NVD

Id
37996  
Name
CVE-2013-1854  
Description
The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.  
Reject
 
CVSS Version
2  
CVSS Score
5  
Severity
Medium  
CVSS Base Score
5  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
10  
CVSS Vector
(AV:N/AC:L/Au:N/C:N/I:N/A:P)  
Pub Date
2017-01-18  
Published
2013-03-19  
Modified Date
2015-09-28  
Seq
2013-1854  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
194056 37996 CVE-2013-1854 APPLE-SA-2013-06-04-1  View
194057 37996 CVE-2013-1854 APPLE-SA-2013-10-22-5  View
194058 37996 CVE-2013-1854 openSUSE-SU-2013:0659  View
194059 37996 CVE-2013-1854 openSUSE-SU-2013:0660  View
194060 37996 CVE-2013-1854 openSUSE-SU-2013:0664  View
194061 37996 CVE-2013-1854 openSUSE-SU-2013:0667  View
194062 37996 CVE-2013-1854 openSUSE-SU-2013:0668  View
194063 37996 CVE-2013-1854 RHSA-2013:0699  View
194064 37996 CVE-2013-1854 RHSA-2014:1863  View
194065 37996 CVE-2013-1854 http://support.apple.com/kb/HT5784  View
194066 37996 CVE-2013-1854 http://weblog.rubyonrails.org/2013/3/18/SEC-ANN-Rails-3-2-13-3-1-12-and-2-3-18-have-been-released/  View
194067 37996 CVE-2013-1854 [ruby-security-ann] 20130318 [CVE-2013-1854] Symbol DoS vulnerability in Active Record  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
20352 JVNDB-2013-001927 Ruby on Rails の Active Record コンポーネントにおけるサービス運用妨害 (DoS) の脆弱性 Ruby on Rails の Active Record コンポーネントは、シンボルからハッシュキーへの変換によって発生する特定のクエリ処理により、サービス運用妨害 (DoS) 状態にされる脆弱性が存在します。 CVE-2013-1854 61796 CVE-2013-1854 37996 5 http://jvndb.jvn.jp/ja/contents/2013/JVNDB-2013-001927.html 2013-03-18 2014-12-18 View