CVE-2013-1854
Fixed in a distro release EPSS 4%
The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.
Products: rubyonrails rails, rubyonrails ruby_on_rails, redhat enterprise_linux
Fixed upstream
| Ecosystem | Package | Fixed in |
|---|---|---|
| RubyGems | activerecord | 2.3.18 |
| RubyGems | activerecord | 3.1.12 |
| RubyGems | activerecord | 3.2.13 |
Distro releases
| Release | Package | Fixed in |
|---|---|---|
| Debian 12 | rails | 2.3.14.1 |
| Debian 13 | rails | 2.3.14.1 |
| Debian 14 | rails | 2.3.14.1 |
| Debian 6.0 | rails | 2.3.5-1.2+squeeze8 |
| Red Hat openshift 1 | ruby193-rubygem-activerecord | 1:3.2.8-6.el6 |
| Red Hat openshift 1 | ruby193-rubygem-activerecord-doc | 1:3.2.8-6.el6 |