CVE-2013-0175 Improper Input Validation in multi_xml
HighCVSS 7.5
EPSS 3.7%
- Published
- Updated
- Exploit status
- No public exploit known
Description
multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems multi_xml(RubyGems) | < 0.5.2 | 0.5.2 |
| rubygems multi_xml(RubyGems) | = 0.0.1 | No fix listed |
| rubygems multi_xml(RubyGems) | = 0.1.0 | No fix listed |
| rubygems multi_xml(RubyGems) | = 0.1.1 | No fix listed |
| rubygems multi_xml(RubyGems) | = 0.1.2 | No fix listed |
| rubygems multi_xml(RubyGems) | = 0.1.3 | No fix listed |
| rubygems multi_xml(RubyGems) | = 0.1.4 | No fix listed |
| rubygems multi_xml(RubyGems) | = 0.2.0 | No fix listed |
| rubygems multi_xml(RubyGems) | = 0.2.1 | No fix listed |
| rubygems multi_xml(RubyGems) | = 0.2.2 | No fix listed |
| rubygems multi_xml(RubyGems) | = 0.3.0 | No fix listed |
| rubygems multi_xml(RubyGems) | = 0.4.0 | No fix listed |
| rubygems multi_xml(RubyGems) | = 0.4.1 | No fix listed |
| rubygems multi_xml(RubyGems) | = 0.4.2 | No fix listed |
| rubygems multi_xml(RubyGems) | = 0.4.3 | No fix listed |
| rubygems multi_xml(RubyGems) | = 0.4.4 | No fix listed |
| rubygems multi_xml(RubyGems) | = 0.5.0 | No fix listed |
| rubygems multi_xml(RubyGems) | = 0.5.1 | No fix listed |
| erik michaels-ober multi xml | = 0.5.2 | No fix listed |
| grape project grape | = 0.1.0 | No fix listed |
| grape project grape | = 0.1.1 | No fix listed |
| grape project grape | = 0.1.2 | No fix listed |
| grape project grape | = 0.1.3 | No fix listed |
| grape project grape | = 0.1.4 | No fix listed |
| grape project grape | = 0.1.5 | No fix listed |
Show 6 more
| Product | Affected versions | Fixed in |
|---|---|---|
| grape project grape | = 0.2.0 | No fix listed |
| grape project grape | = 0.2.1 | No fix listed |
| grape project grape | = 0.2.2 | No fix listed |
| grape project grape | = 0.2.3 | No fix listed |
| grape project grape | = 0.2.4 | No fix listed |
| grape project grape | = 0.2.5 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- github.com patch
- groups.google.com
- news.ycombinator.com
- www.openwall.com
- github.com patch
- github.com
- github.com product
- [oss-security] 20130111 Re: CVE request for multi_xml ruby gem (has same problem as CVE-2013-0156) mailing-list
- gist.github.com
- Debian Security Tracker CVE-2013-0175 vendor-advisory