` to return a hash, and the keys to that hash may be converted to symbols. All users running an affected release should either upgrade or use one of the work arounds immediately. Releases -------- The 3.2.13 and 3.1.12 releases are available at the normal locations. Workarounds ----------- To work around this problem, change code that looks like this: User.where(:name =&gt; params[:name]) to code like this: User.where(:name =&gt; params[:name].to_s) Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. * 3-2-attribute_symbols.patch - Patch for 3.2 series * 3-1-attribute_symbols.patch - Patch for 3.1 series * 2-3-attribute_symbols.patch - Patch for 2.3 series Please note that only the 3.1.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases. Credits ------- Thanks to Ben Murphy for reporting this!

Credit: secalert@redhat.com

Affected SoftwareAffected VersionHow to fix
rubygems/activerecord>=3.2.0<3.2.13
3.2.13
rubygems/activerecord>=3.1.0<3.1.12
3.1.12
rubygems/activerecord>=2.3.0<2.3.18
2.3.18
Ruby on Rails=2.3.0
Ruby on Rails=2.3.1
Ruby on Rails=2.3.2
Ruby on Rails=2.3.3
Ruby on Rails=2.3.4
Ruby on Rails=2.3.9
Ruby on Rails=2.3.10
Ruby on Rails=2.3.11
Ruby on Rails=2.3.12
Ruby on Rails=2.3.13
Ruby on Rails=2.3.14
Ruby on Rails=2.3.15
Ruby on Rails=2.3.16
Ruby on Rails=3.1.0
Ruby on Rails=3.1.0-beta1
Ruby on Rails=3.1.0-rc1
Ruby on Rails=3.1.0-rc2
Ruby on Rails=3.1.0-rc3
Ruby on Rails=3.1.0-rc4
Ruby on Rails=3.1.0-rc5
Ruby on Rails=3.1.0-rc6
Ruby on Rails=3.1.0-rc7
Ruby on Rails=3.1.0-rc8
Ruby on Rails=3.1.1
Ruby on Rails=3.1.1-rc1
Ruby on Rails=3.1.1-rc2
Ruby on Rails=3.1.1-rc3
Ruby on Rails=3.1.2
Ruby on Rails=3.1.2-rc1
Ruby on Rails=3.1.2-rc2
Ruby on Rails=3.1.3
Ruby on Rails=3.1.4
Ruby on Rails=3.1.4-rc1
Ruby on Rails=3.1.5
Ruby on Rails=3.1.5-rc1
Ruby on Rails=3.1.6
Ruby on Rails=3.1.7
Ruby on Rails=3.1.8
Ruby on Rails=3.1.9
Ruby on Rails=3.1.10
Ruby on Rails=3.2.0
Ruby on Rails=3.2.0-rc1
Ruby on Rails=3.2.0-rc2
Ruby on Rails=3.2.1
Ruby on Rails=3.2.2
Ruby on Rails=3.2.2-rc1
Ruby on Rails=3.2.3
Ruby on Rails=3.2.3-rc1
Ruby on Rails=3.2.3-rc2
Ruby on Rails=3.2.4
Ruby on Rails=3.2.4-rc1
Ruby on Rails=3.2.5
Ruby on Rails=3.2.6
Ruby on Rails=3.2.7
Ruby on Rails=3.2.8
Ruby on Rails=3.2.9
Ruby on Rails=3.2.10
Ruby on Rails=3.2.11
Ruby on Rails=3.2.12
Ruby on Rails=2.3.17
Ruby on Rails=3.1.11
Red Hat Enterprise Linux=6.0

Never miss a vulnerability like this again

Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.

Read MoreStart Free Trial

Reference Links

Frequently Asked Questions

  • What is the severity of CVE-2013-1854?

    CVE-2013-1854 has a moderate severity level due to its potential for a denial-of-service attack.

  • How do I fix CVE-2013-1854?

    To fix CVE-2013-1854, upgrade Active Record to versions 3.2.13, 3.1.12, or 2.3.18 or later.

  • Which versions are affected by CVE-2013-1854?

    CVE-2013-1854 affects Active Record versions 3.2.x, 3.1.x, and 2.3.x.

  • Is CVE-2013-1854 applicable to Ruby on Rails 3.0?

    No, CVE-2013-1854 does not affect Ruby on Rails version 3.0.

  • What type of vulnerability is CVE-2013-1854?

    CVE-2013-1854 is classified as a symbol denial-of-service (DoS) vulnerability.

Company

Resources

Contact

SecAlerts Pty Ltd.
132 Wickham Terrace
Fortitude Valley,
QLD 4006, Australia
info@secalerts.co
By using SecAlerts services, you agree to our services end-user license agreement. This website is safeguarded by reCAPTCHA and governed by the Google Privacy Policy and Terms of Service. All names, logos, and brands of products are owned by their respective owners, and any usage of these names, logos, and brands for identification purposes only does not imply endorsement. If you possess any content that requires removal, please get in touch with us.
© 2025 SecAlerts Pty Ltd.
ABN: 70 645 966 203, ACN: 645 966 203