GitHub Advisoryadvisory · RubyGems

GHSA-fhj9-cjjh-27vm Active Record contains deserialization of arbitrary YAML

CRITICAL Published 2017-10-24 Modified 2023-03-14 Official page ↗
Aliases
CVE-2013-0277
Ecosystem
RubyGems
Packages
activerecord
Severity
Critical
Weaknesses
CWE-502
Reviewed
2020-06-16

Affected packages

• RubyGems activerecord: < 2.3.17 → fixed in 2.3.17 • RubyGems activerecord: >= 3.0.0, < 3.1.0 → fixed in 3.1.0

Description

ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.

Related

Alias · CVE (1)

  • CVE-2013-0277 ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary… vulnerability

Weakness · CWE (1)

  • CWE-502 Deserialization of Untrusted Data weakness

References