logo

Database

Insecure deserialization In activerecord

Description

Active Record contains deserialization of arbitrary YAML ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.

Mitigation

Update Impact

Minimal update. May introduce new vulnerabilities or breaking changes.

Ecosystem
Component
Affected version
Patched versions

Aliases

1. CVE-2013-02772. NVD-2013-02773. OSV-2013-02774. OSV-DEBIAN-2013-02775. GCVE-2013-02776. SECURITY-TRACKER-CVE-2013-0277

References

1. https://github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2013-0277.yml2. https://groups.google.com/group/rubyonrails-security/msg/302ec7ce90f13837?dmode=source&output=gplain3. https://puppet.com/security/cve/cve-2013-02774. http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html5. http://lists.opensuse.org/opensuse-updates/2013-03/msg00048.html6. http://securitytracker.com/id?10281097. http://support.apple.com/kb/HT57848. http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released9. http://www.debian.org/security/2013/dsa-262010. http://www.openwall.com/lists/oss-security/2013/02/11/6

Does your application use this vulnerable software?

During the free trial, our tools assess your application, identify vulnerabilities, and provide recommendations for their remediation.