GHSA-3crr-9vmg-864v
Active Record Improper Input Validation
At a glance
- Published
- Updated
- CVE
- CVE-2013-1854
Description
The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.
Affected packages
| Package | Versions |
|---|---|
| RubyGems · activerecord | introduced 2.3.0, fixed 2.3.18 |
| RubyGems · activerecord | introduced 3.1.0, fixed 3.1.12 |
| RubyGems · activerecord | introduced 3.2.0, fixed 3.2.13 |
References
- https://nvd.nist.gov/vuln/detail/CVE-2013-1854 ADVISORY
- https://access.redhat.com/errata/RHSA-2013:0699 WEB
- https://access.redhat.com/errata/RHSA-2014:1863 WEB
- https://access.redhat.com/security/cve/CVE-2013-1854 WEB
- https://bugzilla.redhat.com/show_bug.cgi?id=921329 WEB
- https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2013-1854.yml WEB
- https://groups.google.com/group/ruby-security-ann/msg/34e0d780b04308de?dmode=source&output=gplain WEB
- http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html WEB
- http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html WEB
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00070.html WEB
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00071.html WEB
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00075.html WEB
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00078.html WEB
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00079.html WEB
- http://rhn.redhat.com/errata/RHSA-2013-0699.html WEB
- http://rhn.redhat.com/errata/RHSA-2014-1863.html WEB
- http://support.apple.com/kb/HT5784 WEB
- http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released WEB
Sources
| Source | Licence |
|---|---|
| OSV.dev | CC-BY 4.0 — GitHub Advisory Database |