Lucene search
Https://gitlab.com/gitlab-org/security-products/gemnasium-dbGITLAB-F2AA05A37BE3241305C7EF2F76D0E39DHistoryFeb 12, 2013 - 12:00 a.m.
Serialized Attributes YAML Vulnerability with Rails 2.3 and 3.0
2013-02-1200:00:00
https://gitlab.com/gitlab-org/security-products/gemnasium-db
gitlab.com
11
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.099 Low
EPSS
Percentile
94.8%
There is a vulnerability in the serialized attribute handling code in Ruby on Rails, applications which allow users to directly assign to the serialized fields in their models are at risk of Denial of Service or Remote Code Execution vulnerabilities.
| CPE | Name | Operator | Version |
|---|---|---|---|
| gem/activerecord | lt | 2.3.17 | |
| gem/activerecord | ge | 2.4.0 | |
| gem/activerecord | lt | 3.1.0 |
Related
github
github
Active Record contains deserialization of arbitrary YAML
2017-10-24 18:33:37
seebug
seebug
Ruby on Rails θΏη¨δ»£η ζ§θ‘ζΌζ΄(CVE-2013-0277)
2013-03-07 00:00:00
cve
cve
CVE-2013-0277
2013-02-13 01:55:00
ubuntucve
ubuntucve
CVE-2013-0277
2013-02-13 00:00:00
debiancve
debiancve
CVE-2013-0277
2013-02-13 01:55:00
nessus
nessus
Fedora 17 : rubygem-activerecord-3.0.11-6.fc17 (2013-2351)
2013-02-21 00:00:00
Debian DSA-2620-1 : rails - several vulnerabilities
2013-02-13 00:00:00
openSUSE Security Update : RubyOnRails (openSUSE-SU-2013:0338-1)
2014-06-13 00:00:00
prion
prion
Code injection
2013-02-13 01:55:00
osv
osv
Active Record contains deserialization of arbitrary YAML
2017-10-24 18:33:37
rails - several
2013-02-12 00:00:00
rubygems
rubygems
debian
debian
[SECURITY] [DSA 2620-1] rails security update
2013-02-12 21:09:50
openvas
openvas
Debian: Security Advisory (DSA-2620-1)
2013-02-11 00:00:00
Debian Security Advisory DSA 2620-1 (rails - several vulnerabilities)
2013-02-12 00:00:00
Fedora Update for rubygem-activerecord FEDORA-2013-2351
2013-02-22 00:00:00
securityvulns
securityvulns
[SECURITY] [DSA 2620-1] rails security update
2013-02-18 00:00:00
Web applications security vulnerabilities summary (PHP, ASP, JSP, CGI, Perl)
2013-02-18 00:00:00
Apple Mac OS X multiple security vulnerabilities
2013-06-17 00:00:00
threatpost
threatpost
Ruby on Rails Patches DoS, Remote Execution Flaws
2013-02-13 17:51:57
fedora
fedora
[SECURITY] Fedora 17 Update: rubygem-activerecord-3.0.11-6.fc17
2013-02-21 05:33:12
suse
suse
Security update for Ruby on Rails (important)
2013-04-03 20:06:19
Security update for Ruby On Rails (important)
2013-03-19 18:04:46
gentoo
gentoo
Ruby on Rails: Multiple vulnerabilities
2014-12-14 00:00:00
10 High
CVSS2
Access Vector
NETWORK
Access Complexity
LOW
Authentication
NONE
Confidentiality Impact
COMPLETE
Integrity Impact
COMPLETE
Availability Impact
COMPLETE
AV:N/AC:L/Au:N/C:C/I:C/A:C
0.099 Low
EPSS
Percentile
94.8%
Related for GITLAB-F2AA05A37BE3241305C7EF2F76D0E39D