CVE-2013-0269

Published: Feb 13, 2013Modified: Apr 29, 2026

7.5

Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Exploitability: 10.0 / Impact: 6.4

Source: NVD

Description

The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."

Affected (20)

Products: Rubygems: Json Gem

1 product

Configuration A

20 vulnerable

Vulnerable Software	Affected Versions
Rubygems Json Gem	Version 1.5.0
Rubygems Json Gem	Version 1.5.1
Rubygems Json Gem	Version 1.5.2
Rubygems Json Gem	Version 1.5.3
Rubygems Json Gem	Version 1.5.4
Rubygems Json Gem	Version 1.6.0
Rubygems Json Gem	Version 1.6.1
Rubygems Json Gem	Version 1.6.2
Rubygems Json Gem	Version 1.6.3
Rubygems Json Gem	Version 1.6.4
Rubygems Json Gem	Version 1.6.5
Rubygems Json Gem	Version 1.6.6
Rubygems Json Gem	Version 1.6.7
Rubygems Json Gem	Version 1.7.0
Rubygems Json Gem	Version 1.7.1
Rubygems Json Gem	Version 1.7.2
Rubygems Json Gem	Version 1.7.3
Rubygems Json Gem	Version 1.7.4
Rubygems Json Gem	Version 1.7.5
Rubygems Json Gem	Version 1.7.6

Related CWEs

Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

References (46)

http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html

Source: secalert@redhat.com

http://lists.opensuse.org/opensuse-updates/2013-04/msg00034.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-0686.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-0701.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-1028.html

Source: secalert@redhat.com

http://rhn.redhat.com/errata/RHSA-2013-1147.html

Source: secalert@redhat.com

http://secunia.com/advisories/52075

Source: secalert@redhat.com

Vendor Advisory

http://secunia.com/advisories/52774

Source: secalert@redhat.com

http://secunia.com/advisories/52902

Source: secalert@redhat.com

http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed

Source: secalert@redhat.com

http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/

Source: secalert@redhat.com

Vendor Advisory

http://www.openwall.com/lists/oss-security/2013/02/11/7

Source: secalert@redhat.com

http://www.openwall.com/lists/oss-security/2013/02/11/8

Source: secalert@redhat.com

http://www.osvdb.org/90074

Source: secalert@redhat.com

http://www.securityfocus.com/bid/57899

Source: secalert@redhat.com

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.426862

Source: secalert@redhat.com

http://www.ubuntu.com/usn/USN-1733-1

Source: secalert@redhat.com

http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection

Source: secalert@redhat.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/82010

Source: secalert@redhat.com

https://groups.google.com/group/rubyonrails-security/msg/d8e0db6e08c81428?dmode=source&output=gplain

Source: secalert@redhat.com

https://puppet.com/security/cve/cve-2013-0269

Source: secalert@redhat.com

http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://lists.opensuse.org/opensuse-updates/2013-04/msg00034.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-0686.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-0701.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-1028.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://rhn.redhat.com/errata/RHSA-2013-1147.html

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/52075

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://secunia.com/advisories/52774

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/52902

Source: af854a3a-2127-422b-91ae-364da2661108

http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed

Source: af854a3a-2127-422b-91ae-364da2661108

http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.openwall.com/lists/oss-security/2013/02/11/7

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.openwall.com/lists/oss-security/2013/02/11/8

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.osvdb.org/90074

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securityfocus.com/bid/57899

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.426862

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.ubuntu.com/usn/USN-1733-1

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/82010

Source: af854a3a-2127-422b-91ae-364da2661108

https://groups.google.com/group/rubyonrails-security/msg/d8e0db6e08c81428?dmode=source&output=gplain

Source: af854a3a-2127-422b-91ae-364da2661108

https://puppet.com/security/cve/cve-2013-0269

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.