Read the docs
TI-2013-01637 Aliases CVE-2013-1854GHSA-3crr-9vmg-864v

The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12…

Priority LOW 29CWE-20Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
— Not recorded in CVSS 2.0
Attack complexity
Low
Impact type
—
Confidentiality · integrity · availability
None · None · Partial
Fix status
Partial Red Hat: 3 fixed, 2 without a fix

Attack profile from CVSS 2.0 · NVD. Fix status from CNA, GitHub and Red Hat.

Summary

The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.

Why it matters now

EPSS 0.03504 89th percentileScored 2026-11-07
Fix Partial activerecord (RubyGems): 2.3.18, 3.1.12, 3.2.13Red Hat: 2 advisoriesRed Hat: 3 fixed, 2 without a fix

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
——all versions—No fix listedCNA
—activerecord (RubyGems)2.3.0 to before 2.3.182.3.18Patch availableGHSA-3crr-9vmg-864v
—activerecord (RubyGems)3.1.0 to before 3.1.123.1.12Patch availableGHSA-3crr-9vmg-864v
—activerecord (RubyGems)3.2.0 to before 3.2.133.2.13Patch availableGHSA-3crr-9vmg-864v
  • — Vendor— Affected all versions Fixed in — No fix listed CNA
  • activerecord (RubyGems) Vendor— Affected 2.3.0 to before 2.3.18 Fixed in 2.3.18 Patch available GHSA-3crr-9vmg-864v
  • activerecord (RubyGems) Vendor— Affected 3.1.0 to before 3.1.12 Fixed in 3.1.12 Patch available GHSA-3crr-9vmg-864v
  • activerecord (RubyGems) Vendor— Affected 3.2.0 to before 3.2.13 Fixed in 3.2.13 Patch available GHSA-3crr-9vmg-864v

CPE configurations NVD · 62

CPEVersionsRoleVendor
cpe:2.3:a:rubyonrails:rails:2.3.0:*:*:*:*:*:*:*2.3.0VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.3.1:*:*:*:*:*:*:*2.3.1VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.3.2:*:*:*:*:*:*:*2.3.2VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.3.3:*:*:*:*:*:*:*2.3.3VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.3.4:*:*:*:*:*:*:*2.3.4VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.3.9:*:*:*:*:*:*:*2.3.9VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.3.10:*:*:*:*:*:*:*2.3.10VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.3.11:*:*:*:*:*:*:*2.3.11VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.3.12:*:*:*:*:*:*:*2.3.12VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.3.13:*:*:*:*:*:*:*2.3.13VulnerableRails
  • cpe:2.3:a:rubyonrails:rails:2.3.0:*:*:*:*:*:*:* Versions 2.3.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.3.1:*:*:*:*:*:*:* Versions 2.3.1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.3.2:*:*:*:*:*:*:* Versions 2.3.2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.3.3:*:*:*:*:*:*:* Versions 2.3.3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.3.4:*:*:*:*:*:*:* Versions 2.3.4 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.3.9:*:*:*:*:*:*:* Versions 2.3.9 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.3.10:*:*:*:*:*:*:* Versions 2.3.10 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.3.11:*:*:*:*:*:*:* Versions 2.3.11 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.3.12:*:*:*:*:*:*:* Versions 2.3.12 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.3.13:*:*:*:*:*:*:* Versions 2.3.13 Vulnerable ·Rails
Show 52 more CPE
CPEVersionsRoleVendor
cpe:2.3:a:rubyonrails:rails:2.3.14:*:*:*:*:*:*:*2.3.14VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.3.15:*:*:*:*:*:*:*2.3.15VulnerableRails
cpe:2.3:a:rubyonrails:rails:2.3.16:*:*:*:*:*:*:*2.3.16VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:*3.1.0VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:*3.1.0 beta1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:*3.1.0 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:*3.1.0 rc2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:*3.1.0 rc3VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:*3.1.0 rc4VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:*3.1.0 rc5VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:*3.1.0 rc6VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:*3.1.0 rc7VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:*3.1.0 rc8VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:*3.1.1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:*3.1.1 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:*3.1.1 rc2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:*3.1.1 rc3VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:*3.1.2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:*3.1.2 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:*3.1.2 rc2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:*3.1.3VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:*3.1.4VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:*3.1.4 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:*3.1.5VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:*3.1.5 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:*3.1.6VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.7:*:*:*:*:*:*:*3.1.7VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.8:*:*:*:*:*:*:*3.1.8VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.9:*:*:*:*:*:*:*3.1.9VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.1.10:*:*:*:*:*:*:*3.1.10VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:*3.2.0VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:*3.2.0 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:*3.2.0 rc2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:*3.2.1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:*3.2.2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:*3.2.2 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:*3.2.3VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:*3.2.3 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:*3.2.3 rc2VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:*3.2.4VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:*3.2.4 rc1VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:*3.2.5VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:*3.2.6VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:*3.2.7VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.8:*:*:*:*:*:*:*3.2.8VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.9:*:*:*:*:*:*:*3.2.9VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.10:*:*:*:*:*:*:*3.2.10VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.11:*:*:*:*:*:*:*3.2.11VulnerableRails
cpe:2.3:a:rubyonrails:rails:3.2.12:*:*:*:*:*:*:*3.2.12VulnerableRails
cpe:2.3:a:rubyonrails:ruby_on_rails:2.3.17:*:*:*:*:*:*:*2.3.17VulnerableRails
cpe:2.3:a:rubyonrails:ruby_on_rails:3.1.11:*:*:*:*:*:*:*3.1.11VulnerableRails
cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:*6.0VulnerableRed Hat
  • cpe:2.3:a:rubyonrails:rails:2.3.14:*:*:*:*:*:*:* Versions 2.3.14 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.3.15:*:*:*:*:*:*:* Versions 2.3.15 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:2.3.16:*:*:*:*:*:*:* Versions 2.3.16 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.0:*:*:*:*:*:*:* Versions 3.1.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.0:beta1:*:*:*:*:*:* Versions 3.1.0 beta1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.0:rc1:*:*:*:*:*:* Versions 3.1.0 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.0:rc2:*:*:*:*:*:* Versions 3.1.0 rc2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.0:rc3:*:*:*:*:*:* Versions 3.1.0 rc3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.0:rc4:*:*:*:*:*:* Versions 3.1.0 rc4 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.0:rc5:*:*:*:*:*:* Versions 3.1.0 rc5 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.0:rc6:*:*:*:*:*:* Versions 3.1.0 rc6 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.0:rc7:*:*:*:*:*:* Versions 3.1.0 rc7 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.0:rc8:*:*:*:*:*:* Versions 3.1.0 rc8 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.1:*:*:*:*:*:*:* Versions 3.1.1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.1:rc1:*:*:*:*:*:* Versions 3.1.1 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.1:rc2:*:*:*:*:*:* Versions 3.1.1 rc2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.1:rc3:*:*:*:*:*:* Versions 3.1.1 rc3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.2:*:*:*:*:*:*:* Versions 3.1.2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.2:rc1:*:*:*:*:*:* Versions 3.1.2 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.2:rc2:*:*:*:*:*:* Versions 3.1.2 rc2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.3:*:*:*:*:*:*:* Versions 3.1.3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.4:*:*:*:*:*:*:* Versions 3.1.4 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.4:rc1:*:*:*:*:*:* Versions 3.1.4 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.5:*:*:*:*:*:*:* Versions 3.1.5 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.5:rc1:*:*:*:*:*:* Versions 3.1.5 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.6:*:*:*:*:*:*:* Versions 3.1.6 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.7:*:*:*:*:*:*:* Versions 3.1.7 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.8:*:*:*:*:*:*:* Versions 3.1.8 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.9:*:*:*:*:*:*:* Versions 3.1.9 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.1.10:*:*:*:*:*:*:* Versions 3.1.10 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.0:*:*:*:*:*:*:* Versions 3.2.0 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.0:rc1:*:*:*:*:*:* Versions 3.2.0 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.0:rc2:*:*:*:*:*:* Versions 3.2.0 rc2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.1:*:*:*:*:*:*:* Versions 3.2.1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.2:*:*:*:*:*:*:* Versions 3.2.2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.2:rc1:*:*:*:*:*:* Versions 3.2.2 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.3:*:*:*:*:*:*:* Versions 3.2.3 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.3:rc1:*:*:*:*:*:* Versions 3.2.3 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.3:rc2:*:*:*:*:*:* Versions 3.2.3 rc2 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.4:*:*:*:*:*:*:* Versions 3.2.4 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.4:rc1:*:*:*:*:*:* Versions 3.2.4 rc1 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.5:*:*:*:*:*:*:* Versions 3.2.5 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.6:*:*:*:*:*:*:* Versions 3.2.6 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.7:*:*:*:*:*:*:* Versions 3.2.7 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.8:*:*:*:*:*:*:* Versions 3.2.8 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.9:*:*:*:*:*:*:* Versions 3.2.9 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.10:*:*:*:*:*:*:* Versions 3.2.10 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.11:*:*:*:*:*:*:* Versions 3.2.11 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:rails:3.2.12:*:*:*:*:*:*:* Versions 3.2.12 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:ruby_on_rails:2.3.17:*:*:*:*:*:*:* Versions 2.3.17 Vulnerable ·Rails
  • cpe:2.3:a:rubyonrails:ruby_on_rails:3.1.11:*:*:*:*:*:*:* Versions 3.1.11 Vulnerable ·Rails
  • cpe:2.3:o:redhat:enterprise_linux:6.0:*:*:*:*:*:*:* Versions 6.0 Vulnerable ·Red Hat

Remediation

  • Fix · GHSA-3crr-9vmg-864v activerecord (RubyGems) Fixed in 2.3.18 Advisory →
  • Fix · GHSA-3crr-9vmg-864v activerecord (RubyGems) Fixed in 3.1.12 Advisory →
  • Fix · GHSA-3crr-9vmg-864v activerecord (RubyGems) Fixed in 3.2.13 Advisory →

Red Hat 2 advisories

  • RHSA-2014:1863 Released 2014-11-17 · Red Hat rating Important
    Subscription Asset Manager 1.4 security update
    • Red Hat Subscription Asset Manager for RHEL 6 Server katello-1.4.3.28-1.el6sam_splice, katello-common-1.4.3.28-1.el6sam_splice, katello-glue-candlepin-1.4.3.28-1.el6sam_splice +14
  • RHSA-2013:0699 Released 2013-04-02 · Red Hat rating Moderate
    ruby193-rubygem-activerecord security update
    • Red Hat OpenShift Enterprise Infrastructure ruby193-rubygem-activerecord-1:3.2.8-6.el6, ruby193-rubygem-activerecord-doc-1:3.2.8-6.el6
    • Red Hat OpenShift Enterprise Node ruby193-rubygem-activerecord-1:3.2.8-6.el6, ruby193-rubygem-activerecord-doc-1:3.2.8-6.el6

Vendor assessments

Red Hat

Red Hat rating: Moderate. Red Hat's page for this CVE →

ProductStatusPlan or fix
Red Hat Satellite 6AffectedNo fix yet
Red Hat Subscription Asset ManagerAffectedNo fix planned: Will not fix
Red Hat OpenShift Enterprise InfrastructureFixed RHSA-2013:0699
Red Hat OpenShift Enterprise NodeFixed RHSA-2013:0699
Red Hat Subscription Asset Manager for RHEL 6 ServerFixed RHSA-2014:1863
Not affected: 1 product
  • OpenShift Enterprise 1

Timeline

  1. 2026-10-02 Threatist record created from CVE-2013-1854
  2. 2026-10-03 Alias added: GHSA-3crr-9vmg-864v

References

Advisory 10

Other 9

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences