PT-2013-2217 · Ruby · Nori

Kurt Seifried · Publicado 2013-04-09 · Atualizado 2017-10-24 · CVE-2013-0285

Positive Technologies (AI Summary)

CVSS v2.0

7.5

Alta

Vetor base

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions nori gem versions 1.0.x through 1.0.2 nori gem versions 1.1.x through 1.1.3 nori gem versions 2.0.x through 2.0.1

Description The issue allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service involving nested XML entity references. This is achieved by leveraging Action Pack support for YAML type conversion or Symbol type conversion.

Recommendations For nori gem version 1.0.x, update to version 1.0.3 or later. For nori gem version 1.1.x, update to version 1.1.4 or later. For nori gem version 2.0.x, update to version 2.0.2 or later.

Exploit

Correção

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

CVE-2013-0285

GHSA-4936-RJ25-6WM6

Produtos afetados

Nori

Referências · 17

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/nori/CVE-2013-0285.yml · Exploit
• https://github.com/savonrb/nori/commit/818f5263b1d597b603d46cbe1702cd2717259e32 · Nota
• https://github.com/savonrb/nori/commit/c5e07f5c32e615f0a4a7ee2782d37f7a33261be4 · Nota
• https://github.com/savonrb/nori · Nota
• https://github.com/savonrb/nori/commit/2ca6f8603e406f884a8fcea6bc26f8f6bf168f40 · Nota
• https://github.com/savonrb/nori/commit/d9b68667249b98776fb23ba9e9c548dc4b524709 · Nota
• https://github.com/savonrb/nori/commit/c3fdce7a2d2670b44f1cda35da0ae73cc1372084 · Nota
• https://github.com/savonrb/nori/commit/4bcf59abdcec6bcd1153241b122eda61a494e4fb · Nota
• https://ubuntu.com/security/CVE-2013-0285 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2013-0285 · Nota de Segurança
• https://osv.dev/vulnerability/GHSA-4936-rj25-6wm6 · Aviso do Fabricante
• https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately · Nota
• https://web.archive.org/web/20130203232028/https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately · Nota
• https://osv.dev/vulnerability/UBUNTU-CVE-2013-0285 · Aviso do Fabricante
• http://seclists.org/oss-sec/2013/q1/304 · Nota