Skip to content
OpenAdvisories
Unscored RHSA-2013:0153 1 CVE

Red Hat Security Advisory: Ruby on Rails security update

Published Sep 15, 2024 · Updated Mar 27, 2026

Ecosystem: Red Hat

Fixed packages 5

ReleasePackageFixed in
Red Hat · OpenShift 1 openshift:1::el6 ruby193-rubygem-actionpack 1:3.2.8-2.el6
Red Hat · OpenShift 1 openshift:1::el6 ruby193-rubygem-actionpack-doc 1:3.2.8-2.el6
Red Hat · OpenShift 1 openshift:1::el6 ruby193-rubygem-activesupport 1:3.2.8-3.el6
Red Hat · OpenShift 1 openshift:1::el6 rubygem-actionpack 1:3.0.13-2.1.el6op
Red Hat · OpenShift 1 openshift:1::el6 rubygem-activesupport 1:3.0.13-2.el6op

Vulnerabilities 1

  • High —
    CVE-2013-0156 Public exploit EPSS 99%

    actionpack Improper Input Validation vulnerability

    active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks …

    rails actionpack Debian RubyGems

References

  • article
    https://access.redhat.com/security/updates/classification/#critical
  • article
    https://access.redhat.com/knowledge/solutions/290903
  • report
    https://bugzilla.redhat.com/show_bug.cgi?id=892870
  • advisory
    https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0153.json
  • report
    https://access.redhat.com/security/cve/CVE-2013-0156
  • advisory
    https://www.cve.org/CVERecord?id=CVE-2013-0156
  • advisory
    https://nvd.nist.gov/vuln/detail/CVE-2013-0156