CVE-2013-0156

🗓️ 13 Jan 2013 22:00:00Reported by redhatType

cve🔗 web.nvd.nist.gov📰️ 1 Media mentions👁 299 Views

active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion

Reporter	Title	Published	Views	Family All 144
0day.today	Action Pack Multiple Vulnerabilities	9 Jan 201300:00	–	zdt
0day.today	Ruby On Rails XML Processor YAML Deserialization Code Execution	11 Jan 201300:00	–	zdt
0day.today	Ruby on Rails JSON Processor YAML Deserialization Code Execution	29 Jan 201300:00	–	zdt
IBM Security Bulletins	Security Bulletin: IBM Security Network Intrusion Prevention System can be affected by vulnerabilities in Ruby on Rails (CVE-2012-2660, CVE-2012-2694, CVE-2013-0156, CVE-2012-6496, CVE-2012-3424, and CVE-2012-2695)	25 Jan 202120:13	–	ibm
GithubExploit	Exploit for Improper Input Validation in Rubyonrails Rails	28 Aug 202522:15	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Rubyonrails Rails	12 Jan 201313:37	–	githubexploit
Tenable Nessus	Mac OS X 10.8 < 10.8.3 Multiple Vulnerabilities (Security Update 2013-001)	16 Mar 201300:00	–	nessus
Tenable Nessus	Mac OS X 10.8 < 10.8.3 Multiple Vulnerabilities (Security Update 2013-001)	16 Mar 201300:00	–	nessus
Tenable Nessus	Debian DLA-172-1 : libextlib-ruby security update	26 Mar 201500:00	–	nessus
Tenable Nessus	Debian DSA-2604-1 : rails - insufficient input validation	10 Jan 201300:00	–	nessus

NVD

Node

rubyonrails railsRange3.2.0–3.2.11

rubyonrails ruby_on_railsRange<2.3.15

rubyonrails ruby_on_railsRange3.0.0–3.0.19

rubyonrails ruby_on_railsRange3.1.0–3.1.10

Node

debian debian_linuxMatch6.0

debian debian_linuxMatch7.0

Source	Link
insinuator	www.insinuator.net/2013/01/rails-yaml/
weblog	www.weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/
debian	www.debian.org/security/2013/dsa-2604
fujitsu	www.fujitsu.com/global/support/software/security/products-f/sw-sv-rcve-ror201301e.html
community	www.community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156
kb	www.kb.cert.org/vuls/id/380039
kb	www.kb.cert.org/vuls/id/628463
rhn	www.rhn.redhat.com/errata/RHSA-2013-0155.html
lists	www.lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
rhn	www.rhn.redhat.com/errata/RHSA-2013-0153.html

29 Apr 2026 01:13Current

9.6High risk

Vulners AI Score9.6

CVSS 27.5

EPSS0.91907

CWE-20