CVE-2013-6414: Input Validation

Q: What is the severity of CVE-2013-6414?

CVE-2013-6414 is classified as a denial of service vulnerability due to memory consumption issues.

Q: How do I fix CVE-2013-6414?

To fix CVE-2013-6414, upgrade Action Pack to version 4.0.2 or 3.2.16 or later.

Q: Which versions of Ruby on Rails are affected by CVE-2013-6414?

CVE-2013-6414 affects Ruby on Rails versions prior to 3.2.16 and 4.0.2.

Q: What type of attack is possible with CVE-2013-6414?

An attacker can exploit CVE-2013-6414 to cause a denial of service by sending requests with invalid MIME types.

Q: Is there a specific workaround for CVE-2013-6414?

There are no specific workarounds for CVE-2013-6414 other than applying the necessary updates.

Published Dec 7, 2013

Updated

actionpack/lib/actionview/lookupcontext.rb in Action View in Ruby on Rails 3.x before 3.2.16 and 4.x before 4.0.2 allows remote attackers to cause a denial of service (memory consumption) via a header containing an invalid MIME type that leads to excessive caching.

Other sources

Affected Software

110 affected componentsFixes available

rubygems/actionpack>=4.0.0<4.0.2

4.0.2

rubygems/actionpack>=3.0.0<3.2.16

3.2.16

rubyonrails Rails<=4.0.1

rubyonrails Rails=4.0.0

rubyonrails Rails=4.0.0-beta

rubyonrails Rails=4.0.0-rc1

rubyonrails Rails=4.0.0-rc2

rubyonrails Rails=4.0.1-rc1

rubyonrails Rails=3.0.0

rubyonrails Rails=3.0.0-beta

rubyonrails Rails=3.0.0-beta2

rubyonrails Rails=3.0.0-beta3

rubyonrails Rails=3.0.0-beta4

rubyonrails Rails=3.0.0-rc

rubyonrails Rails=3.0.0-rc2

rubyonrails Rails=3.0.1

rubyonrails Rails=3.0.1-pre

rubyonrails Rails=3.0.2

rubyonrails Rails=3.0.2-pre

rubyonrails Rails=3.0.3

rubyonrails Rails=3.0.4-rc1

rubyonrails Rails=3.0.5

rubyonrails Rails=3.0.5-rc1

rubyonrails Rails=3.0.6

rubyonrails Rails=3.0.6-rc1

rubyonrails Rails=3.0.6-rc2

rubyonrails Rails=3.0.7

rubyonrails Rails=3.0.7-rc1

rubyonrails Rails=3.0.7-rc2

rubyonrails Rails=3.0.8

rubyonrails Rails=3.0.8-rc1

rubyonrails Rails=3.0.8-rc2

rubyonrails Rails=3.0.8-rc3

rubyonrails Rails=3.0.8-rc4

rubyonrails Rails=3.0.9

rubyonrails Rails=3.0.9-rc1

rubyonrails Rails=3.0.9-rc2

rubyonrails Rails=3.0.9-rc3

rubyonrails Rails=3.0.9-rc4

rubyonrails Rails=3.0.9-rc5

rubyonrails Rails=3.0.10

rubyonrails Rails=3.0.10-rc1

rubyonrails Rails=3.0.11

rubyonrails Rails=3.0.12

rubyonrails Rails=3.0.12-rc1

rubyonrails Rails=3.0.13

rubyonrails Rails=3.0.13-rc1

rubyonrails Rails=3.0.14

rubyonrails Rails=3.0.16

rubyonrails Rails=3.0.17

rubyonrails Rails=3.0.18

rubyonrails Rails=3.0.19

rubyonrails Rails=3.0.20

rubyonrails Rails=3.1.0

rubyonrails Rails=3.1.0-beta1

rubyonrails Rails=3.1.0-rc1

rubyonrails Rails=3.1.0-rc2

rubyonrails Rails=3.1.0-rc3

rubyonrails Rails=3.1.0-rc4

rubyonrails Rails=3.1.0-rc5

rubyonrails Rails=3.1.0-rc6

rubyonrails Rails=3.1.0-rc7

rubyonrails Rails=3.1.0-rc8

rubyonrails Rails=3.1.1

rubyonrails Rails=3.1.1-rc1

rubyonrails Rails=3.1.1-rc2

rubyonrails Rails=3.1.1-rc3

rubyonrails Rails=3.1.2

rubyonrails Rails=3.1.2-rc1

rubyonrails Rails=3.1.2-rc2

rubyonrails Rails=3.1.3

rubyonrails Rails=3.1.4

rubyonrails Rails=3.1.4-rc1

rubyonrails Rails=3.1.5

rubyonrails Rails=3.1.5-rc1

rubyonrails Rails=3.1.6

rubyonrails Rails=3.1.7

rubyonrails Rails=3.1.8

rubyonrails Rails=3.1.9

rubyonrails Rails=3.1.10

rubyonrails Rails=3.2.0

rubyonrails Rails=3.2.0-rc1

rubyonrails Rails=3.2.0-rc2

rubyonrails Rails=3.2.1

rubyonrails Rails=3.2.2

rubyonrails Rails=3.2.2-rc1

rubyonrails Rails=3.2.3

rubyonrails Rails=3.2.3-rc1

rubyonrails Rails=3.2.3-rc2

rubyonrails Rails=3.2.4

rubyonrails Rails=3.2.4-rc1

rubyonrails Rails=3.2.5

rubyonrails Rails=3.2.6

rubyonrails Rails=3.2.7

rubyonrails Rails=3.2.8

rubyonrails Rails=3.2.9

rubyonrails Rails=3.2.10

rubyonrails Rails=3.2.11

rubyonrails Rails=3.2.12

rubyonrails Rails=3.2.13

rubyonrails Rails=3.2.13-rc1

rubyonrails Rails=3.2.13-rc2

rubyonrails ruby on Rails<=3.2.15

rubyonrails ruby on Rails=3.0.4

rubyonrails ruby on Rails=3.1.11

rubyonrails ruby on Rails=3.2.14

rubyonrails ruby on Rails=3.2.14-rc1

rubyonrails ruby on Rails=3.2.14-rc2

rubyonrails ruby on Rails=3.2.15-rc1

rubyonrails ruby on Rails=3.2.15-rc2

Remediation

Recommended actions to resolve this vulnerability, in priority order.

Upgrade
Upgrade rubygems/actionpack to a version that resolves this vulnerability.
Fixed in 4.0.2
Upgrade
Upgrade rubygems/actionpack to a version that resolves this vulnerability.
Fixed in 3.2.16

Event History

Dec 7, 2013

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

Description

Data Sourced

via NVD·12:55 AM

RemedyDescriptionSeverityWeaknessAffected Software

Oct 24, 2017

Advisory Published

06:33 PM

Frequently Asked Questions

What is the severity of CVE-2013-6414?

CVE-2013-6414 is classified as a denial of service vulnerability due to memory consumption issues.

How do I fix CVE-2013-6414?

To fix CVE-2013-6414, upgrade Action Pack to version 4.0.2 or 3.2.16 or later.

Which versions of Ruby on Rails are affected by CVE-2013-6414?