PT-2013-2202 · Ruby+1 · Ruby On Rails+3

Ben Murphy + 1 · Published 2013-02-12 · Updated 2022-04-18 · CVE-2013-0269

Positive Technologies (AI Summary)

CVSS v2.0

7.5

High

Base vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions JSON gem versions prior to 1.5.5 JSON gem versions 1.6.x prior to 1.6.8 JSON gem versions 1.7.x prior to 1.7.7

Description The issue allows remote attackers to cause a denial of service or bypass the mass assignment protection mechanism via a crafted JSON document. This can trigger the creation of arbitrary Ruby symbols or certain internal objects, potentially leading to attacks such as SQL injection against Ruby on Rails.

Recommendations For JSON gem versions prior to 1.5.5, update to version 1.5.5 or later. For JSON gem versions 1.6.x prior to 1.6.8, update to version 1.6.8 or later. For JSON gem versions 1.7.x prior to 1.7.7, update to version 1.7.7 or later.

Exploit

Fix

DoS

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2013-0269

DLA-215-1

DLA-2192-1

DLA-263-1

GHSA-X457-CW4H-HQ5F

RHSA-2013:0701

SUSE-SU-2013_0609-2

USN-1733-1

Affected Products

Json Gem

Ruby

Ruby On Rails

Suse

References · 43

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json/CVE-2013-0269.yml · Exploit
• https://cve.org/CVERecord?id=CVE-2013-0269 · Security Note
• http://slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.426862 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1028.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html · Vendor Advisory
• https://ubuntu.com/security/CVE-2013-0269 · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0686.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-0701.html · Vendor Advisory
• http://lists.opensuse.org/opensuse-updates/2013-04/msg00034.html · Vendor Advisory
• http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released · Vendor Advisory
• http://rhn.redhat.com/errata/RHSA-2013-1147.html · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-x457-cw4h-hq5f · Vendor Advisory
• http://ubuntu.com/usn/USN-1733-1 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-0269 · Security Note