VulnerabilityModified
CVE-2013-1854
The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to…
MEDIUM 5.0EPSS 3.44%
Does this matter?
Lower severity and a low EPSS score (3.44%). Track it; it rarely justifies an emergency change on its own.
Description
The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.
- CVSS 2.0
- 5.0 MEDIUMAV:N/AC:L/Au:N/C:N/I:N/A:P
- EPSS
- 3.44% probability · 88th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- rubyonrails/rails · rubyonrails/ruby on rails · redhat/enterprise linux
- Source
- secalert@redhat.com
References
- http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
- http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00070.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00071.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00075.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00078.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00079.html
- http://rhn.redhat.com/errata/RHSA-2013-0699.html
- http://rhn.redhat.com/errata/RHSA-2014-1863.html
- http://support.apple.com/kb/HT5784
- http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/
- https://groups.google.com/group/ruby-security-ann/msg/34e0d780b04308de?dmode=source&output=gplain
- http://lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
- http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00070.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00071.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00075.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00078.html
- http://lists.opensuse.org/opensuse-updates/2013-04/msg00079.html
- http://rhn.redhat.com/errata/RHSA-2013-0699.html
- http://rhn.redhat.com/errata/RHSA-2014-1863.html
- http://support.apple.com/kb/HT5784
- http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/
- https://groups.google.com/group/ruby-security-ann/msg/34e0d780b04308de?dmode=source&output=gplain
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.