CVE Feed

    Dashboard / CVE / CVE-2013-1800

    CVE-2013-1800

    The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.

    Published:Jan 14, 2013
    Last Modified:Apr 11, 2025
    EPS:Apr 9, 2013
    EPSS Score:0.01653
    CVSS Score:7.5

    Affected Products

    Vendor
    John Nunemaker
    Product
    Crack

    Exploits

    https://github.com/jnunemaker/crack/commit/e3da1212a1f84a898ee3601336d1dbbf118fb5f6https://github.com/jnunemaker/crack/commit/e3da1212a1f84a898ee3601336d1dbbf118fb5f6

    Common Attack Pattern Enumeration and Classification (CAPEC)

    CAPEC-586 Object Injection

    References

    http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00003.html
    http://secunia.com/advisories/52897
    https://bugzilla.novell.com/show_bug.cgi?id=804721
    https://bugzilla.redhat.com/show_bug.cgi?id=917236
    https://github.com/jnunemaker/crack/commit/e3da1212a1f84a898ee3601336d1dbbf118fb5f6
    https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately
    http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00003.html
    http://secunia.com/advisories/52897
    https://bugzilla.novell.com/show_bug.cgi?id=804721
    https://bugzilla.redhat.com/show_bug.cgi?id=917236
    https://github.com/jnunemaker/crack/commit/e3da1212a1f84a898ee3601336d1dbbf118fb5f6
    https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately

    Common Vulnerability Scoring System

    Attack Vector
    Network
    Adjacent
    Local
    Physical
    Privileges Required
    None
    Low
    High
    User Interaction
    None
    Required
    Scope
    Unchanged
    Changed
    Confidentiality
    None
    Low
    High
    Integrity
    None
    Low
    High
    Availability
    None
    Low
    High