CVE-2013-1854: Input Validation

First published: Thu Mar 14 2013(Updated: )

Symbol DoS vulnerability in Active Record There is a symbol DoS vulnerability in Active Record. This vulnerability has been assigned the CVE identifier <a href="https://access.redhat.com/security/cve/CVE-2013-1854">CVE-2013-1854</a>. Versions Affected: 3.2.x, 3.1.x, 2.3.x Not affected: 3.0.x Fixed Versions: 3.2.13, 3.1.12 Impact ------ When a hash is provided as the find value for a query, the keys of the hash may be converted to symbols. In this example, User.where(:name => { 'foo' => 'bar' }) the string 'foo' will be converted to a symbol. Impacted code will look something like this: User.where(:name => params[:name]) Carefully crafted requests can coerce `params[:name]` to return a hash, and the keys to that hash may be converted to symbols. All users running an affected release should either upgrade or use one of the work arounds immediately. Releases -------- The 3.2.13 and 3.1.12 releases are available at the normal locations. Workarounds ----------- To work around this problem, change code that looks like this: User.where(:name => params[:name]) to code like this: User.where(:name => params[:name].to_s) Patches ------- To aid users who aren't able to upgrade immediately we have provided patches for the two supported release series. They are in git-am format and consist of a single changeset. * 3-2-attribute_symbols.patch - Patch for 3.2 series * 3-1-attribute_symbols.patch - Patch for 3.1 series * 2-3-attribute_symbols.patch - Patch for 2.3 series Please note that only the 3.1.x and 3.2.x series are supported at present. Users of earlier unsupported releases are advised to upgrade as soon as possible as we cannot guarantee the continued availability of security fixes for unsupported releases. Credits ------- Thanks to Ben Murphy for reporting this!

Credit: secalert@redhat.com secalert@redhat.com

Affected Software	Affected Version	How to fix
rubygems/activerecord	>=3.2.0<3.2.13	3.2.13
rubygems/activerecord	>=3.1.0<3.1.12	3.1.12
rubygems/activerecord	>=2.3.0<2.3.18	2.3.18
Rubyonrails Rails	=2.3.0
Rubyonrails Rails	=2.3.1
Rubyonrails Rails	=2.3.2
Rubyonrails Rails	=2.3.3
Rubyonrails Rails	=2.3.4
Rubyonrails Rails	=2.3.9
Rubyonrails Rails	=2.3.10
Rubyonrails Rails	=2.3.11
Rubyonrails Rails	=2.3.12
Rubyonrails Rails	=2.3.13
Rubyonrails Rails	=2.3.14
Rubyonrails Rails	=2.3.15
Rubyonrails Rails	=2.3.16
Rubyonrails Rails	=3.1.0
Rubyonrails Rails	=3.1.0-beta1
Rubyonrails Rails	=3.1.0-rc1
Rubyonrails Rails	=3.1.0-rc2
Rubyonrails Rails	=3.1.0-rc3
Rubyonrails Rails	=3.1.0-rc4
Rubyonrails Rails	=3.1.0-rc5
Rubyonrails Rails	=3.1.0-rc6
Rubyonrails Rails	=3.1.0-rc7
Rubyonrails Rails	=3.1.0-rc8
Rubyonrails Rails	=3.1.1
Rubyonrails Rails	=3.1.1-rc1
Rubyonrails Rails	=3.1.1-rc2
Rubyonrails Rails	=3.1.1-rc3
Rubyonrails Rails	=3.1.2
Rubyonrails Rails	=3.1.2-rc1
Rubyonrails Rails	=3.1.2-rc2
Rubyonrails Rails	=3.1.3
Rubyonrails Rails	=3.1.4
Rubyonrails Rails	=3.1.4-rc1
Rubyonrails Rails	=3.1.5
Rubyonrails Rails	=3.1.5-rc1
Rubyonrails Rails	=3.1.6
Rubyonrails Rails	=3.1.7
Rubyonrails Rails	=3.1.8
Rubyonrails Rails	=3.1.9
Rubyonrails Rails	=3.1.10
Rubyonrails Rails	=3.2.0
Rubyonrails Rails	=3.2.0-rc1
Rubyonrails Rails	=3.2.0-rc2
Rubyonrails Rails	=3.2.1
Rubyonrails Rails	=3.2.2
Rubyonrails Rails	=3.2.2-rc1
Rubyonrails Rails	=3.2.3
Rubyonrails Rails	=3.2.3-rc1
Rubyonrails Rails	=3.2.3-rc2
Rubyonrails Rails	=3.2.4
Rubyonrails Rails	=3.2.4-rc1
Rubyonrails Rails	=3.2.5
Rubyonrails Rails	=3.2.6
Rubyonrails Rails	=3.2.7
Rubyonrails Rails	=3.2.8
Rubyonrails Rails	=3.2.9
Rubyonrails Rails	=3.2.10
Rubyonrails Rails	=3.2.11
Rubyonrails Rails	=3.2.12
Rubyonrails Ruby On Rails	=2.3.17
Rubyonrails Ruby On Rails	=3.1.11
Redhat Enterprise Linux	=6.0

CVE-2013-1854: Input Validation

Never miss a vulnerability like this again

Reference Links

Company

Resources

Contact