CVE-2013-1801

描述

The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for YAML type conversion, a similar vulnerability to CVE-2013-0156.

如何修補 CVE-2013-1801

要修補 CVE-2013-1801,請將受影響套件升級到下列已修補版本。

• RubyGems/httparty—升級至 0.10.0 或更新版本

CVE-2013-1801 正在被利用嗎?

低 — EPSS 為 4.4%,目前沒有觀察到大規模利用活動。

受影響套件(1)

• from 0, < 0.10.0

參考連結(7)

• ADVISORYnvd.nist.gov/vuln/detail/CVE-2013-1801
• PATCHgithub.com/jnunemaker/httparty
• WEBbugzilla.redhat.com/show_bug.cgi?id=917229
• WEBgithub.com/jnunemaker/httparty/commit/53a812426dd32108d6cba4272b493aa03bc8c031