rails - several

2013-02-1200:00:00

Google

osv.dev

10 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:N/C:C/I:C/A:C

0.099 Low

EPSS

Percentile

94.0%

JSON

Two vulnerabilities were discovered in Ruby on Rails, a Ruby framework
for web application development.

CVE-2013-0276
The blacklist provided by the attr_protected method could be
bypassed with crafted requests, having an application-specific
impact.
CVE-2013-0277
In some applications, the +serialize+ helper in ActiveRecord
could be tricked into deserializing arbitrary YAML data,
possibly leading to remote code execution.

For the stable distribution (squeeze), these problems have been fixed
in version 2.3.5-1.2+squeeze7.

We recommend that you upgrade your rails packages.

CPENameOperatorVersion
railseq2.3.5-1.2
railseq2.3.5-1.2+squeeze0.1
railseq2.3.5-1.2+squeeze1
railseq2.3.5-1.2+squeeze2
railseq2.3.5-1.2+squeeze3
railseq2.3.5-1.2+squeeze4
railseq2.3.5-1.2+squeeze4.1
railseq2.3.5-1.2+squeeze5
railseq2.3.5-1.2+squeeze6

Name	Operator	Version
rails	eq	2.3.5-1.2
rails	eq	2.3.5-1.2+squeeze0.1
rails	eq	2.3.5-1.2+squeeze1
rails	eq	2.3.5-1.2+squeeze2
rails	eq	2.3.5-1.2+squeeze3
rails	eq	2.3.5-1.2+squeeze4
rails	eq	2.3.5-1.2+squeeze4.1
rails	eq	2.3.5-1.2+squeeze5
rails	eq	2.3.5-1.2+squeeze6