Vulnerability advisory

GHSA-jmgw-6vjg-jjwg

actionpack Improper Input Validation vulnerability

Published Oct 24, 2017Updated Nov 30, 2024OSV record ↗

Also known as CVE-2013-0156

Severity

Severity not reported.

Affected versions

actionpack RubyGems

All actionpack advisories →

Affected	Fixed in
All versions before 2.3.15	`2.3.15`Advisories →
Also listed as affected (59) `0.9.0` `0.9.5` `1.0.0` `1.0.1` `1.1.0` `1.10.1` `1.10.2` `1.11.0` `1.11.1` `1.11.2` `1.12.0` `1.12.1` `1.12.2` `1.12.3` `1.12.4` `1.12.5` `1.13.0` `1.13.1` `1.13.2` `1.13.3` `1.13.4` `1.13.5` `1.13.6` `1.2.0` `1.3.0` `1.3.1` `1.4.0` `1.5.0` `1.5.1` `1.6.0` `1.7.0` `1.8.0` `1.8.1` `1.9.0` `1.9.1` `2.0.0` `2.0.1` `2.0.2` `2.0.4` `2.0.5` `2.1.0` `2.1.1` `2.1.2` `2.2.2` `2.2.3` `2.3.10` `2.3.11` `2.3.12` `2.3.14` `2.3.2` `2.3.3` `2.3.4` `2.3.5` `2.3.6` `2.3.7` `2.3.8` `2.3.8.pre1` `2.3.9` `2.3.9.pre`
`3.0.0` to before 3.0.19	`3.0.19`Advisories →
Also listed as affected (35) `3.0.0` `3.0.1` `3.0.10` `3.0.10.rc1` `3.0.11` `3.0.12` `3.0.12.rc1` `3.0.13` `3.0.13.rc1` `3.0.14` `3.0.15` `3.0.16` `3.0.17` `3.0.18` `3.0.2` `3.0.3` `3.0.4` `3.0.4.rc1` `3.0.5` `3.0.5.rc1` `3.0.6` `3.0.6.rc1` `3.0.6.rc2` `3.0.7` `3.0.7.rc1` `3.0.7.rc2` `3.0.8` `3.0.8.rc1` `3.0.8.rc2` `3.0.8.rc4` `3.0.9` `3.0.9.rc1` `3.0.9.rc3` `3.0.9.rc4` `3.0.9.rc5`
`3.1.0` to before 3.1.10	`3.1.10`Advisories →
Also listed as affected (17) `3.1.0` `3.1.1` `3.1.1.rc1` `3.1.1.rc2` `3.1.1.rc3` `3.1.2` `3.1.2.rc1` `3.1.2.rc2` `3.1.3` `3.1.4` `3.1.4.rc1` `3.1.5` `3.1.5.rc1` `3.1.6` `3.1.7` `3.1.8` `3.1.9`
`3.2.0` to before 3.2.11	`3.2.11`Advisories →
Also listed as affected (21) `3.2.0` `3.2.1` `3.2.10` `3.2.2` `3.2.2.rc1` `3.2.3` `3.2.3.rc1` `3.2.3.rc2` `3.2.4` `3.2.4.rc1` `3.2.5` `3.2.6` `3.2.7` `3.2.7.rc1` `3.2.8` `3.2.8.rc1` `3.2.8.rc2` `3.2.9` `3.2.9.rc1` `3.2.9.rc2` `3.2.9.rc3`

Description

active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.

GHSA-jmgw-6vjg-jjwg

Affected versions

actionpack RubyGems

Description

References