Skip to content
Fencer Intel
high 7.5

CVE-2013-0156 in the critical feed json

actionpack Improper Input Validation vulnerability

published 13y ago modified 4mo ago also GHSA-jmgw-6vjg-jjwg , EUVD-2017-0264

cvss
7.5
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
99.0%
EPSS 99.0% chance of exploitation in 30 days, percentile 99.9%
public exploits
5
Metasploit and Exploit-DB

Summary

active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.

Patch / fix

  • rubygems actionpack 2.3.15, 3.0.19, 3.1.10, 3.2.11
  • rubyonrails rails 3.2.11
  • rubyonrails ruby_on_rails 2.3.15, 3.0.19, 3.1.10
  • rails Debian 14, Debian 13, Debian 12 2.3.14.1

debian advisories DEBIAN-CVE-2013-0156

  • rubygem-actionpack openshift 1 1:3.0.13-2.1.el6op
  • rubygem-activesupport openshift 1 1:3.0.13-2.el6op
  • ruby193-rubygem-actionpack openshift 1 1:3.2.8-2.el6
  • ruby193-rubygem-activesupport openshift 1 1:3.2.8-3.el6

red hat advisories RHSA-2013:0153

  • rubygem-extlib openSUSE Tumbleweed 0.9.16-7.4

opensuse advisories openSUSE-SU-2024:10188-1

Is CVE-2013-0156 in your dependencies? Fencer shows which of your repositories are affected as soon as an advisory lands, and opens the fix as a pull request.

Check with Fencer

Vendor advisories

What the vendors themselves say about their products: affected, fixed or not affected, and what to do.

red hat product security vex CVE-2013-0156 updated cvss 7.5

rubygem-activesupport: Multiple vulnerabilities in parameter parsing in ActionPack

  • Red Hat CloudForms Cloud Engine for RHEL 6 Server rubygem-actionpack 3.0.10-11.el6cf, rubygem-activerecord 3.0.10-8.el6cf, rubygem-activesupport 3.0.10-5.el6cf Red Hat CloudForms System Engine for RHEL 6 Server rubygem-actionpack 3.0.10-11.el6cf, rubygem-activerecord 3.0.10-8.el6cf, rubygem-activesupport 3.0.10-5.el6cf
    fixed: vendor fix RHSA-2013:0155
  • Red Hat OpenShift Enterprise Infrastructure rubygem-actionpack 3.0.13-2.1.el6op, rubygem-activesupport 3.0.13-2.el6op, ruby193-rubygem-actionpack 3.2.8-2.el6, ruby193-rubygem-activesupport 3.2.8-3.el6 Red Hat OpenShift Enterprise Node rubygem-activesupport 3.0.13-2.el6op, ruby193-rubygem-actionpack 3.2.8-2.el6, ruby193-rubygem-activesupport 3.2.8-3.el6
    fixed: vendor fix RHSA-2013:0153
  • Red Hat Subscription Asset Manager for RHEL 6 Server rubygem-actionpack 3.0.10-11.el6cf, rubygem-activerecord 3.0.10-8.el6cf, rubygem-activesupport 3.0.10-5.el6cf
    fixed: vendor fix RHSA-2013:0154

Red Hat CSAF VEX © Red Hat, Inc., from https://security.access.redhat.com/data/csaf/v2/vex/; changed: reduced to product statuses and remediations. CC BY 4.0 · csaf

Timeline

  1. First public exploit (Metasploit exploit/multi/http/rails_xml_yaml_code_exec)
  2. Published

Exploit prediction

98.98% chance of exploitation in the next 30 days, higher than 99.9% of all scored CVEs (FIRST EPSS, 2026-11-09).

Exploits and checks

CVSS scores

assigned by version score vector
NVD 2.0 7.5 AV:N/AC:L/Au:N/C:P/I:P/A:P

Affected packages

ecosystem package affected fixed in
rubygems actionpack
<2.3.15
>=3.0.0, <3.0.19
>=3.1.0, <3.1.10
>=3.2.0, <3.2.11
2.3.15
3.0.19
3.1.10
3.2.11

Classification

Weakness
  • CWE-20 Improper Input Validation
Technology feeds

References

Sources

Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.