PT-2013-2216 · New Relic · Ruby Agent

Publicado 2013-04-09 · Atualizado 2017-10-24 · CVE-2013-0284

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Média

Vetor base

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ruby agent versions 3.2.0 through 3.5.2 Ruby agent versions 3.2.0 through 3.5.3.23

Description The issue allows remote attackers to obtain sensitive information, including database credentials and SQL statements, by sniffing the network and deserializing the data. This occurs because the Ruby agent serializes sensitive data when communicating with New Relic servers.

Recommendations For Ruby agent versions 3.2.0 through 3.5.2, update to a version outside of this range to mitigate the risk. For Ruby agent versions 3.2.0 through 3.5.3.23, update to a version outside of this range to mitigate the risk.

Exploit

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2013-0284

GHSA-Q6CW-2553-7837

Produtos afetados

Ruby Agent

Referências · 8

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/newrelic_rpm/CVE-2013-0284.yml · Exploit
• https://github.com/newrelic/newrelic-ruby-agent · Nota
• https://newrelic.com/docs/ruby/ruby-agent-security-notification · Aviso do Fabricante
• https://osv.dev/vulnerability/GHSA-q6cw-2553-7837 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-0284 · Nota de Segurança
• https://web.archive.org/web/20130117025417/https://newrelic.com/docs/ruby/ruby-agent-security-notification · Nota
• http://seclists.org/oss-sec/2013/q1/304 · Nota
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0284 · Nota