CVE-2013-0156

Published: Jan 13, 2013Modified: Apr 29, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.

Affected (6)

Products: Rubyonrails: Rails, Ruby On Rails · Debian: Debian Linux

2 products

1 product

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Rubyonrails Rails	From 3.2.0 to 3.2.11
Rubyonrails Ruby On Rails	Before 2.3.15
Rubyonrails Ruby On Rails	From 3.0.0 to 3.0.19
Rubyonrails Ruby On Rails	From 3.1.0 to 3.1.10

Configuration B

2 vulnerable

Vulnerable Software	Affected Versions
Debian Debian Linux	Version 6.0
Debian Debian Linux	Version 7.0

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (28)

http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A

Source: secalert@redhat.com

Third Party AdvisoryUS Government Resource

http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html

Source: secalert@redhat.com

Mailing ListThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-0153.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-0154.html

Source: secalert@redhat.com

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-0155.html

Source: secalert@redhat.com

Third Party Advisory

http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/

Source: secalert@redhat.com

Vendor Advisory

http://www.debian.org/security/2013/dsa-2604

Source: secalert@redhat.com

Third Party Advisory

http://www.fujitsu.com/global/support/software/security/products-f/sw-sv-rcve-ror201301e.html

Source: secalert@redhat.com

Third Party Advisory

http://www.insinuator.net/2013/01/rails-yaml/

Source: secalert@redhat.com

Third Party Advisory

http://www.kb.cert.org/vuls/id/380039

Source: secalert@redhat.com

Third Party AdvisoryUS Government Resource

http://www.kb.cert.org/vuls/id/628463

Source: secalert@redhat.com

Third Party AdvisoryUS Government Resource

https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156

Source: secalert@redhat.com

Third Party Advisory

https://groups.google.com/group/rubyonrails-security/msg/c1432d0f8c70e89d?dmode=source&output=gplain

Source: secalert@redhat.com

Third Party Advisory

https://puppet.com/security/cve/cve-2013-0156

Source: secalert@redhat.com

Third Party Advisory

http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html

Source: af854a3a-2127-422b-91ae-364da2661108

Mailing ListThird Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-0153.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-0154.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://rhn.redhat.com/errata/RHSA-2013-0155.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.debian.org/security/2013/dsa-2604

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.fujitsu.com/global/support/software/security/products-f/sw-sv-rcve-ror201301e.html

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.insinuator.net/2013/01/rails-yaml/

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

http://www.kb.cert.org/vuls/id/380039

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

http://www.kb.cert.org/vuls/id/628463

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party AdvisoryUS Government Resource

https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://groups.google.com/group/rubyonrails-security/msg/c1432d0f8c70e89d?dmode=source&output=gplain

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

https://puppet.com/security/cve/cve-2013-0156

Source: af854a3a-2127-422b-91ae-364da2661108

Third Party Advisory

Timeline

No history available yet.