CVE-2013-0285 nori contains Improper Input Validation
Remote attackers can execute arbitrary code or cause denial of service via unsafe deserialization in the nori Ruby gem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-0285?
CVE-2013-0285 is a high-severity unsafe deserialization vulnerability in n/a, published on 9 Apr 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Weakness: CWE-20
Which versions are affected by CVE-2013-0285?
6 open source packages ship an affected version, including nori. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
nori RubyGems | From 1.0.0 | 1.0.3 |
nori RubyGems | From 1.0.0 | 1.0.3 |
nori RubyGems | From 1.1.0 | 1.1.4 |
nori RubyGems | From 1.1.0 | 1.1.4 |
nori RubyGems | From 2.0.0 | 2.0.2 |
nori RubyGems | From 2.0.0 | 2.0.2 |
Products include Nori Gem Project Nori Gem.
How do I fix CVE-2013-0285?
Upgrade nori to a fixed version for your release line: 1.0.3, 1.1.4 or 2.0.2.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2013-0285 being exploited?
There is no known exploitation of CVE-2013-0285 in the wild and no public exploit code.
Sources
Also known as GHSA-4936-rj25-6wm6.