CVE-2013-1800 crack does not properly restrict casts of string values
Remote attackers can execute arbitrary code or cause denial of service via unsafe YAML or Symbol type conversion in the Ruby crack gem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-1800?
CVE-2013-1800 is a high-severity unsafe deserialization vulnerability in n/a, published on 9 Apr 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Weakness: CWE-264
Which versions are affected by CVE-2013-1800?
2 open source packages ship an affected version, including crack. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
crack RubyGems | All versions | 0.3.2 |
crack RubyGems | All versions | 0.3.2 |
Products include John Nunemaker Crack.
How do I fix CVE-2013-1800?
Upgrade crack to 0.3.2 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2013-1800 being exploited?
There is no known exploitation of CVE-2013-1800 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2013-1800, GHSA-m7fq-cf8q-35q7.