Vulnerability advisory

GHSA-xgr2-v94m-rc9g

activesupport in Rails vulnerable to incorrect data conversion

Published Oct 24, 2017Updated Nov 29, 2024OSV record ↗

Also known as CVE-2013-0333

Severity

Severity not reported.

Affected versions

activesupport RubyGems

All activesupport advisories →

Affected	Fixed in
`2.3.2` to before 2.3.16	`2.3.16`Advisories →
Also listed as affected (16) `2.3.10` `2.3.11` `2.3.12` `2.3.14` `2.3.15` `2.3.2` `2.3.3` `2.3.4` `2.3.5` `2.3.6` `2.3.6.pre` `2.3.7` `2.3.8` `2.3.8.pre1` `2.3.9` `2.3.9.pre`
`3.0.0` to before 3.0.20	`3.0.20`Advisories →
Also listed as affected (36) `3.0.0` `3.0.1` `3.0.10` `3.0.10.rc1` `3.0.11` `3.0.12` `3.0.12.rc1` `3.0.13` `3.0.13.rc1` `3.0.14` `3.0.15` `3.0.16` `3.0.17` `3.0.18` `3.0.19` `3.0.2` `3.0.3` `3.0.4` `3.0.4.rc1` `3.0.5` `3.0.5.rc1` `3.0.6` `3.0.6.rc1` `3.0.6.rc2` `3.0.7` `3.0.7.rc1` `3.0.7.rc2` `3.0.8` `3.0.8.rc1` `3.0.8.rc2` `3.0.8.rc4` `3.0.9` `3.0.9.rc1` `3.0.9.rc3` `3.0.9.rc4` `3.0.9.rc5`

Description

lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.

GHSA-xgr2-v94m-rc9g

Affected versions

activesupport RubyGems

Description

References