CVE-2013-0333

lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before 2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML data for processing by a YAML parser, which allows remote attackers to execute arbitrary code, conduct SQL injection attacks, or bypass authentication via crafted data that triggers unsafe decoding, a different vulnerability than CVE-2013-0156.

Affected Software

Name	Vendor	Start Version	End Version
Rails	Rubyonrails	2.3.0 (including)	2.3.0 (including)
Rails	Rubyonrails	2.3.1 (including)	2.3.1 (including)
Rails	Rubyonrails	2.3.2 (including)	2.3.2 (including)
Rails	Rubyonrails	2.3.3 (including)	2.3.3 (including)
Rails	Rubyonrails	2.3.4 (including)	2.3.4 (including)
Rails	Rubyonrails	2.3.9 (including)	2.3.9 (including)
Rails	Rubyonrails	2.3.10 (including)	2.3.10 (including)
Rails	Rubyonrails	2.3.11 (including)	2.3.11 (including)
Rails	Rubyonrails	2.3.12 (including)	2.3.12 (including)
Rails	Rubyonrails	2.3.13 (including)	2.3.13 (including)
Rails	Rubyonrails	2.3.14 (including)	2.3.14 (including)
Rails	Rubyonrails	2.3.15 (including)	2.3.15 (including)
CloudForms for RHEL 6	RedHat	katello-0:1.1.12.1-1.el6cf	*
CloudForms for RHEL 6	RedHat	rubygem-activesupport-1:3.0.10-9.el6cf	*
Red Hat Subscription Asset Manager 1.1	RedHat	rubygem-activesupport-1:3.0.10-7.el6cf	*
RHEL 6 Version of OpenShift Enterprise	RedHat	rubygem-activesupport-1:3.0.13-4.el6op	*
Rails	Ubuntu	hardy	*
Rails	Ubuntu	lucid	*
Ruby-activesupport-2.3	Ubuntu	oneiric	*
Ruby-activesupport-2.3	Ubuntu	precise	*
Ruby-activesupport-2.3	Ubuntu	quantal	*
Ruby-activesupport-2.3	Ubuntu	upstream	*

NVD	https://nvd.nist.gov/vuln/detail/CVE-2013-0333
CWE	https://cwe.mitre.org/data/definitions/NVD-Other.html

Affected Software

References