Skip to content
OpenAdvisories
Unscored DSA-2620-1 2 CVEs

rails - several

Published Feb 12, 2013 · Updated Mar 9, 2026

Ecosystem: Debian

Fixed packages 1

ReleasePackageFixed in
Debian · 6.0 rails 2.3.5-1.2+squeeze7

Vulnerabilities 2

  • Medium —
    CVE-2013-0276

    ActiveRecord vulnerable to modification of protected model attributes

    ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.

    rails activerecord Debian RubyGems
  • Critical —
    CVE-2013-0277

    Active Record contains deserialization of arbitrary YAML

    ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.

    rails activerecord Debian RubyGems