PT-2013-2216 · New Relic · Ruby Agent

Published 2013-04-09 · Updated 2017-10-24 · CVE-2013-0284

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Ruby agent versions 3.2.0 through 3.5.2 Ruby agent versions 3.2.0 through 3.5.3.23

Description The issue allows remote attackers to obtain sensitive information, including database credentials and SQL statements, by sniffing the network and deserializing the data. This occurs because the Ruby agent serializes sensitive data when communicating with New Relic servers.

Recommendations For Ruby agent versions 3.2.0 through 3.5.2, update to a version outside of this range to mitigate the risk. For Ruby agent versions 3.2.0 through 3.5.3.23, update to a version outside of this range to mitigate the risk.

Exploit

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2013-0284

GHSA-Q6CW-2553-7837

Affected Products

Ruby Agent

References · 8

• 🔥 https://github.com/rubysec/ruby-advisory-db/blob/master/gems/newrelic_rpm/CVE-2013-0284.yml · Exploit
• https://newrelic.com/docs/ruby/ruby-agent-security-notification · Vendor Advisory
• https://osv.dev/vulnerability/GHSA-q6cw-2553-7837 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2013-0284 · Security Note
• https://github.com/newrelic/newrelic-ruby-agent · Note
• https://web.archive.org/web/20130117025417/https://newrelic.com/docs/ruby/ruby-agent-security-notification · Note
• http://seclists.org/oss-sec/2013/q1/304 · Note
• https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0284 · Note