PT-2013-1678 · Ruby+3 · Ruby+3

Shugo Maedo + 1 · Published 2013-01-08 · Updated 2023-02-13 · CVE-2012-4481

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Ruby version 1.8.7

Description The safe-level feature in Ruby allows context-dependent attackers to modify strings via the NameError#to s method when operating on Ruby objects.

Recommendations For Ruby version 1.8.7, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-264

Related Identifiers

CESA-2013_0612

CVE-2012-4481

RHSA-2013:0129

RHSA-2013:0612

RHSA-2013_0129

RHSA-2013_0612

SUSE-SU-2014_0844-1

Affected Products

Centos

Red Hat

Ruby

Suse

References · 36

• http://rhn.redhat.com/errata/RHSA-2013-0612.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0129.html · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-1821 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2012-4481 · Security Note
• http://mandriva.com/security/advisories?name=MDVSA-2013:124 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2012-4481 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4164 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-4073 · Security Note
• https://linux.oracle.com/errata/ELSA-2013-0612.html · Vendor Advisory
• https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/dos/http/rails_json_float_dos.rb · Note
• https://lists.centos.org/pipermail/centos-announce/2013-March/031671.html · Note
• http://lists.suse.com/mailman/listinfo/sle-security-updates · Note
• http://support.novell.com/security/cve/CVE-2013-1821.html · Note
• https://bugzilla.novell.com/783525 · Note
• http://support.novell.com/security/cve/CVE-2012-4481.html · Note