GHSA-xgr2-v94m-rc9g CVE-2013-0333
activesupport in Rails vulnerable to incorrect data conversion
- Severity
- High
- The publisher's own rating, not a CVSS score
- Exploit chance (EPSS)
- 95.57%
- Chance of exploitation in the next 30 days. Higher than 99.87% of scored vulnerabilities.
- Known exploited
- No
- Not in CISA's catalog
- Weakness
- CWE-74 Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
- Fix
2.3.16- Upgrade activesupport to this version or later
Description
lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
Affected versions
RubyGems
| Package | Vulnerable | Fixed in |
|---|---|---|
| activesupport | >= 2.3.2, < 2.3.16 |
2.3.16 |
| activesupport | >= 3.0.0, < 3.0.20 |
3.0.20 |
How to fix
Move to the fixed version or later with your package manager, update the lockfile, and run your tests. If the package only arrives through another dependency, upgrade that dependency first. If none of its releases pulls a fixed version yet, force the version with your package manager's override.
activesupport RubyGems → 2.3.16
- bundler
bundle update activesupport # Gemfile: gem "activesupport", ">= 2.3.16"
Weakness
CWE-74: Improper Neutralization of Special Elements in Output Used by a Downstream Component ('Injection')
The product constructs all or part of a command, data structure, or record using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify how it is parsed or interpreted when it is sent to a downstream component.
How to prevent it
- Requirements: Programming languages and supporting technologies might be chosen which are not subject to these issues.
- Implementation: Utilize an appropriate mix of allowlist and denylist parsing to filter control-plane syntax from all input.
References
Advisories
Other links
- access.redhat.com/errata/RHSA-2013:0201
- access.redhat.com/errata/RHSA-2013:0202
- access.redhat.com/errata/RHSA-2013:0203
- access.redhat.com/security/cve/CVE-2013-0333
- bugzilla.redhat.com/show_bug.cgi
- github.com/rubysec/ruby-advisory-db/blob/master/gems/activesupport/CVE-2013-033…
- groups.google.com/forum
- groups.google.com/group/rubyonrails-security/msg/52179af76915e518
- puppet.com/security/cve/cve-2013-0333
- lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
- lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
- rhn.redhat.com/errata/RHSA-2013-0201.html
- rhn.redhat.com/errata/RHSA-2013-0202.html
- rhn.redhat.com/errata/RHSA-2013-0203.html
- support.apple.com/kb/HT5784
- weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released
- debian.org/security/2013/dsa-2613
- kb.cert.org/vuls/id/628463
Timeline
- Published
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-2j26-frm8-cmj9 Rails Active Support has a possible DoS vulnerability in its number helpers | High | Also affects activesupport |
| GHSA-89vf-4333-qx8v Rails Active Support has a possible XSS vulnerability in SafeBuffer#% | Medium | Also affects activesupport |
| GHSA-cg4j-q9v8-6v38 Rails Active Support has a possible ReDoS vulnerability in number_to_delimited | Medium | Also affects activesupport |
| GHSA-cr5q-6q9f-rq6q Active Support Possibly Discloses Locally Encrypted Files | Medium | Also affects activesupport |
| GHSA-pj73-v5mw-pm9j Possible XSS Security Vulnerability in SafeBuffer#bytesplice | Medium | Also affects activesupport |
| GHSA-j6gc-792m-qgm2 ReDoS based DoS vulnerability in Active Support's underscore | Low | Also affects activesupport |
| GHSA-2p68-f74v-9wc6 ActiveSupport potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore | Critical | Also affects activesupport |
| GHSA-qv8p-v9qw-wc7g activesupport Cross-site Scripting vulnerability | Medium | Also affects activesupport |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor