CVE-2013-1802 extlib does not properly restrict casts of string values
HighCVSS 7.5
EPSS 3.4%
PoC
- Published
- Updated
- Exploit status
- Proof-of-concept only
Description
The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| rubygems extlib(RubyGems) | < 0.9.16 | 0.9.16 |
| rubygems extlib(RubyGems) | = 0.9.10 | No fix listed |
| rubygems extlib(RubyGems) | = 0.9.11 | No fix listed |
| rubygems extlib(RubyGems) | = 0.9.12 | No fix listed |
| rubygems extlib(RubyGems) | = 0.9.13 | No fix listed |
| rubygems extlib(RubyGems) | = 0.9.14 | No fix listed |
| rubygems extlib(RubyGems) | = 0.9.15 | No fix listed |
| rubygems extlib(RubyGems) | = 0.9.2 | No fix listed |
| rubygems extlib(RubyGems) | = 0.9.3 | No fix listed |
| rubygems extlib(RubyGems) | = 0.9.4 | No fix listed |
| rubygems extlib(RubyGems) | = 0.9.5 | No fix listed |
| rubygems extlib(RubyGems) | = 0.9.6 | No fix listed |
| rubygems extlib(RubyGems) | = 0.9.7 | No fix listed |
| rubygems extlib(RubyGems) | = 0.9.8 | No fix listed |
| rubygems extlib(RubyGems) | = 0.9.9 | No fix listed |
| debian/ruby-extlib(Debian:12) | < 0.9.15-3 | 0.9.15-3 |
| debian/ruby-extlib(Debian:13) | < 0.9.15-3 | 0.9.15-3 |
| debian/ruby-extlib(Debian:14) | < 0.9.15-3 | 0.9.15-3 |
| dan kubb extlib | <= 0.9.15 | No fix listed |
| dan kubb extlib | = 0.9.2 | No fix listed |
| dan kubb extlib | = 0.9.3 | No fix listed |
| dan kubb extlib | = 0.9.4 | No fix listed |
| dan kubb extlib | = 0.9.5 | No fix listed |
| dan kubb extlib | = 0.9.6 | No fix listed |
| dan kubb extlib | = 0.9.7 | No fix listed |
Show 7 more
| Product | Affected versions | Fixed in |
|---|---|---|
| dan kubb extlib | = 0.9.8 | No fix listed |
| dan kubb extlib | = 0.9.9 | No fix listed |
| dan kubb extlib | = 0.9.10 | No fix listed |
| dan kubb extlib | = 0.9.11 | No fix listed |
| dan kubb extlib | = 0.9.12 | No fix listed |
| dan kubb extlib | = 0.9.13 | No fix listed |
| dan kubb extlib | = 0.9.14 | No fix listed |
References
- nvd.nist.gov third-party-advisory vendor-advisory
- bugzilla.redhat.com
- github.com exploit patch
- SUSE-SU-2013:0612 vendor-advisory
- web.archive.org
- github.com exploit
- github.com
- github.com product
- Debian Security Tracker CVE-2013-1802 vendor-advisory
- support.cloud.engineyard.com
- bugs.debian.org issue-tracking