CVE-2013-0277

ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.

Affected products

Ruby On Rails, Suse

Rubyonrails Rails

= 3.0.0, 3.0.1, 3.0.2, 3.0.3, 3.0.4, 3.0.5, 3.0.6, 3.0.7, 3.0.8, 3.0.9, 3.0.10, 3.0.11, 3.0.12, 3.0.13, 3.0.14, 3.0.16, 3.0.17, 3.0.18, 3.0.19, 3.0.20

Rubyonrails Ruby On Rails

= 3.0.4

Fix

Available

CVSS 2.0

10.0 HIGH

EPSS

7.5% (94th percentile)

NVD status

Modified

Published

2013-02-13