actionpack Improper Input Validation vulnerability
High severity
GitHub Reviewed
Published
Oct 24, 2017
to the GitHub Advisory Database
•
Updated Feb 15, 2023
Package
Affected versions
< 2.3.15
>= 3.0.0, < 3.0.19
>= 3.1.0, < 3.1.10
>= 3.2.0, < 3.2.11
Patched versions
2.3.15
3.0.19
3.1.10
3.2.11
Description
Published by the National Vulnerability Database
Jan 13, 2013
Published to the GitHub Advisory Database
Oct 24, 2017
Reviewed
Jun 16, 2020
Last updated
Feb 15, 2023
active_support/core_ext/hash/conversions.rbin Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion.References