lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Note | — | Apply OS X security update 2013-002Apply OS X security update 2013-001Upgrade macOS to the latest version | Aug 28, 2015 | Jan 30, 2013 |
| Apple Osx Podcastproducerserver | — | Apply OS X security update 2013-001 | Apr 3, 2013 | Jan 30, 2013 |
| Apple Osx Ruby | — | Apply OS X security update 2013-002 | Jun 20, 2013 | Jan 30, 2013 |
| Apple Osx Wikiserver | — | Apply OS X security update 2013-001 | Apr 3, 2013 | Jan 30, 2013 |
| Debian | — | Upgrade rails | Jul 30, 2024 | Jan 30, 2013 |
| Gentoo Linux | — | Upgrade dev-ruby/rails. | Oct 30, 2017 | Jan 30, 2013 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Jan 3, 2020 | Jan 30, 2013 |
| Suse | — | Upgrade rubygem-rack-1_3-docUpgrade rubygem-activesupportUpgrade rubygem-actionpack-2_3-testsuiteUpgrade rubygem-actionpackUpgrade rubygem-rack-1_2-docUpgrade rubygem-activerecord-3_2-docUpgrade rubygem-actionmailer-2_3-testsuiteUpgrade rubygem-activeresource-3_2-docUpgrade rubygem-rack-1_2Upgrade rubygem-activerecordUpgrade rubygem-actionpack-2_3-docUpgrade rubygem-actionmailer-3_2-docUpgrade rubygem-rack-1_4Upgrade rubygem-actionpack-2_3Upgrade rubygem-activesupport-2_3Upgrade rubygem-rails-3_2Upgrade rubygem-rails-3_2-docUpgrade rubygem-activeresource-2_3Upgrade rubygem-activesupport-2_3-docUpgrade rubygem-activeresource-2_3-testsuiteUpgrade rubygem-rack-1_4-docUpgrade rubygem-rails-2_3Upgrade rubygem-rack-1_2-testsuiteUpgrade rubygem-activesupport-3_2-docUpgrade rubygem-activemodel-3_2Upgrade rubygem-activesupport-3_2Upgrade rubygem-rack-1_1-docUpgrade rubygem-sprockets-2_2Upgrade rubygem-activerecord-2_3-docUpgrade rubygem-rack-1_3Upgrade rubygem-actionmailer-3_2Upgrade rubygem-railties-3_2-docUpgrade rubygem-railsUpgrade rubygem-sprockets-2_2-docUpgrade rubygem-activerecord-2_3Upgrade rubygem-rack-1_1Upgrade rubygem-rack-1_3-testsuiteUpgrade rubygem-activeresource-3_2Upgrade rubygem-rack-1_1-testsuiteUpgrade rubygem-activerecord-2_3-testsuiteUpgrade rubygem-actionmailer-2_3Upgrade rubygem-activemodel-3_2-docUpgrade rubygem-rack-1_4-testsuiteUpgrade rubygem-actionmailer-2_3-docUpgrade rubygem-activeresourceUpgrade rubygem-actionpack-3_2-docUpgrade rubygem-rails-2_3-docUpgrade rubygem-activeresource-2_3-docUpgrade rubygem-actionmailerUpgrade rubygem-actionpack-3_2Upgrade rubygem-activerecord-3_2Upgrade rubygem-railties-3_2 | Feb 17, 2015 | Jan 30, 2013 |
| Ubuntu | — | Upgrade ruby-activesupport-2.3 | Nov 19, 2024 | Jan 30, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub