CVE-2013-1856: Input Validation
First published: Tue Mar 19 2013(Updated: )
The `ActiveSupport::XmlMini_JDOM` backend in `lib/active_support/xml_mini/jdom.rb` in the Active Support component in Ruby on Rails 3.0.x and 3.1.x before 3.1.12 and 3.2.x before 3.2.13, when JRuby is used, does not properly restrict the capabilities of the XML parser, which allows remote attackers to read arbitrary files or cause a denial of service (resource consumption) via vectors involving (1) an external DTD or (2) an external entity declaration in conjunction with an entity reference.
Credit: secalert@redhat.com
| Affected Software | Affected Version | How to fix |
|---|---|---|
| rubygems/activesupport | >=3.2.0<3.2.13 | 3.2.13 |
| rubygems/activesupport | >=3.0.0<3.1.12 | 3.1.12 |
| Ruby on Rails | =3.1.0 | |
| Ruby on Rails | =3.1.0-beta1 | |
| Ruby on Rails | =3.1.0-rc1 | |
| Ruby on Rails | =3.1.0-rc2 | |
| Ruby on Rails | =3.1.0-rc3 | |
| Ruby on Rails | =3.1.0-rc4 | |
| Ruby on Rails | =3.1.0-rc5 | |
| Ruby on Rails | =3.1.0-rc6 | |
| Ruby on Rails | =3.1.0-rc7 | |
| Ruby on Rails | =3.1.0-rc8 | |
| Ruby on Rails | =3.1.1 | |
| Ruby on Rails | =3.1.1-rc1 | |
| Ruby on Rails | =3.1.1-rc2 | |
| Ruby on Rails | =3.1.1-rc3 | |
| Ruby on Rails | =3.1.2 | |
| Ruby on Rails | =3.1.2-rc1 | |
| Ruby on Rails | =3.1.2-rc2 | |
| Ruby on Rails | =3.1.3 | |
| Ruby on Rails | =3.1.4 | |
| Ruby on Rails | =3.1.4-rc1 | |
| Ruby on Rails | =3.1.5 | |
| Ruby on Rails | =3.1.5-rc1 | |
| Ruby on Rails | =3.1.6 | |
| Ruby on Rails | =3.1.7 | |
| Ruby on Rails | =3.1.8 | |
| Ruby on Rails | =3.1.9 | |
| Ruby on Rails | =3.1.10 | |
| Ruby on Rails | =3.2.0 | |
| Ruby on Rails | =3.2.0-rc1 | |
| Ruby on Rails | =3.2.0-rc2 | |
| Ruby on Rails | =3.2.1 | |
| Ruby on Rails | =3.2.2 | |
| Ruby on Rails | =3.2.2-rc1 | |
| Ruby on Rails | =3.2.3 | |
| Ruby on Rails | =3.2.3-rc1 | |
| Ruby on Rails | =3.2.3-rc2 | |
| Ruby on Rails | =3.2.4 | |
| Ruby on Rails | =3.2.4-rc1 | |
| Ruby on Rails | =3.2.5 | |
| Ruby on Rails | =3.2.6 | |
| Ruby on Rails | =3.2.7 | |
| Ruby on Rails | =3.2.8 | |
| Ruby on Rails | =3.2.9 | |
| Ruby on Rails | =3.2.10 | |
| Ruby on Rails | =3.2.11 | |
| Ruby on Rails | =3.2.12 | |
| Ruby on Rails | =3.1.11 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- https://nvd.nist.gov/vuln/detail/CVE-2013-1856
- https://groups.google.com/group/rubyonrails-security/msg/6c2482d4ed1545e6?dmode=source&output=gplain
- http://support.apple.com/kb/HT5784
- http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/
- https://web.archive.org/web/20130609174600/http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
- https://web.archive.org/web/20131109010518/http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2013-1856.yml
- http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
- http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html
- https://github.com/advisories/GHSA-9c2j-593q-3g82 (Advisory)
Frequently Asked Questions
What is the severity of CVE-2013-1856?
CVE-2013-1856 is classified as a moderate severity vulnerability due to improper restrictions in the XML parser.
How do I fix CVE-2013-1856?
To fix CVE-2013-1856, upgrade the ActiveSupport gem to version 3.1.12 or higher for Rails 3.1.x and to version 3.2.13 or higher for Rails 3.2.x.
Which versions are affected by CVE-2013-1856?
CVE-2013-1856 affects Ruby on Rails versions 3.0.x and 3.1.x before 3.1.12, and 3.2.x before 3.2.13 when using JRuby.
What components are involved in CVE-2013-1856?
CVE-2013-1856 involves the ActiveSupport::XmlMini_JDOM backend from the Active Support component in Ruby on Rails.
Are there any known exploits for CVE-2013-1856?
There are no public details available regarding specific exploits that target CVE-2013-1856.
- collector/github-advisory
- alias/GHSA-9c2j-593q-3g82
- alias/CVE-2013-1856
- collector/github-advisory-latest
- package-manager/rubygems
- agent/references
- agent/author
- agent/type
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/description
- agent/first-publish-date
- agent/event
- agent/trending
- agent/source
- agent/tags
- agent/softwarecombine
- collector/nvd-index
- agent/software-canonical-lookup-request
- collector/nvd-cve
- vendor/rubyonrails
- canonical/ruby on rails
- version/ruby on rails/3.1.0
- version/ruby on rails/3.1.0-beta1
- version/ruby on rails/3.1.0-rc1
- version/ruby on rails/3.1.0-rc2
- version/ruby on rails/3.1.0-rc3
- version/ruby on rails/3.1.0-rc4
- version/ruby on rails/3.1.0-rc5
- version/ruby on rails/3.1.0-rc6
- version/ruby on rails/3.1.0-rc7
- version/ruby on rails/3.1.0-rc8
- version/ruby on rails/3.1.1
- version/ruby on rails/3.1.1-rc1
- version/ruby on rails/3.1.1-rc2
- version/ruby on rails/3.1.1-rc3
- version/ruby on rails/3.1.2
- version/ruby on rails/3.1.2-rc1
- version/ruby on rails/3.1.2-rc2
- version/ruby on rails/3.1.3
- version/ruby on rails/3.1.4
- version/ruby on rails/3.1.4-rc1
- version/ruby on rails/3.1.5
- version/ruby on rails/3.1.5-rc1
- version/ruby on rails/3.1.6
- version/ruby on rails/3.1.7
- version/ruby on rails/3.1.8
- version/ruby on rails/3.1.9
- version/ruby on rails/3.1.10
- version/ruby on rails/3.2.0
- version/ruby on rails/3.2.0-rc1
- version/ruby on rails/3.2.0-rc2
- version/ruby on rails/3.2.1
- version/ruby on rails/3.2.2
- version/ruby on rails/3.2.2-rc1
- version/ruby on rails/3.2.3
- version/ruby on rails/3.2.3-rc1
- version/ruby on rails/3.2.3-rc2
- version/ruby on rails/3.2.4
- version/ruby on rails/3.2.4-rc1
- version/ruby on rails/3.2.5
- version/ruby on rails/3.2.6
- version/ruby on rails/3.2.7
- version/ruby on rails/3.2.8
- version/ruby on rails/3.2.9
- version/ruby on rails/3.2.10
- version/ruby on rails/3.2.11
- version/ruby on rails/3.2.12
- version/ruby on rails/3.1.11