CVE-2013-1802 extlib does not properly restrict casts of string values
Remote attackers can execute arbitrary code or cause denial of service via unsafe YAML or Symbol type conversion in the Ruby extlib gem.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- Not needed
- Fix
- Available
What is CVE-2013-1802?
CVE-2013-1802 is a high-severity unsafe deserialization vulnerability in n/a, published on 9 Apr 2013. An attacker can exploit it over the internet without logging in, with no action from the victim.
Official description
The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Weakness: CWE-264
Which versions are affected by CVE-2013-1802?
2 open source packages ship an affected version, including extlib. It affects 1 product.
| Package | Affected | Fixed in |
|---|---|---|
extlib RubyGems | All versions | 0.9.16 |
extlib RubyGems | All versions | 0.9.16 |
Products include Dan Kubb Extlib.
How do I fix CVE-2013-1802?
Upgrade extlib to 0.9.16 or later.
Upgrade, and only deserialise data from trusted sources or with an allow-list of types. More about Unsafe deserialization.
Is CVE-2013-1802 being exploited?
There is no known exploitation of CVE-2013-1802 in the wild and no public exploit code.
Sources
Also known as DEBIAN-CVE-2013-1802, DLA-172-1, GHSA-9h36-4jf2-hx53.