~ / search / GHSA-jmgw-6vjg-jjwg

GHSA-jmgw-6vjg-jjwg

actionpack Improper Input Validation vulnerability

Source: GitHub Advisory Database (reviewed) High CVE-2013-0156

Packages

EcosystemPackageAffectedFixed in
RubyGems actionpack < 2.3.15 2.3.15
RubyGems actionpack >= 3.0.0, < 3.0.19 3.0.19
RubyGems actionpack >= 3.1.0, < 3.1.10 3.1.10
RubyGems actionpack >= 3.2.0, < 3.2.11 3.2.11

Details

As written in the advisory (Markdown source, shown as plain text).

`active_support/core_ext/hash/conversions.rb` in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.

References

External links from the advisory. They lead to third-party sites.