active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before…
Priority HIGH 78CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Low
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · Partial · Partial
- Fix status
- Fixed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.
Summary
active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.
Why it matters now
EPSS 0.98979 99th percentileScored 2026-11-07
Fix Fixed actionpack (RubyGems): 2.3.15, 3.0.19, 3.1.10 +1Red Hat: 3 advisories
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
| — | actionpack (RubyGems) | before 2.3.15 | 2.3.15 | Patch available | GHSA-jmgw-6vjg-jjwg |
| — | actionpack (RubyGems) | 3.0.0 to before 3.0.19 | 3.0.19 | Patch available | GHSA-jmgw-6vjg-jjwg |
| — | actionpack (RubyGems) | 3.1.0 to before 3.1.10 | 3.1.10 | Patch available | GHSA-jmgw-6vjg-jjwg |
| — | actionpack (RubyGems) | 3.2.0 to before 3.2.11 | 3.2.11 | Patch available | GHSA-jmgw-6vjg-jjwg |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
- actionpack (RubyGems) Vendor— Affected before 2.3.15 Fixed in 2.3.15 Patch available GHSA-jmgw-6vjg-jjwg
- actionpack (RubyGems) Vendor— Affected 3.0.0 to before 3.0.19 Fixed in 3.0.19 Patch available GHSA-jmgw-6vjg-jjwg
- actionpack (RubyGems) Vendor— Affected 3.1.0 to before 3.1.10 Fixed in 3.1.10 Patch available GHSA-jmgw-6vjg-jjwg
- actionpack (RubyGems) Vendor— Affected 3.2.0 to before 3.2.11 Fixed in 3.2.11 Patch available GHSA-jmgw-6vjg-jjwg
CPE configurations NVD · 4
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* | 3.2.0 to before 3.2.11 | Vulnerable | Rails |
| cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:* | before 2.3.15; 3.0.0 to before 3.0.19; 3.1.0 to before 3.1.10 | Vulnerable | Rails |
| cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* | 6.0 | Vulnerable | Debian |
| cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* | 7.0 | Vulnerable | Debian |
- cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:* Versions 3.2.0 to before 3.2.11 Vulnerable ·Rails
- cpe:2.3:a:rubyonrails:ruby_on_rails:*:*:*:*:*:*:*:* Versions before 2.3.15; 3.0.0 to before 3.0.19; 3.1.0 to before 3.1.10 Vulnerable ·Rails
- cpe:2.3:o:debian:debian_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Debian
- cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:* Versions 7.0 Vulnerable ·Debian
Remediation
- Fix · GHSA-jmgw-6vjg-jjwg actionpack (RubyGems) Fixed in 2.3.15 Advisory →
- Fix · GHSA-jmgw-6vjg-jjwg actionpack (RubyGems) Fixed in 3.0.19 Advisory →
- Fix · GHSA-jmgw-6vjg-jjwg actionpack (RubyGems) Fixed in 3.1.10 Advisory →
- Fix · GHSA-jmgw-6vjg-jjwg actionpack (RubyGems) Fixed in 3.2.11 Advisory →
Red Hat 3 advisories
- RHSA-2013:0155 Released 2013-01-10 · Red Hat rating CriticalRuby on Rails security update
- CloudForms Cloud Engine for RHEL 6 Server rubygem-actionpack-1:3.0.10-11.el6cf, rubygem-activerecord-1:3.0.10-8.el6cf, rubygem-activesupport-1:3.0.10-5.el6cf
- CloudForms System Engine for RHEL 6 Server rubygem-actionpack-1:3.0.10-11.el6cf, rubygem-activerecord-1:3.0.10-8.el6cf, rubygem-activesupport-1:3.0.10-5.el6cf
- RHSA-2013:0154 Released 2013-01-10 · Red Hat rating CriticalRuby on Rails security update
- Red Hat Subscription Asset Manager for RHEL 6 Server rubygem-actionpack-1:3.0.10-11.el6cf, rubygem-activerecord-1:3.0.10-8.el6cf, rubygem-activesupport-1:3.0.10-5.el6cf
- RHSA-2013:0153 Released 2013-01-10 · Red Hat rating CriticalRuby on Rails security update
- Red Hat OpenShift Enterprise Infrastructure ruby193-rubygem-actionpack-1:3.2.8-2.el6, ruby193-rubygem-actionpack-doc-1:3.2.8-2.el6, ruby193-rubygem-activesupport-1:3.2.8-3.el6 +2
- Red Hat OpenShift Enterprise Node ruby193-rubygem-actionpack-1:3.2.8-2.el6, ruby193-rubygem-actionpack-doc-1:3.2.8-2.el6, ruby193-rubygem-activesupport-1:3.2.8-3.el6 +1
Vendor assessments
Red Hat
Red Hat rating: Critical. Red Hat's page for this CVE →
| Product | Status | Plan or fix |
|---|---|---|
| CloudForms Cloud Engine for RHEL 6 Server | Fixed | RHSA-2013:0155 |
| CloudForms System Engine for RHEL 6 Server | Fixed | RHSA-2013:0155 |
| Red Hat OpenShift Enterprise Infrastructure | Fixed | RHSA-2013:0153 |
| Red Hat OpenShift Enterprise Node | Fixed | RHSA-2013:0153 |
| Red Hat Subscription Asset Manager for RHEL 6 Server | Fixed | RHSA-2013:0154 |
Timeline
- 2026-10-02 Threatist record created from CVE-2013-0156
- 2026-10-03 Alias added: GHSA-jmgw-6vjg-jjwg
References
Advisory 15
- [rubyonrails-security] 20130108 Multiple vulnerabilities in parameter parsing in Action Pack (CVE-2013-0156)
- http://www.insinuator.net/2013/01/rails-yaml/
- RHSA-2013:0155
- VU#628463
- https://community.rapid7.com/community/metasploit/blog/2013/01/09/serialization-mischief-in-ruby-land-cve-2013-0156
- http://www.fujitsu.com/global/support/software/security/products-f/sw-sv-rcve-ror201301e.html
- VU#380039
- APPLE-SA-2013-03-14-1
- DSA-2604
- http://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A
- RHSA-2013:0154
- https://puppet.com/security/cve/cve-2013-0156
- http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released/
- RHSA-2013:0153
- https://nvd.nist.gov/vuln/detail/CVE-2013-0156
Other 6
- https://github.com/rails/rails
- https://web.archive.org/web/20140111025708/http://lists.apple.com/archives/security-announce/2013/Mar/msg00002.html
- https://web.archive.org/web/20160415043747/https://ics-cert.us-cert.gov/advisories/ICSA-13-036-01A
- https://web.archive.org/web/20160806154149/https://puppet.com/security/cve/cve-2013-0156
- http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-2-3-16-have-been-released
- http://www.insinuator.net/2013/01/rails-yaml
Sources
- CVE-2013-0156 · CVE Program
- CVE-2013-0156 · NVD
- FIRST EPSS
- GHSA-jmgw-6vjg-jjwg · GitHub Advisory Database · CC BY 4.0
- CVE-2013-0156 · Red Hat security data · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences