lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.
CVSS Details
- CVSS 3.1 Base Score: 7.3
Covered by Rapid7
| Product | Vendor Advisory | Solution File | Added | Published |
|---|---|---|---|---|
| Apple Osx Note | — | Apply OS X security update 2013-002Apply OS X security update 2013-001Upgrade macOS to the latest version | Aug 28, 2015 | Jan 30, 2013 |
| Apple Osx Podcastproducerserver | — | Apply OS X security update 2013-001 | Apr 3, 2013 | Jan 30, 2013 |
| Apple Osx Ruby | — | Apply OS X security update 2013-002 | Jun 20, 2013 | Jan 30, 2013 |
| Apple Osx Wikiserver | — | Apply OS X security update 2013-001 | Apr 3, 2013 | Jan 30, 2013 |
| Debian | — | Upgrade rails | Jul 30, 2024 | Jan 30, 2013 |
| Gentoo Linux | — | Upgrade dev-ruby/rails. | Oct 30, 2017 | Jan 30, 2013 |
| Ruby_on_rails | — | Upgrade to the latest version of Ruby on Rails | Jan 3, 2020 | Jan 30, 2013 |
| Suse | — | Upgrade rubygem-actionmailer-3_2Upgrade rubygem-railties-3_2-docUpgrade rubygem-rack-1_3Upgrade rubygem-activeresource-2_3-docUpgrade rubygem-activeresource-3_2Upgrade rubygem-actionmailer-2_3Upgrade rubygem-actionpack-3_2Upgrade rubygem-rack-1_3-testsuiteUpgrade rubygem-rack-1_1-testsuiteUpgrade rubygem-activeresourceUpgrade rubygem-activerecord-2_3Upgrade rubygem-activerecord-3_2Upgrade rubygem-activerecord-2_3-testsuiteUpgrade rubygem-sprockets-2_2-docUpgrade rubygem-activerecord-2_3-docUpgrade rubygem-activemodel-3_2Upgrade rubygem-actionmailerUpgrade rubygem-rails-2_3-docUpgrade rubygem-rack-1_4-testsuiteUpgrade rubygem-sprockets-2_2Upgrade rubygem-rack-1_1Upgrade rubygem-rack-1_1-docUpgrade rubygem-railsUpgrade rubygem-activesupport-3_2-docUpgrade rubygem-railties-3_2Upgrade rubygem-activemodel-3_2-docUpgrade rubygem-actionpack-3_2-docUpgrade rubygem-actionmailer-2_3-docUpgrade rubygem-activesupport-3_2Upgrade rubygem-rack-1_2-docUpgrade rubygem-rack-1_2Upgrade rubygem-activeresource-2_3Upgrade rubygem-activerecord-3_2-docUpgrade rubygem-activeresource-2_3-testsuiteUpgrade rubygem-actionmailer-3_2-docUpgrade rubygem-rack-1_4Upgrade rubygem-actionpack-2_3-docUpgrade rubygem-rack-1_4-docUpgrade rubygem-activesupport-2_3Upgrade rubygem-actionpack-2_3-testsuiteUpgrade rubygem-actionpack-2_3Upgrade rubygem-activesupportUpgrade rubygem-rack-1_3-docUpgrade rubygem-rack-1_2-testsuiteUpgrade rubygem-rails-3_2-docUpgrade rubygem-activerecordUpgrade rubygem-activeresource-3_2-docUpgrade rubygem-activesupport-2_3-docUpgrade rubygem-actionmailer-2_3-testsuiteUpgrade rubygem-actionpackUpgrade rubygem-rails-3_2Upgrade rubygem-rails-2_3 | Feb 17, 2015 | Jan 30, 2013 |
| Ubuntu | — | Upgrade ruby-activesupport-2.3 | Nov 19, 2024 | Jan 30, 2013 |
Prioritise with Active Threat Intelligence
With curated Threat Intelligence, you can see which vulnerabilities truly put you at risk, prioritize what matters most, and act before attackers do.
Explore Intelligence Hub