Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2013-0269 (GCVE-0-2013-0269)
Vulnerability from cvelistv5
Published
2013-02-13 01:00
Modified
2024-08-06 14:18
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- n/a
Summary
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
References
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-06T14:18:09.563Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "RHSA-2013:0701",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0701.html"
},
{
"name": "openSUSE-SU-2013:0603",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00034.html"
},
{
"name": "APPLE-SA-2013-10-22-5",
"tags": [
"vendor-advisory",
"x_refsource_APPLE",
"x_transferred"
],
"url": "http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html"
},
{
"name": "SSA:2013-075-01",
"tags": [
"vendor-advisory",
"x_refsource_SLACKWARE",
"x_transferred"
],
"url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2013\u0026m=slackware-security.426862"
},
{
"name": "52774",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/52774"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed"
},
{
"name": "[rubyonrails-security] 20130211 Denial of Service and Unsafe Object Creation Vulnerability in JSON [CVE-2013-0269]",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "https://groups.google.com/group/rubyonrails-security/msg/d8e0db6e08c81428?dmode=source\u0026output=gplain"
},
{
"name": "90074",
"tags": [
"vdb-entry",
"x_refsource_OSVDB",
"x_transferred"
],
"url": "http://www.osvdb.org/90074"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "https://puppet.com/security/cve/cve-2013-0269"
},
{
"name": "52902",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/52902"
},
{
"name": "RHSA-2013:0686",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0686.html"
},
{
"name": "57899",
"tags": [
"vdb-entry",
"x_refsource_BID",
"x_transferred"
],
"url": "http://www.securityfocus.com/bid/57899"
},
{
"name": "[oss-security] 20130211 Denial of Service and Unsafe Object Creation Vulnerability in JSON [CVE-2013-0269]",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/02/11/7"
},
{
"tags": [
"x_refsource_MISC",
"x_transferred"
],
"url": "http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection"
},
{
"name": "[oss-security] 20130211 Patch update for [CVE-2013-0269]",
"tags": [
"mailing-list",
"x_refsource_MLIST",
"x_transferred"
],
"url": "http://www.openwall.com/lists/oss-security/2013/02/11/8"
},
{
"name": "USN-1733-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU",
"x_transferred"
],
"url": "http://www.ubuntu.com/usn/USN-1733-1"
},
{
"name": "SUSE-SU-2013:0609",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html"
},
{
"name": "RHSA-2013:1028",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1028.html"
},
{
"name": "json-ruby-security-bypass(82010)",
"tags": [
"vdb-entry",
"x_refsource_XF",
"x_transferred"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82010"
},
{
"name": "RHSA-2013:1147",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT",
"x_transferred"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1147.html"
},
{
"tags": [
"x_refsource_CONFIRM",
"x_transferred"
],
"url": "http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/"
},
{
"name": "52075",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA",
"x_transferred"
],
"url": "http://secunia.com/advisories/52075"
},
{
"name": "SUSE-SU-2013:0647",
"tags": [
"vendor-advisory",
"x_refsource_SUSE",
"x_transferred"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"product": "n/a",
"vendor": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
],
"datePublic": "2013-02-11T00:00:00",
"descriptions": [
{
"lang": "en",
"value": "The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka \"Unsafe Object Creation Vulnerability.\""
}
],
"problemTypes": [
{
"descriptions": [
{
"description": "n/a",
"lang": "en",
"type": "text"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2017-12-08T10:57:01",
"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"shortName": "redhat"
},
"references": [
{
"name": "RHSA-2013:0701",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0701.html"
},
{
"name": "openSUSE-SU-2013:0603",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00034.html"
},
{
"name": "APPLE-SA-2013-10-22-5",
"tags": [
"vendor-advisory",
"x_refsource_APPLE"
],
"url": "http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html"
},
{
"name": "SSA:2013-075-01",
"tags": [
"vendor-advisory",
"x_refsource_SLACKWARE"
],
"url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2013\u0026m=slackware-security.426862"
},
{
"name": "52774",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/52774"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed"
},
{
"name": "[rubyonrails-security] 20130211 Denial of Service and Unsafe Object Creation Vulnerability in JSON [CVE-2013-0269]",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "https://groups.google.com/group/rubyonrails-security/msg/d8e0db6e08c81428?dmode=source\u0026output=gplain"
},
{
"name": "90074",
"tags": [
"vdb-entry",
"x_refsource_OSVDB"
],
"url": "http://www.osvdb.org/90074"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "https://puppet.com/security/cve/cve-2013-0269"
},
{
"name": "52902",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/52902"
},
{
"name": "RHSA-2013:0686",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0686.html"
},
{
"name": "57899",
"tags": [
"vdb-entry",
"x_refsource_BID"
],
"url": "http://www.securityfocus.com/bid/57899"
},
{
"name": "[oss-security] 20130211 Denial of Service and Unsafe Object Creation Vulnerability in JSON [CVE-2013-0269]",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/02/11/7"
},
{
"tags": [
"x_refsource_MISC"
],
"url": "http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection"
},
{
"name": "[oss-security] 20130211 Patch update for [CVE-2013-0269]",
"tags": [
"mailing-list",
"x_refsource_MLIST"
],
"url": "http://www.openwall.com/lists/oss-security/2013/02/11/8"
},
{
"name": "USN-1733-1",
"tags": [
"vendor-advisory",
"x_refsource_UBUNTU"
],
"url": "http://www.ubuntu.com/usn/USN-1733-1"
},
{
"name": "SUSE-SU-2013:0609",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html"
},
{
"name": "RHSA-2013:1028",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1028.html"
},
{
"name": "json-ruby-security-bypass(82010)",
"tags": [
"vdb-entry",
"x_refsource_XF"
],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82010"
},
{
"name": "RHSA-2013:1147",
"tags": [
"vendor-advisory",
"x_refsource_REDHAT"
],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1147.html"
},
{
"tags": [
"x_refsource_CONFIRM"
],
"url": "http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/"
},
{
"name": "52075",
"tags": [
"third-party-advisory",
"x_refsource_SECUNIA"
],
"url": "http://secunia.com/advisories/52075"
},
{
"name": "SUSE-SU-2013:0647",
"tags": [
"vendor-advisory",
"x_refsource_SUSE"
],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html"
}
]
}
},
"cveMetadata": {
"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749",
"assignerShortName": "redhat",
"cveId": "CVE-2013-0269",
"datePublished": "2013-02-13T01:00:00",
"dateReserved": "2012-12-06T00:00:00",
"dateUpdated": "2024-08-06T14:18:09.563Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2013-0269\",\"sourceIdentifier\":\"secalert@redhat.com\",\"published\":\"2013-02-13T01:55:05.107\",\"lastModified\":\"2025-04-11T00:51:21.963\",\"vulnStatus\":\"Deferred\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka \\\"Unsafe Object Creation Vulnerability.\\\"\"},{\"lang\":\"es\",\"value\":\"El JSON gem v1.7.x anteriores a 1.7.7, v1.6.x anteriores a v1.6.8, y v1.5.x anteriores a v1.5.5 permite a atacantes remotos provocar una denegaci\u00f3n de servicio (consumo de recursos) o evitar el mecanismo de protecci\u00f3n de asignaci\u00f3n masiva a trav\u00e9s de un documento JSON manipulado que lanza la creaci\u00f3n de s\u00edmbolos arbitrarios en Ruby o ciertos objetos internos, como se demostr\u00f3 como se ha demostrado mediante la realizaci\u00f3n de un ataque de inyecci\u00f3n SQL en Ruby on Rails, tambi\u00e9n conocido como \\\"Vulnerabilidad de creaci\u00f3n de objetos no seguro\\\".\"}],\"metrics\":{\"cvssMetricV2\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"2.0\",\"vectorString\":\"AV:N/AC:L/Au:N/C:P/I:P/A:P\",\"baseScore\":7.5,\"accessVector\":\"NETWORK\",\"accessComplexity\":\"LOW\",\"authentication\":\"NONE\",\"confidentialityImpact\":\"PARTIAL\",\"integrityImpact\":\"PARTIAL\",\"availabilityImpact\":\"PARTIAL\"},\"baseSeverity\":\"HIGH\",\"exploitabilityScore\":10.0,\"impactScore\":6.4,\"acInsufInfo\":false,\"obtainAllPrivilege\":false,\"obtainUserPrivilege\":false,\"obtainOtherPrivilege\":false,\"userInteractionRequired\":false}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-20\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubygems:json_gem:1.5.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"1A6068E1-1BB1-4FBE-A4DA-C303B2E65E1D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubygems:json_gem:1.5.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6572D2E9-1D09-4245-BEB3-A3BCF3C4455C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubygems:json_gem:1.5.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"56DF3383-1E82-4FA0-B92F-1C96DAB5C12C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubygems:json_gem:1.5.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"3EFA5025-DFED-4540-B773-5777ACE013C3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubygems:json_gem:1.5.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9EB792B2-FF20-4C39-B2DD-171E6B8317F4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubygems:json_gem:1.6.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"A65B497E-F658-4E6D-810C-97C56FF0AAF1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubygems:json_gem:1.6.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"6D8A1269-441E-48E1-A0F2-949C49FFAEC3\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubygems:json_gem:1.6.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"DC0420E6-84C8-4210-AB79-875564741330\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubygems:json_gem:1.6.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"73665EA1-E35D-469D-8898-163FB8DF34AB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubygems:json_gem:1.6.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0AB8EC9A-8CC4-4A71-A026-6FB98DA1A35F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubygems:json_gem:1.6.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"530A8D3B-AFF0-4316-A4B5-B222A73CD9E8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubygems:json_gem:1.6.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"89AE459A-4169-47F4-9B40-344002352C61\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubygems:json_gem:1.6.7:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"9FC8E7A7-7A94-497E-B8C2-B4A0CBD4BD7B\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubygems:json_gem:1.7.0:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"D696FD5D-3DAD-4AAB-A3C7-1865739922D8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubygems:json_gem:1.7.1:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"88A3B72B-5784-4169-88DA-9EF51C5CE907\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubygems:json_gem:1.7.2:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B59F779-5E90-40E3-ABC8-58A7EC3C7E17\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubygems:json_gem:1.7.3:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"979B9AA8-3E70-4BCF-8C2F-3C872AF8A7B0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubygems:json_gem:1.7.4:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"7DCB75C6-3E7A-41C7-8513-8766C4ED73F7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubygems:json_gem:1.7.5:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"717A9E8C-9E3E-4F55-8CD4-D9E6CF670C5C\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:rubygems:json_gem:1.7.6:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"52D8BF48-03A7-4EFA-B626-A92C8570CB86\"}]}]}],\"references\":[{\"url\":\"http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2013-04/msg00034.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-0686.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-0701.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-1028.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-1147.html\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/52075\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/52774\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://secunia.com/advisories/52902\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/\",\"source\":\"secalert@redhat.com\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2013/02/11/7\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2013/02/11/8\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.osvdb.org/90074\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.securityfocus.com/bid/57899\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2013\u0026m=slackware-security.426862\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.ubuntu.com/usn/USN-1733-1\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/82010\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://groups.google.com/group/rubyonrails-security/msg/d8e0db6e08c81428?dmode=source\u0026output=gplain\",\"source\":\"secalert@redhat.com\"},{\"url\":\"https://puppet.com/security/cve/cve-2013-0269\",\"source\":\"secalert@redhat.com\"},{\"url\":\"http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://lists.opensuse.org/opensuse-updates/2013-04/msg00034.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-0686.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-0701.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-1028.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://rhn.redhat.com/errata/RHSA-2013-1147.html\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/52075\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://secunia.com/advisories/52774\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://secunia.com/advisories/52902\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Vendor Advisory\"]},{\"url\":\"http://www.openwall.com/lists/oss-security/2013/02/11/7\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.openwall.com/lists/oss-security/2013/02/11/8\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.osvdb.org/90074\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.securityfocus.com/bid/57899\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2013\u0026m=slackware-security.426862\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.ubuntu.com/usn/USN-1733-1\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://exchange.xforce.ibmcloud.com/vulnerabilities/82010\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://groups.google.com/group/rubyonrails-security/msg/d8e0db6e08c81428?dmode=source\u0026output=gplain\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"},{\"url\":\"https://puppet.com/security/cve/cve-2013-0269\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\"}]}}"
}
}
rhsa-2013:1028
Vulnerability from csaf_redhat
Published
2013-07-09 17:35
Modified
2024-11-22 06:54
Summary
Red Hat Security Advisory: Fuse ESB Enterprise 7.1.0 update
Notes
Topic
Fuse ESB Enterprise 7.1.0 roll up patch 1, which fixes multiple security
issues and various bugs, is now available from the Red Hat Customer Portal.
The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
Details
Fuse ESB Enterprise, based on Apache ServiceMix, provides an integration
platform.
This release of Fuse ESB Enterprise 7.1.0 roll up patch 1 is an update to
Fuse ESB Enterprise 7.1.0 and includes bug fixes. Refer to the readme file
included with the patch files for information about the bug fixes.
The following security issues are also fixed with this release:
XML encryption backwards compatibility attacks were found against various
frameworks, including Apache CXF. An attacker could force a server to use
insecure, legacy cryptosystems, even when secure cryptosystems were enabled
on endpoints. By forcing the use of legacy cryptosystems, flaws such as
CVE-2011-1096 and CVE-2011-2487 would be exposed, allowing plain text to be
recovered from cryptograms and symmetric keys. (CVE-2012-5575)
Note: Automatic checks to prevent CVE-2012-5575 are only run when
WS-SecurityPolicy is used to enforce security requirements. It is best
practice to use WS-SecurityPolicy to enforce security requirements.
A flaw in JRuby's JSON gem allowed remote attacks by creating different
types of malicious objects. For example, it could initiate a denial of
service attack through resource consumption by using a JSON document to
create arbitrary Ruby symbols, which were never garbage collected. It could
also be exploited to create internal objects which could allow a SQL
injection attack. (CVE-2013-0269)
It was discovered that JRuby's REXML library did not properly restrict XML
entity expansion. An attacker could use this flaw to cause a denial of
service by tricking a Ruby application using REXML to read text nodes from
specially-crafted XML content, which will result in REXML consuming large
amounts of system memory. (CVE-2013-1821)
Multiple denial of service flaws were found in the way the Apache CXF
StAX parser implementation processed certain XML files. If a web service
utilized the StAX parser, a remote attacker could provide a
specially-crafted XML file that, when processed, would lead to excessive
CPU and memory consumption. (CVE-2013-2160)
Note: Fuse ESB Enterprise 7.1.0 ships JRuby as part of the camel-ruby
component, which allows users to define Camel routes in Ruby. The default
use of JRuby in Fuse ESB Enterprise 7.1.0 does not appear to expose either
CVE-2013-0269 or CVE-2013-1821. If the version of JRuby shipped with Fuse
ESB Enterprise 7.1.0 was used to build a custom application, then these
flaws could be exposed.
Red Hat would like to thank Tibor Jager, Kenneth G. Paterson and Juraj
Somorovsky of Ruhr-University Bochum for reporting CVE-2012-5575; Ruby
on Rails upstream for reporting CVE-2013-0269; and Andreas Falkenberg of
SEC Consult Deutschland GmbH, and Christian Mainka, Juraj Somorovsky and
Joerg Schwenk of Ruhr-University Bochum for reporting CVE-2013-2160.
Upstream acknowledges Thomas Hollstegge of Zweitag and Ben Murphy as the
original reporters of CVE-2013-0269.
All users of Fuse ESB Enterprise 7.1.0 as provided from the Red Hat
Customer Portal are advised to upgrade to Fuse ESB Enterprise 7.1.0 roll up
patch 1.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Fuse ESB Enterprise 7.1.0 roll up patch 1, which fixes multiple security\nissues and various bugs, is now available from the Red Hat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Fuse ESB Enterprise, based on Apache ServiceMix, provides an integration\nplatform.\n\nThis release of Fuse ESB Enterprise 7.1.0 roll up patch 1 is an update to\nFuse ESB Enterprise 7.1.0 and includes bug fixes. Refer to the readme file\nincluded with the patch files for information about the bug fixes.\n\nThe following security issues are also fixed with this release:\n\nXML encryption backwards compatibility attacks were found against various\nframeworks, including Apache CXF. An attacker could force a server to use\ninsecure, legacy cryptosystems, even when secure cryptosystems were enabled\non endpoints. By forcing the use of legacy cryptosystems, flaws such as\nCVE-2011-1096 and CVE-2011-2487 would be exposed, allowing plain text to be\nrecovered from cryptograms and symmetric keys. (CVE-2012-5575)\n\nNote: Automatic checks to prevent CVE-2012-5575 are only run when\nWS-SecurityPolicy is used to enforce security requirements. It is best\npractice to use WS-SecurityPolicy to enforce security requirements.\n\nA flaw in JRuby\u0027s JSON gem allowed remote attacks by creating different\ntypes of malicious objects. For example, it could initiate a denial of\nservice attack through resource consumption by using a JSON document to\ncreate arbitrary Ruby symbols, which were never garbage collected. It could\nalso be exploited to create internal objects which could allow a SQL\ninjection attack. (CVE-2013-0269)\n\nIt was discovered that JRuby\u0027s REXML library did not properly restrict XML\nentity expansion. An attacker could use this flaw to cause a denial of\nservice by tricking a Ruby application using REXML to read text nodes from\nspecially-crafted XML content, which will result in REXML consuming large\namounts of system memory. (CVE-2013-1821)\n\nMultiple denial of service flaws were found in the way the Apache CXF\nStAX parser implementation processed certain XML files. If a web service\nutilized the StAX parser, a remote attacker could provide a\nspecially-crafted XML file that, when processed, would lead to excessive\nCPU and memory consumption. (CVE-2013-2160)\n\nNote: Fuse ESB Enterprise 7.1.0 ships JRuby as part of the camel-ruby\ncomponent, which allows users to define Camel routes in Ruby. The default\nuse of JRuby in Fuse ESB Enterprise 7.1.0 does not appear to expose either\nCVE-2013-0269 or CVE-2013-1821. If the version of JRuby shipped with Fuse\nESB Enterprise 7.1.0 was used to build a custom application, then these\nflaws could be exposed.\n\nRed Hat would like to thank Tibor Jager, Kenneth G. Paterson and Juraj\nSomorovsky of Ruhr-University Bochum for reporting CVE-2012-5575; Ruby\non Rails upstream for reporting CVE-2013-0269; and Andreas Falkenberg of\nSEC Consult Deutschland GmbH, and Christian Mainka, Juraj Somorovsky and\nJoerg Schwenk of Ruhr-University Bochum for reporting CVE-2013-2160.\nUpstream acknowledges Thomas Hollstegge of Zweitag and Ben Murphy as the\noriginal reporters of CVE-2013-0269.\n\nAll users of Fuse ESB Enterprise 7.1.0 as provided from the Red Hat\nCustomer Portal are advised to upgrade to Fuse ESB Enterprise 7.1.0 roll up\npatch 1.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2013:1028",
"url": "https://access.redhat.com/errata/RHSA-2013:1028"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.esb.enterprise\u0026downloadType=securityPatches\u0026version=7.1.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=fuse.esb.enterprise\u0026downloadType=securityPatches\u0026version=7.1.0"
},
{
"category": "external",
"summary": "http://cxf.apache.org/cve-2012-5575.html",
"url": "http://cxf.apache.org/cve-2012-5575.html"
},
{
"category": "external",
"summary": "https://cxf.apache.org/security-advisories.data/CVE-2013-2160.txt.asc",
"url": "https://cxf.apache.org/security-advisories.data/CVE-2013-2160.txt.asc"
},
{
"category": "external",
"summary": "880443",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=880443"
},
{
"category": "external",
"summary": "909029",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=909029"
},
{
"category": "external",
"summary": "914716",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=914716"
},
{
"category": "external",
"summary": "929197",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=929197"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1028.json"
}
],
"title": "Red Hat Security Advisory: Fuse ESB Enterprise 7.1.0 update",
"tracking": {
"current_release_date": "2024-11-22T06:54:49+00:00",
"generator": {
"date": "2024-11-22T06:54:49+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2013:1028",
"initial_release_date": "2013-07-09T17:35:00+00:00",
"revision_history": [
{
"date": "2013-07-09T17:35:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2013-07-09T17:36:00+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T06:54:49+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Fuse ESB Enterprise 7.1.0",
"product": {
"name": "Fuse ESB Enterprise 7.1.0",
"product_id": "Fuse ESB Enterprise 7.1.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:fuse_esb_enterprise:7.1.0"
}
}
}
],
"category": "product_family",
"name": "Fuse Enterprise Middleware"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Tibor Jager",
"Kenneth G. Paterson",
"Juraj Somorovsky"
],
"organization": "Ruhr-University Bochum"
}
],
"cve": "CVE-2012-5575",
"cwe": {
"id": "CWE-327",
"name": "Use of a Broken or Risky Cryptographic Algorithm"
},
"discovery_date": "2012-11-15T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "880443"
}
],
"notes": [
{
"category": "description",
"text": "Apache CXF 2.5.x before 2.5.10, 2.6.x before CXF 2.6.7, and 2.7.x before CXF 2.7.4 does not verify that a specified cryptographic algorithm is allowed by the WS-SecurityPolicy AlgorithmSuite definition before decrypting, which allows remote attackers to force CXF to use weaker cryptographic algorithms than intended and makes it easier to decrypt communications, aka \"XML Encryption backwards compatibility attack.\"",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "apache-cxf: XML encryption backwards compatibility attacks",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Fuse ESB Enterprise 7.1.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-5575"
},
{
"category": "external",
"summary": "RHBZ#880443",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=880443"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-5575",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-5575"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-5575",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5575"
},
{
"category": "external",
"summary": "http://cxf.apache.org/cve-2012-5575.html",
"url": "http://cxf.apache.org/cve-2012-5575.html"
},
{
"category": "external",
"summary": "http://www.nds.ruhr-uni-bochum.de/research/publications/backwards-compatibility/",
"url": "http://www.nds.ruhr-uni-bochum.de/research/publications/backwards-compatibility/"
}
],
"release_date": "2013-03-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-07-09T17:35:00+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
"product_ids": [
"Fuse ESB Enterprise 7.1.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1028"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 7.8,
"confidentialityImpact": "COMPLETE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:C/I:N/A:N",
"version": "2.0"
},
"products": [
"Fuse ESB Enterprise 7.1.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "apache-cxf: XML encryption backwards compatibility attacks"
},
{
"acknowledgments": [
{
"names": [
"Ruby on Rails upstream"
]
},
{
"names": [
"Thomas Hollstegge"
],
"organization": "Zweitag",
"summary": "Acknowledged by upstream."
},
{
"names": [
"Ben Murphy"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2013-0269",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2013-02-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "909029"
}
],
"notes": [
{
"category": "description",
"text": "The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka \"Unsafe Object Creation Vulnerability.\"",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-json: Denial of Service and SQL Injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Satellite tools ship RubyGem Json 1.4.6 which is earlier than affected 1.5.5 version however, this version of RubyGem is not affected to the flaw. We may update RubyGem in a future release.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Fuse ESB Enterprise 7.1.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-0269"
},
{
"category": "external",
"summary": "RHBZ#909029",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=909029"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-0269",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0269"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0269",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0269"
},
{
"category": "external",
"summary": "http://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/",
"url": "http://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/"
}
],
"release_date": "2013-02-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-07-09T17:35:00+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
"product_ids": [
"Fuse ESB Enterprise 7.1.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1028"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Fuse ESB Enterprise 7.1.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-json: Denial of Service and SQL Injection"
},
{
"cve": "CVE-2013-1821",
"discovery_date": "2013-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "914716"
}
],
"notes": [
{
"category": "description",
"text": "lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ruby: entity expansion DoS vulnerability in REXML",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Fuse ESB Enterprise 7.1.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-1821"
},
{
"category": "external",
"summary": "RHBZ#914716",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=914716"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-1821",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-1821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-1821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1821"
},
{
"category": "external",
"summary": "http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/",
"url": "http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/"
}
],
"release_date": "2013-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-07-09T17:35:00+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
"product_ids": [
"Fuse ESB Enterprise 7.1.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1028"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Fuse ESB Enterprise 7.1.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ruby: entity expansion DoS vulnerability in REXML"
},
{
"acknowledgments": [
{
"names": [
"Andreas Falkenberg"
],
"organization": "SEC Consult Deutschland GmbH"
},
{
"names": [
"Christian Mainka",
"Juraj Somorovsky",
"Joerg Schwenk"
],
"organization": "Ruhr-University Bochum"
}
],
"cve": "CVE-2013-2160",
"discovery_date": "2013-03-29T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "929197"
}
],
"notes": [
{
"category": "description",
"text": "The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "apache-cxf: Multiple denial of service flaws in the StAX parser",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Fuse ESB Enterprise 7.1.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-2160"
},
{
"category": "external",
"summary": "RHBZ#929197",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=929197"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-2160",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-2160"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-2160",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2160"
},
{
"category": "external",
"summary": "http://cxf.apache.org/security-advisories.data/CVE-2013-2160.txt.asc",
"url": "http://cxf.apache.org/security-advisories.data/CVE-2013-2160.txt.asc"
}
],
"release_date": "2013-06-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-07-09T17:35:00+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
"product_ids": [
"Fuse ESB Enterprise 7.1.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1028"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Fuse ESB Enterprise 7.1.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "apache-cxf: Multiple denial of service flaws in the StAX parser"
}
]
}
rhsa-2013:1185
Vulnerability from csaf_redhat
Published
2013-08-29 23:22
Modified
2024-11-22 07:01
Summary
Red Hat Security Advisory: Red Hat JBoss Fuse 6.0.0 patch 2
Notes
Topic
Red Hat JBoss Fuse 6.0.0 patch 2, which fixes several security issues and
various bugs, is now available from the Red Hat Customer Portal.
The Red Hat Security Response Team has rated this update as having
important security impact. Common Vulnerability Scoring System (CVSS) base
scores, which give detailed severity ratings, are available for each
vulnerability from the CVE links in the References section.
Details
Red Hat JBoss Fuse 6.0.0, based on Apache ServiceMix, provides an
integration platform.
Red Hat JBoss Fuse 6.0.0 patch 2 is an update to Red Hat JBoss Fuse 6.0.0
and includes bug fixes. Refer to the readme file included with the patch
files for information about these fixes.
The following security issues are also resolved with this update:
A flaw was found in the logging performed during deserialization of the
BrokerFactory class in Apache OpenJPA. A remote attacker able to supply a
serialized instance of the BrokerFactory class, which will be deserialized
on a server, could use this flaw to write an executable file to the
server's file system. (CVE-2013-1768)
A flaw in JRuby's JSON gem allowed remote attacks by creating different
types of malicious objects. For example, it could initiate a denial of
service attack through resource consumption by using a JSON document to
create arbitrary Ruby symbols, which were never garbage collected. It could
also be exploited to create internal objects which could allow a SQL
injection attack. (CVE-2013-0269)
It was discovered that JRuby's REXML library did not properly restrict XML
entity expansion. An attacker could use this flaw to cause a denial of
service by tricking a Ruby application using REXML to read text nodes from
specially-crafted XML content, which will result in REXML consuming large
amounts of system memory. (CVE-2013-1821)
Note: Red Hat JBoss Fuse 6.0.0 ships JRuby as part of the camel-ruby
component, which allows users to define Camel routes in Ruby. The default
use of JRuby in Red Hat JBoss Fuse 6.0.0 does not appear to expose either
CVE-2013-0269 or CVE-2013-1821. If the version of JRuby shipped with Red
Hat JBoss Fuse 6.0.0 was used to build a custom application, then these
flaws could be exposed.
Multiple denial of service flaws were found in the way the Apache CXF StAX
parser implementation processed certain XML files. If a web service
utilized the StAX parser, a remote attacker could provide a
specially-crafted XML file that, when processed, would lead to excessive
CPU and memory consumption. (CVE-2013-2160)
Red Hat would like to thank Ruby on Rails upstream for reporting
CVE-2013-0269, and Andreas Falkenberg of SEC Consult Deutschland GmbH, and
Christian Mainka, Juraj Somorovsky and Joerg Schwenk of Ruhr-University
Bochum for reporting CVE-2013-2160. Upstream acknowledges Thomas Hollstegge
of Zweitag and Ben Murphy as the original reporters of CVE-2013-0269.
All users of Red Hat JBoss Fuse 6.0 as provided from the Red Hat Customer
Portal are advised to apply this patch.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss Fuse 6.0.0 patch 2, which fixes several security issues and\nvarious bugs, is now available from the Red Hat Customer Portal.\n\nThe Red Hat Security Response Team has rated this update as having\nimportant security impact. Common Vulnerability Scoring System (CVSS) base\nscores, which give detailed severity ratings, are available for each\nvulnerability from the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss Fuse 6.0.0, based on Apache ServiceMix, provides an\nintegration platform.\n\nRed Hat JBoss Fuse 6.0.0 patch 2 is an update to Red Hat JBoss Fuse 6.0.0\nand includes bug fixes. Refer to the readme file included with the patch\nfiles for information about these fixes.\n\nThe following security issues are also resolved with this update:\n\nA flaw was found in the logging performed during deserialization of the\nBrokerFactory class in Apache OpenJPA. A remote attacker able to supply a\nserialized instance of the BrokerFactory class, which will be deserialized\non a server, could use this flaw to write an executable file to the\nserver\u0027s file system. (CVE-2013-1768)\n\nA flaw in JRuby\u0027s JSON gem allowed remote attacks by creating different\ntypes of malicious objects. For example, it could initiate a denial of\nservice attack through resource consumption by using a JSON document to\ncreate arbitrary Ruby symbols, which were never garbage collected. It could\nalso be exploited to create internal objects which could allow a SQL\ninjection attack. (CVE-2013-0269)\n\nIt was discovered that JRuby\u0027s REXML library did not properly restrict XML\nentity expansion. An attacker could use this flaw to cause a denial of\nservice by tricking a Ruby application using REXML to read text nodes from\nspecially-crafted XML content, which will result in REXML consuming large\namounts of system memory. (CVE-2013-1821)\n\nNote: Red Hat JBoss Fuse 6.0.0 ships JRuby as part of the camel-ruby\ncomponent, which allows users to define Camel routes in Ruby. The default\nuse of JRuby in Red Hat JBoss Fuse 6.0.0 does not appear to expose either\nCVE-2013-0269 or CVE-2013-1821. If the version of JRuby shipped with Red\nHat JBoss Fuse 6.0.0 was used to build a custom application, then these\nflaws could be exposed.\n\nMultiple denial of service flaws were found in the way the Apache CXF StAX\nparser implementation processed certain XML files. If a web service\nutilized the StAX parser, a remote attacker could provide a\nspecially-crafted XML file that, when processed, would lead to excessive\nCPU and memory consumption. (CVE-2013-2160)\n\nRed Hat would like to thank Ruby on Rails upstream for reporting\nCVE-2013-0269, and Andreas Falkenberg of SEC Consult Deutschland GmbH, and\nChristian Mainka, Juraj Somorovsky and Joerg Schwenk of Ruhr-University\nBochum for reporting CVE-2013-2160. Upstream acknowledges Thomas Hollstegge\nof Zweitag and Ben Murphy as the original reporters of CVE-2013-0269.\n\nAll users of Red Hat JBoss Fuse 6.0 as provided from the Red Hat Customer\nPortal are advised to apply this patch.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2013:1185",
"url": "https://access.redhat.com/errata/RHSA-2013:1185"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#important",
"url": "https://access.redhat.com/security/updates/classification/#important"
},
{
"category": "external",
"summary": "https://cxf.apache.org/security-advisories.data/CVE-2013-2160.txt.asc",
"url": "https://cxf.apache.org/security-advisories.data/CVE-2013-2160.txt.asc"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.0.0",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=jboss.fuse\u0026downloadType=securityPatches\u0026version=6.0.0"
},
{
"category": "external",
"summary": "909029",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=909029"
},
{
"category": "external",
"summary": "914716",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=914716"
},
{
"category": "external",
"summary": "929197",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=929197"
},
{
"category": "external",
"summary": "984034",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=984034"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1185.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss Fuse 6.0.0 patch 2",
"tracking": {
"current_release_date": "2024-11-22T07:01:20+00:00",
"generator": {
"date": "2024-11-22T07:01:20+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2013:1185",
"initial_release_date": "2013-08-29T23:22:00+00:00",
"revision_history": [
{
"date": "2013-08-29T23:22:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2013-08-29T23:27:44+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T07:01:20+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Fuse 6.0",
"product": {
"name": "Red Hat JBoss Fuse 6.0",
"product_id": "Red Hat JBoss Fuse 6.0",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_fuse:6.0.0"
}
}
}
],
"category": "product_family",
"name": "Fuse Enterprise Middleware"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Ruby on Rails upstream"
]
},
{
"names": [
"Thomas Hollstegge"
],
"organization": "Zweitag",
"summary": "Acknowledged by upstream."
},
{
"names": [
"Ben Murphy"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2013-0269",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2013-02-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "909029"
}
],
"notes": [
{
"category": "description",
"text": "The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka \"Unsafe Object Creation Vulnerability.\"",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-json: Denial of Service and SQL Injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Satellite tools ship RubyGem Json 1.4.6 which is earlier than affected 1.5.5 version however, this version of RubyGem is not affected to the flaw. We may update RubyGem in a future release.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-0269"
},
{
"category": "external",
"summary": "RHBZ#909029",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=909029"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-0269",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0269"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0269",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0269"
},
{
"category": "external",
"summary": "http://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/",
"url": "http://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/"
}
],
"release_date": "2013-02-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-08-29T23:22:00+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
"product_ids": [
"Red Hat JBoss Fuse 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1185"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-json: Denial of Service and SQL Injection"
},
{
"cve": "CVE-2013-1768",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2013-07-11T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "984034"
}
],
"notes": [
{
"category": "description",
"text": "The BrokerFactory functionality in Apache OpenJPA 1.x before 1.2.3 and 2.x before 2.2.2 creates local executable JSP files containing logging trace data produced during deserialization of certain crafted OpenJPA objects, which makes it easier for remote attackers to execute arbitrary code by creating a serialized object and leveraging improperly secured server programs.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "openjpa: Remote arbitrary code execution by creating a serialized object and leveraging improperly secured server programs",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-1768"
},
{
"category": "external",
"summary": "RHBZ#984034",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=984034"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-1768",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-1768"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-1768",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1768"
}
],
"release_date": "2013-06-12T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-08-29T23:22:00+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
"product_ids": [
"Red Hat JBoss Fuse 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1185"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Important"
}
],
"title": "openjpa: Remote arbitrary code execution by creating a serialized object and leveraging improperly secured server programs"
},
{
"cve": "CVE-2013-1821",
"discovery_date": "2013-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "914716"
}
],
"notes": [
{
"category": "description",
"text": "lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ruby: entity expansion DoS vulnerability in REXML",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-1821"
},
{
"category": "external",
"summary": "RHBZ#914716",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=914716"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-1821",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-1821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-1821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1821"
},
{
"category": "external",
"summary": "http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/",
"url": "http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/"
}
],
"release_date": "2013-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-08-29T23:22:00+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
"product_ids": [
"Red Hat JBoss Fuse 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1185"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ruby: entity expansion DoS vulnerability in REXML"
},
{
"acknowledgments": [
{
"names": [
"Andreas Falkenberg"
],
"organization": "SEC Consult Deutschland GmbH"
},
{
"names": [
"Christian Mainka",
"Juraj Somorovsky",
"Joerg Schwenk"
],
"organization": "Ruhr-University Bochum"
}
],
"cve": "CVE-2013-2160",
"discovery_date": "2013-03-29T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "929197"
}
],
"notes": [
{
"category": "description",
"text": "The streaming XML parser in Apache CXF 2.5.x before 2.5.10, 2.6.x before 2.6.7, and 2.7.x before 2.7.4 allows remote attackers to cause a denial of service (CPU and memory consumption) via crafted XML with a large number of (1) elements, (2) attributes, (3) nested constructs, and possibly other vectors.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "apache-cxf: Multiple denial of service flaws in the StAX parser",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss Fuse 6.0"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-2160"
},
{
"category": "external",
"summary": "RHBZ#929197",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=929197"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-2160",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-2160"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-2160",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-2160"
},
{
"category": "external",
"summary": "http://cxf.apache.org/security-advisories.data/CVE-2013-2160.txt.asc",
"url": "http://cxf.apache.org/security-advisories.data/CVE-2013-2160.txt.asc"
}
],
"release_date": "2013-06-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-08-29T23:22:00+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update).",
"product_ids": [
"Red Hat JBoss Fuse 6.0"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1185"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss Fuse 6.0"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "apache-cxf: Multiple denial of service flaws in the StAX parser"
}
]
}
rhsa-2013:0701
Vulnerability from csaf_redhat
Published
2013-04-02 19:58
Modified
2024-11-22 06:54
Summary
Red Hat Security Advisory: ruby193-ruby, rubygem-json and rubygem-rdoc security update
Notes
Topic
Updated ruby193-ruby, rubygem-json and rubygem-rdoc packages that fix two
security issues are now available for Red Hat OpenShift Enterprise 1.1.3.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Ruby is an extensible, interpreted, object-oriented, scripting language. It
has features to process text files and to do system management tasks.
A flaw in rubygem-json and ruby193-rubygem-json allowed remote attacks by
creating different types of malicious objects. For example, it could
initiate a denial of service attack through resource consumption by using a
JSON document to create arbitrary Ruby symbols, which were never garbage
collected. It could also be exploited to create internal objects which
could allow a SQL injection attack. (CVE-2013-0269)
It was found that documentation created by rubygem-rdoc and
ruby193-rubygem-rdoc was vulnerable to a cross-site scripting (XSS) attack.
If such documentation was accessible over a network, and a remote attacker
could trick a user into visiting a specially-crafted URL, it would lead to
arbitrary web script execution in the context of the user's session. As
rubygem-rdoc and ruby193-rubygem-rdoc are used for creating documentation
for Ruby source files (such as classes, modules, and so on), it is not a
common scenario to make such documentation accessible over the network.
(CVE-2013-0256)
Red Hat would like to thank Ruby on Rails upstream for reporting
CVE-2013-0269, and Eric Hodel of RDoc upstream for reporting CVE-2013-0256.
Upstream acknowledges Thomas Hollstegge of Zweitag and Ben Murphy as the
original reporters of CVE-2013-0269, and Evgeny Ermakov as the original
reporter of CVE-2013-0256.
Users of Red Hat OpenShift Enterprise 1.1.3 are advised to upgrade to these
updated packages, which correct these issues.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Updated ruby193-ruby, rubygem-json and rubygem-rdoc packages that fix two\nsecurity issues are now available for Red Hat OpenShift Enterprise 1.1.3.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Ruby is an extensible, interpreted, object-oriented, scripting language. It\nhas features to process text files and to do system management tasks.\n\nA flaw in rubygem-json and ruby193-rubygem-json allowed remote attacks by\ncreating different types of malicious objects. For example, it could\ninitiate a denial of service attack through resource consumption by using a\nJSON document to create arbitrary Ruby symbols, which were never garbage\ncollected. It could also be exploited to create internal objects which\ncould allow a SQL injection attack. (CVE-2013-0269)\n\nIt was found that documentation created by rubygem-rdoc and\nruby193-rubygem-rdoc was vulnerable to a cross-site scripting (XSS) attack.\nIf such documentation was accessible over a network, and a remote attacker\ncould trick a user into visiting a specially-crafted URL, it would lead to\narbitrary web script execution in the context of the user\u0027s session. As\nrubygem-rdoc and ruby193-rubygem-rdoc are used for creating documentation\nfor Ruby source files (such as classes, modules, and so on), it is not a\ncommon scenario to make such documentation accessible over the network.\n(CVE-2013-0256)\n\nRed Hat would like to thank Ruby on Rails upstream for reporting\nCVE-2013-0269, and Eric Hodel of RDoc upstream for reporting CVE-2013-0256.\nUpstream acknowledges Thomas Hollstegge of Zweitag and Ben Murphy as the\noriginal reporters of CVE-2013-0269, and Evgeny Ermakov as the original\nreporter of CVE-2013-0256.\n\nUsers of Red Hat OpenShift Enterprise 1.1.3 are advised to upgrade to these\nupdated packages, which correct these issues.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2013:0701",
"url": "https://access.redhat.com/errata/RHSA-2013:0701"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "907820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=907820"
},
{
"category": "external",
"summary": "909029",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=909029"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0701.json"
}
],
"title": "Red Hat Security Advisory: ruby193-ruby, rubygem-json and rubygem-rdoc security update",
"tracking": {
"current_release_date": "2024-11-22T06:54:45+00:00",
"generator": {
"date": "2024-11-22T06:54:45+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2013:0701",
"initial_release_date": "2013-04-02T19:58:00+00:00",
"revision_history": [
{
"date": "2013-04-02T19:58:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2013-04-02T20:06:00+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T06:54:45+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat OpenShift Enterprise Infrastructure",
"product": {
"name": "Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:1::el6"
}
}
},
{
"category": "product_name",
"name": "Red Hat OpenShift Enterprise Node",
"product": {
"name": "Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:openshift:1::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat OpenShift Enterprise"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby193-rubygem-json-0:1.5.4-28.el6.x86_64",
"product": {
"name": "ruby193-rubygem-json-0:1.5.4-28.el6.x86_64",
"product_id": "ruby193-rubygem-json-0:1.5.4-28.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-json@1.5.4-28.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64",
"product": {
"name": "ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64",
"product_id": "ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-ruby-libs@1.9.3.327-28.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-io-console-0:0.3-28.el6.x86_64",
"product": {
"name": "ruby193-rubygem-io-console-0:0.3-28.el6.x86_64",
"product_id": "ruby193-rubygem-io-console-0:0.3-28.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-io-console@0.3-28.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64",
"product": {
"name": "ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64",
"product_id": "ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-ruby-tcltk@1.9.3.327-28.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64",
"product": {
"name": "ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64",
"product_id": "ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-ruby-doc@1.9.3.327-28.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby193-ruby-0:1.9.3.327-28.el6.x86_64",
"product": {
"name": "ruby193-ruby-0:1.9.3.327-28.el6.x86_64",
"product_id": "ruby193-ruby-0:1.9.3.327-28.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-ruby@1.9.3.327-28.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64",
"product": {
"name": "ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64",
"product_id": "ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-bigdecimal@1.1.0-28.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64",
"product": {
"name": "ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64",
"product_id": "ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-ruby-debuginfo@1.9.3.327-28.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64",
"product": {
"name": "ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64",
"product_id": "ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-ruby-devel@1.9.3.327-28.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64",
"product": {
"name": "ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64",
"product_id": "ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-rdoc@3.9.4-28.el6?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64",
"product": {
"name": "rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64",
"product_id": "rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-json-debuginfo@1.7.3-2.el6op?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-json-0:1.7.3-2.el6op.x86_64",
"product": {
"name": "rubygem-json-0:1.7.3-2.el6op.x86_64",
"product_id": "rubygem-json-0:1.7.3-2.el6op.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-json@1.7.3-2.el6op?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby193-rubygems-0:1.8.23-28.el6.noarch",
"product": {
"name": "ruby193-rubygems-0:1.8.23-28.el6.noarch",
"product_id": "ruby193-rubygems-0:1.8.23-28.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygems@1.8.23-28.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch",
"product": {
"name": "ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch",
"product_id": "ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-ruby-irb@1.9.3.327-28.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch",
"product": {
"name": "ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch",
"product_id": "ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-minitest@2.5.1-28.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygems-devel-0:1.8.23-28.el6.noarch",
"product": {
"name": "ruby193-rubygems-devel-0:1.8.23-28.el6.noarch",
"product_id": "ruby193-rubygems-devel-0:1.8.23-28.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygems-devel@1.8.23-28.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch",
"product": {
"name": "ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch",
"product_id": "ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-rubygem-rake@0.9.2.2-28.el6?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-json-doc-0:1.7.3-2.el6op.noarch",
"product": {
"name": "rubygem-json-doc-0:1.7.3-2.el6op.noarch",
"product_id": "rubygem-json-doc-0:1.7.3-2.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-json-doc@1.7.3-2.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-rdoc-0:3.8-9.el6op.noarch",
"product": {
"name": "rubygem-rdoc-0:3.8-9.el6op.noarch",
"product_id": "rubygem-rdoc-0:3.8-9.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-rdoc@3.8-9.el6op?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-rdoc-doc-0:3.8-9.el6op.noarch",
"product": {
"name": "rubygem-rdoc-doc-0:3.8-9.el6op.noarch",
"product_id": "rubygem-rdoc-doc-0:3.8-9.el6op.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-rdoc-doc@3.8-9.el6op?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "ruby193-ruby-0:1.9.3.327-28.el6.src",
"product": {
"name": "ruby193-ruby-0:1.9.3.327-28.el6.src",
"product_id": "ruby193-ruby-0:1.9.3.327-28.el6.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby193-ruby@1.9.3.327-28.el6?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-json-0:1.7.3-2.el6op.src",
"product": {
"name": "rubygem-json-0:1.7.3-2.el6op.src",
"product_id": "rubygem-json-0:1.7.3-2.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-json@1.7.3-2.el6op?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-rdoc-0:3.8-9.el6op.src",
"product": {
"name": "rubygem-rdoc-0:3.8-9.el6op.src",
"product_id": "rubygem-rdoc-0:3.8-9.el6op.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-rdoc@3.8-9.el6op?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-ruby-0:1.9.3.327-28.el6.src as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.src"
},
"product_reference": "ruby193-ruby-0:1.9.3.327-28.el6.src",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-ruby-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.x86_64"
},
"product_reference": "ruby193-ruby-0:1.9.3.327-28.el6.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64"
},
"product_reference": "ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64"
},
"product_reference": "ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64"
},
"product_reference": "ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch"
},
"product_reference": "ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64"
},
"product_reference": "ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64"
},
"product_reference": "ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64"
},
"product_reference": "ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-io-console-0:0.3-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64"
},
"product_reference": "ruby193-rubygem-io-console-0:0.3-28.el6.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-json-0:1.5.4-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64"
},
"product_reference": "ruby193-rubygem-json-0:1.5.4-28.el6.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch"
},
"product_reference": "ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch"
},
"product_reference": "ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64"
},
"product_reference": "ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygems-0:1.8.23-28.el6.noarch as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-rubygems-0:1.8.23-28.el6.noarch"
},
"product_reference": "ruby193-rubygems-0:1.8.23-28.el6.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygems-devel-0:1.8.23-28.el6.noarch as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch"
},
"product_reference": "ruby193-rubygems-devel-0:1.8.23-28.el6.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-json-0:1.7.3-2.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.src"
},
"product_reference": "rubygem-json-0:1.7.3-2.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-json-0:1.7.3-2.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.x86_64"
},
"product_reference": "rubygem-json-0:1.7.3-2.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64"
},
"product_reference": "rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-json-doc-0:1.7.3-2.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:rubygem-json-doc-0:1.7.3-2.el6op.noarch"
},
"product_reference": "rubygem-json-doc-0:1.7.3-2.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-rdoc-0:3.8-9.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.noarch"
},
"product_reference": "rubygem-rdoc-0:3.8-9.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-rdoc-0:3.8-9.el6op.src as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.src"
},
"product_reference": "rubygem-rdoc-0:3.8-9.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-rdoc-doc-0:3.8-9.el6op.noarch as a component of Red Hat OpenShift Enterprise Infrastructure",
"product_id": "6Server-RHOSE-INFRA:rubygem-rdoc-doc-0:3.8-9.el6op.noarch"
},
"product_reference": "rubygem-rdoc-doc-0:3.8-9.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-INFRA"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-ruby-0:1.9.3.327-28.el6.src as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.src"
},
"product_reference": "ruby193-ruby-0:1.9.3.327-28.el6.src",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-ruby-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.x86_64"
},
"product_reference": "ruby193-ruby-0:1.9.3.327-28.el6.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64"
},
"product_reference": "ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64"
},
"product_reference": "ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64"
},
"product_reference": "ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch"
},
"product_reference": "ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64"
},
"product_reference": "ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64"
},
"product_reference": "ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64"
},
"product_reference": "ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-io-console-0:0.3-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64"
},
"product_reference": "ruby193-rubygem-io-console-0:0.3-28.el6.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-json-0:1.5.4-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64"
},
"product_reference": "ruby193-rubygem-json-0:1.5.4-28.el6.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch"
},
"product_reference": "ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch"
},
"product_reference": "ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64"
},
"product_reference": "ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygems-0:1.8.23-28.el6.noarch as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-rubygems-0:1.8.23-28.el6.noarch"
},
"product_reference": "ruby193-rubygems-0:1.8.23-28.el6.noarch",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby193-rubygems-devel-0:1.8.23-28.el6.noarch as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch"
},
"product_reference": "ruby193-rubygems-devel-0:1.8.23-28.el6.noarch",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-json-0:1.7.3-2.el6op.src as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.src"
},
"product_reference": "rubygem-json-0:1.7.3-2.el6op.src",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-json-0:1.7.3-2.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.x86_64"
},
"product_reference": "rubygem-json-0:1.7.3-2.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64 as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64"
},
"product_reference": "rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64",
"relates_to_product_reference": "6Server-RHOSE-NODE"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-json-doc-0:1.7.3-2.el6op.noarch as a component of Red Hat OpenShift Enterprise Node",
"product_id": "6Server-RHOSE-NODE:rubygem-json-doc-0:1.7.3-2.el6op.noarch"
},
"product_reference": "rubygem-json-doc-0:1.7.3-2.el6op.noarch",
"relates_to_product_reference": "6Server-RHOSE-NODE"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Eric Hodel"
],
"organization": "RDoc upstream"
},
{
"names": [
"Evgeny Ermakov"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2013-0256",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2013-02-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "907820"
}
],
"notes": [
{
"category": "description",
"text": "darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.src",
"6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygems-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-json-doc-0:1.7.3-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.src",
"6Server-RHOSE-INFRA:rubygem-rdoc-doc-0:3.8-9.el6op.noarch",
"6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.src",
"6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygems-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.src",
"6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-json-doc-0:1.7.3-2.el6op.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-0256"
},
{
"category": "external",
"summary": "RHBZ#907820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=907820"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-0256",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0256"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0256",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0256"
},
{
"category": "external",
"summary": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/",
"url": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/"
}
],
"release_date": "2013-02-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-04-02T19:58:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.src",
"6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygems-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-json-doc-0:1.7.3-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.src",
"6Server-RHOSE-INFRA:rubygem-rdoc-doc-0:3.8-9.el6op.noarch",
"6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.src",
"6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygems-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.src",
"6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-json-doc-0:1.7.3-2.el6op.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0701"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.src",
"6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygems-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-json-doc-0:1.7.3-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.src",
"6Server-RHOSE-INFRA:rubygem-rdoc-doc-0:3.8-9.el6op.noarch",
"6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.src",
"6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygems-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.src",
"6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-json-doc-0:1.7.3-2.el6op.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template"
},
{
"acknowledgments": [
{
"names": [
"Ruby on Rails upstream"
]
},
{
"names": [
"Thomas Hollstegge"
],
"organization": "Zweitag",
"summary": "Acknowledged by upstream."
},
{
"names": [
"Ben Murphy"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2013-0269",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2013-02-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "909029"
}
],
"notes": [
{
"category": "description",
"text": "The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka \"Unsafe Object Creation Vulnerability.\"",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-json: Denial of Service and SQL Injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Satellite tools ship RubyGem Json 1.4.6 which is earlier than affected 1.5.5 version however, this version of RubyGem is not affected to the flaw. We may update RubyGem in a future release.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.src",
"6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygems-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-json-doc-0:1.7.3-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.src",
"6Server-RHOSE-INFRA:rubygem-rdoc-doc-0:3.8-9.el6op.noarch",
"6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.src",
"6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygems-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.src",
"6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-json-doc-0:1.7.3-2.el6op.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-0269"
},
{
"category": "external",
"summary": "RHBZ#909029",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=909029"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-0269",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0269"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0269",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0269"
},
{
"category": "external",
"summary": "http://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/",
"url": "http://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/"
}
],
"release_date": "2013-02-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-04-02T19:58:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.src",
"6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygems-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-json-doc-0:1.7.3-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.src",
"6Server-RHOSE-INFRA:rubygem-rdoc-doc-0:3.8-9.el6op.noarch",
"6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.src",
"6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygems-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.src",
"6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-json-doc-0:1.7.3-2.el6op.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0701"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.src",
"6Server-RHOSE-INFRA:ruby193-ruby-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64",
"6Server-RHOSE-INFRA:ruby193-rubygems-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-INFRA:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.src",
"6Server-RHOSE-INFRA:rubygem-json-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-INFRA:rubygem-json-doc-0:1.7.3-2.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.noarch",
"6Server-RHOSE-INFRA:rubygem-rdoc-0:3.8-9.el6op.src",
"6Server-RHOSE-INFRA:rubygem-rdoc-doc-0:3.8-9.el6op.noarch",
"6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.src",
"6Server-RHOSE-NODE:ruby193-ruby-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-debuginfo-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-devel-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-doc-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-irb-0:1.9.3.327-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-ruby-libs-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-ruby-tcltk-0:1.9.3.327-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-bigdecimal-0:1.1.0-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-io-console-0:0.3-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-json-0:1.5.4-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygem-minitest-0:2.5.1-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-rake-0:0.9.2.2-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygem-rdoc-0:3.9.4-28.el6.x86_64",
"6Server-RHOSE-NODE:ruby193-rubygems-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-NODE:ruby193-rubygems-devel-0:1.8.23-28.el6.noarch",
"6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.src",
"6Server-RHOSE-NODE:rubygem-json-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-json-debuginfo-0:1.7.3-2.el6op.x86_64",
"6Server-RHOSE-NODE:rubygem-json-doc-0:1.7.3-2.el6op.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-json: Denial of Service and SQL Injection"
}
]
}
rhsa-2013:1147
Vulnerability from csaf_redhat
Published
2013-08-08 17:04
Modified
2025-08-01 20:59
Summary
Red Hat Security Advisory: Red Hat JBoss SOA Platform 5.3.1 update
Notes
Topic
Red Hat JBoss SOA Platform 5.3.1 roll up patch 3, which fixes three
security issues and various bugs, is now available from the Red Hat
Customer Portal.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat JBoss SOA Platform is the next-generation ESB and business process
automation infrastructure. Red Hat JBoss SOA Platform allows IT to leverage
existing (MoM and EAI), modern (SOA and BPM-Rules), and future (EDA and
CEP) integration methodologies to dramatically improve business process
execution speed and quality.
This roll up patch serves as a cumulative upgrade for Red Hat JBoss SOA
Platform 5.3.1. It includes various bug fixes. The following security
issues are also fixed with this release:
The Jakarta Commons HttpClient component did not verify that the server
hostname matched the domain name in the subject's Common Name (CN) or
subjectAltName field in X.509 certificates. This could allow a
man-in-the-middle attacker to spoof an SSL server if they had a certificate
that was valid for any domain name. (CVE-2012-5783)
A flaw in JRuby's JSON gem allowed remote attacks by creating different
types of malicious objects. For example, it could initiate a denial of
service attack through resource consumption by using a JSON document to
create arbitrary Ruby symbols, which were never garbage collected. It could
also be exploited to create internal objects which could allow a SQL
injection attack. (CVE-2013-0269)
It was discovered that JRuby's REXML library did not properly restrict XML
entity expansion. An attacker could use this flaw to cause a denial of
service by tricking a Ruby application using REXML to read text nodes from
specially-crafted XML content, which will result in REXML consuming large
amounts of system memory. (CVE-2013-1821)
Note: Red Hat JBoss SOA Platform only provides JRuby as a dependency of
the scripting_chain quickstart example application. The CVE-2013-0269 and
CVE-2013-1821 flaws are not exposed unless the version of JRuby shipped
with that quickstart is used by a deployed, custom application.
Red Hat would like to thank Ruby on Rails upstream for reporting
CVE-2013-0269. Upstream acknowledges Thomas Hollstegge of Zweitag and Ben
Murphy as the original reporters of CVE-2013-0269.
Warning: Before applying the update, back up your existing Red Hat JBoss
SOA Platform installation (including its databases, applications,
configuration files, and so on).
All users of Red Hat JBoss SOA Platform 5.3.1 as provided from the Red
Hat Customer Portal are advised to apply this roll up patch.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat JBoss SOA Platform 5.3.1 roll up patch 3, which fixes three\nsecurity issues and various bugs, is now available from the Red Hat\nCustomer Portal.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat JBoss SOA Platform is the next-generation ESB and business process\nautomation infrastructure. Red Hat JBoss SOA Platform allows IT to leverage\nexisting (MoM and EAI), modern (SOA and BPM-Rules), and future (EDA and\nCEP) integration methodologies to dramatically improve business process\nexecution speed and quality.\n\nThis roll up patch serves as a cumulative upgrade for Red Hat JBoss SOA\nPlatform 5.3.1. It includes various bug fixes. The following security\nissues are also fixed with this release:\n\nThe Jakarta Commons HttpClient component did not verify that the server\nhostname matched the domain name in the subject\u0027s Common Name (CN) or\nsubjectAltName field in X.509 certificates. This could allow a\nman-in-the-middle attacker to spoof an SSL server if they had a certificate\nthat was valid for any domain name. (CVE-2012-5783)\n\nA flaw in JRuby\u0027s JSON gem allowed remote attacks by creating different\ntypes of malicious objects. For example, it could initiate a denial of\nservice attack through resource consumption by using a JSON document to\ncreate arbitrary Ruby symbols, which were never garbage collected. It could\nalso be exploited to create internal objects which could allow a SQL\ninjection attack. (CVE-2013-0269)\n\nIt was discovered that JRuby\u0027s REXML library did not properly restrict XML\nentity expansion. An attacker could use this flaw to cause a denial of\nservice by tricking a Ruby application using REXML to read text nodes from\nspecially-crafted XML content, which will result in REXML consuming large\namounts of system memory. (CVE-2013-1821)\n\nNote: Red Hat JBoss SOA Platform only provides JRuby as a dependency of\nthe scripting_chain quickstart example application. The CVE-2013-0269 and\nCVE-2013-1821 flaws are not exposed unless the version of JRuby shipped\nwith that quickstart is used by a deployed, custom application.\n\nRed Hat would like to thank Ruby on Rails upstream for reporting\nCVE-2013-0269. Upstream acknowledges Thomas Hollstegge of Zweitag and Ben\nMurphy as the original reporters of CVE-2013-0269.\n\nWarning: Before applying the update, back up your existing Red Hat JBoss\nSOA Platform installation (including its databases, applications,\nconfiguration files, and so on).\n\nAll users of Red Hat JBoss SOA Platform 5.3.1 as provided from the Red\nHat Customer Portal are advised to apply this roll up patch.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2013:1147",
"url": "https://access.redhat.com/errata/RHSA-2013:1147"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=soaplatform\u0026downloadType=securityPatches\u0026version=5.3.1+GA",
"url": "https://access.redhat.com/jbossnetwork/restricted/listSoftware.html?product=soaplatform\u0026downloadType=securityPatches\u0026version=5.3.1+GA"
},
{
"category": "external",
"summary": "873317",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=873317"
},
{
"category": "external",
"summary": "909029",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=909029"
},
{
"category": "external",
"summary": "914716",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=914716"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_1147.json"
}
],
"title": "Red Hat Security Advisory: Red Hat JBoss SOA Platform 5.3.1 update",
"tracking": {
"current_release_date": "2025-08-01T20:59:19+00:00",
"generator": {
"date": "2025-08-01T20:59:19+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.6.6"
}
},
"id": "RHSA-2013:1147",
"initial_release_date": "2013-08-08T17:04:00+00:00",
"revision_history": [
{
"date": "2013-08-08T17:04:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2013-08-08T17:07:08+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2025-08-01T20:59:19+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss SOA Platform 5.3",
"product": {
"name": "Red Hat JBoss SOA Platform 5.3",
"product_id": "Red Hat JBoss SOA Platform 5.3",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_soa_platform:5.3"
}
}
}
],
"category": "product_family",
"name": "Red Hat JBoss Middleware"
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2012-5783",
"discovery_date": "2012-11-04T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "873317"
}
],
"notes": [
{
"category": "description",
"text": "It was found that Apache Commons HttpClient 3.x, as used in Amazon Flexible Payments Service (FPS) merchant Java SDK and other products, does not verify that the server hostname matches a domain name in the subject\u0027s Common Name (CN) or subjectAltName field of the X.509 certificate, which allows man-in-the-middle attackers to spoof SSL servers via an arbitrary valid certificate.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss SOA Platform 5.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-5783"
},
{
"category": "external",
"summary": "RHBZ#873317",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=873317"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-5783",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-5783"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-5783",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-5783"
}
],
"release_date": "2012-10-16T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-08-08T17:04:00+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss SOA Platform installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss SOA Platform\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss SOA Platform server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss SOA Platform 5.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1147"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"cvss_v3": {
"attackComplexity": "HIGH",
"attackVector": "NETWORK",
"availabilityImpact": "NONE",
"baseScore": 3.7,
"baseSeverity": "LOW",
"confidentialityImpact": "NONE",
"integrityImpact": "LOW",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "NONE",
"vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N",
"version": "3.0"
},
"products": [
"Red Hat JBoss SOA Platform 5.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "jakarta-commons-httpclient: missing connection hostname check against X.509 certificate name"
},
{
"acknowledgments": [
{
"names": [
"Ruby on Rails upstream"
]
},
{
"names": [
"Thomas Hollstegge"
],
"organization": "Zweitag",
"summary": "Acknowledged by upstream."
},
{
"names": [
"Ben Murphy"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2013-0269",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2013-02-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "909029"
}
],
"notes": [
{
"category": "description",
"text": "The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka \"Unsafe Object Creation Vulnerability.\"",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-json: Denial of Service and SQL Injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Satellite tools ship RubyGem Json 1.4.6 which is earlier than affected 1.5.5 version however, this version of RubyGem is not affected to the flaw. We may update RubyGem in a future release.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss SOA Platform 5.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-0269"
},
{
"category": "external",
"summary": "RHBZ#909029",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=909029"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-0269",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0269"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0269",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0269"
},
{
"category": "external",
"summary": "http://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/",
"url": "http://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/"
}
],
"release_date": "2013-02-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-08-08T17:04:00+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss SOA Platform installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss SOA Platform\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss SOA Platform server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss SOA Platform 5.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1147"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss SOA Platform 5.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-json: Denial of Service and SQL Injection"
},
{
"cve": "CVE-2013-1821",
"discovery_date": "2013-02-22T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "914716"
}
],
"notes": [
{
"category": "description",
"text": "lib/rexml/text.rb in the REXML parser in Ruby before 1.9.3-p392 allows remote attackers to cause a denial of service (memory consumption and crash) via crafted text nodes in an XML document, aka an XML Entity Expansion (XEE) attack.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "ruby: entity expansion DoS vulnerability in REXML",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"Red Hat JBoss SOA Platform 5.3"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-1821"
},
{
"category": "external",
"summary": "RHBZ#914716",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=914716"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-1821",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-1821"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-1821",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1821"
},
{
"category": "external",
"summary": "http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/",
"url": "http://www.ruby-lang.org/en/news/2013/02/22/rexml-dos-2013-02-22/"
}
],
"release_date": "2013-02-22T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-08-08T17:04:00+00:00",
"details": "The References section of this erratum contains a download link (you must\nlog in to download the update). Before applying the update, back up your\nexisting Red Hat JBoss SOA Platform installation (including its\ndatabases, applications, configuration files, and so on).\n\nNote that it is recommended to halt the Red Hat JBoss SOA Platform\nserver by stopping the JBoss Application Server process before installing\nthis update, and then after installing the update, restart the Red Hat\nJBoss SOA Platform server by starting the JBoss Application Server\nprocess.",
"product_ids": [
"Red Hat JBoss SOA Platform 5.3"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:1147"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:N/A:P",
"version": "2.0"
},
"products": [
"Red Hat JBoss SOA Platform 5.3"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "ruby: entity expansion DoS vulnerability in REXML"
}
]
}
rhsa-2013:0686
Vulnerability from csaf_redhat
Published
2013-03-26 19:10
Modified
2024-11-22 06:54
Summary
Red Hat Security Advisory: Subscription Asset Manager 1.2.1 update
Notes
Topic
Red Hat Subscription Asset Manager 1.2.1, which fixes several security
issues, multiple bugs, and adds various enhancements, is now available.
The Red Hat Security Response Team has rated this update as having moderate
security impact. Common Vulnerability Scoring System (CVSS) base scores,
which give detailed severity ratings, are available for each vulnerability
from the CVE links in the References section.
Details
Red Hat Subscription Asset Manager acts as a proxy for handling
subscription information and software updates on client machines.
The latest packages for Subscription Asset Manager include a number of security fixes:
When a Subscription Asset Manager instance is created, its configuration
script automatically creates an RPM of the internal subscription service
CA certificate. However, this RPM incorrectly created the CA certificate
with file permissions of 0666. This allowed other users on a client system
to modify the CA certificate used to trust the remote subscription server.
All administrators are advised to update and deploy the subscription
service certificate on all systems which use Subscription Asset Manager
as their subscription service. This procedure is described in:
https://access.redhat.com/knowledge/docs/en-US/Red_Hat_Subscription_Asset_Manager/1.2/html/Installation_Guide/sect-Installation_Guide-Administration-Upgrading_Subscription_Asset_Manager.html
(CVE-2012-6116)
Manifest signature checking was not implemented for early versions of
Subscription Asset Manager. This meant that a malicious user could edit
a manifest file, insert arbitrary data, and successfully upload the edited
manifest file into the Subscription Asset Manager server. (CVE-2012-6119)
Ruby's documentation generator had a flaw in the way it generated HTML
documentation. When a Ruby application exposed its documentation
on a network (such as a web page), an attacker could use a specially-
crafted URL to open an arbitrary web script or to execute HTML code
within the application's user session. (CVE-2013-0256)
A timing attack flaw was found in the way rubygem-rack and
ruby193-rubygem-rack processed HMAC digests in cookies. This flaw could aid
an attacker using forged digital signatures to bypass authentication
checks. (CVE-2013-0263)
A flaw in rubygem-json allowed remote attacks by creating different types
of malicious objects. For example, it could initiate a denial of service
(DoS) attack through resource consumption by using a JSON document to
create arbitrary Ruby symbols, which were never garbage collected. It
could also be exploited to create internal objects which could allow a SQL
injection attack. (CVE-2013-0269)
A flaw in ActiveRecord in Ruby on Rails allowed remote attackers to
circumvent attribute protections and to insert their own crafted requests
to change protected attribute values. (CVE-2013-0276)
HTML markup was not properly escaped when filling in the username field in
the Notifications form of the Subscription Asset Manager UI. This meant
that HTML code used in the value was then applied in the UI page when the
entry was viewed. This could have allowed malicious HTML code to be
entered. The field value is now validated and any HTML tags are escaped.
(CVE-2013-1823)
These updated packages also include bug fixes and enhancements:
* Previously, no SELinux policy for the subscription service was included
with the Subscription Asset Manager packages. The candlepin-selinux package
is now included with SELinux policies for the subscription server.
(BZ#906901)
* When attempting to use the subscription service's CA certificate to
validate a manifest during import, the comparison failed. The upstream
subscription service which generated the manifest is a different service
than the local subscription service; thus, they have different CA
certificates. This caused importing a manifest to fail with the error
'archive failed signature'. This has been fixed so that the proper
certificate is used for verification. (BZ#918778)
All users of Subscription Asset Manager are recommended to update to the
latest packages.
Terms of Use
This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.
{
"document": {
"aggregate_severity": {
"namespace": "https://access.redhat.com/security/updates/classification/",
"text": "Moderate"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Copyright \u00a9 Red Hat, Inc. All rights reserved.",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en",
"notes": [
{
"category": "summary",
"text": "Red Hat Subscription Asset Manager 1.2.1, which fixes several security\nissues, multiple bugs, and adds various enhancements, is now available.\n\nThe Red Hat Security Response Team has rated this update as having moderate\nsecurity impact. Common Vulnerability Scoring System (CVSS) base scores,\nwhich give detailed severity ratings, are available for each vulnerability\nfrom the CVE links in the References section.",
"title": "Topic"
},
{
"category": "general",
"text": "Red Hat Subscription Asset Manager acts as a proxy for handling\nsubscription information and software updates on client machines.\n\nThe latest packages for Subscription Asset Manager include a number of security fixes:\n\nWhen a Subscription Asset Manager instance is created, its configuration\nscript automatically creates an RPM of the internal subscription service \nCA certificate. However, this RPM incorrectly created the CA certificate\nwith file permissions of 0666. This allowed other users on a client system\nto modify the CA certificate used to trust the remote subscription server.\nAll administrators are advised to update and deploy the subscription\nservice certificate on all systems which use Subscription Asset Manager\nas their subscription service. This procedure is described in:\nhttps://access.redhat.com/knowledge/docs/en-US/Red_Hat_Subscription_Asset_Manager/1.2/html/Installation_Guide/sect-Installation_Guide-Administration-Upgrading_Subscription_Asset_Manager.html\n(CVE-2012-6116)\n\nManifest signature checking was not implemented for early versions of \nSubscription Asset Manager. This meant that a malicious user could edit\na manifest file, insert arbitrary data, and successfully upload the edited\nmanifest file into the Subscription Asset Manager server. (CVE-2012-6119)\n\nRuby\u0027s documentation generator had a flaw in the way it generated HTML\ndocumentation. When a Ruby application exposed its documentation\non a network (such as a web page), an attacker could use a specially-\ncrafted URL to open an arbitrary web script or to execute HTML code\nwithin the application\u0027s user session. (CVE-2013-0256)\n\nA timing attack flaw was found in the way rubygem-rack and\nruby193-rubygem-rack processed HMAC digests in cookies. This flaw could aid\nan attacker using forged digital signatures to bypass authentication\nchecks. (CVE-2013-0263)\n\nA flaw in rubygem-json allowed remote attacks by creating different types\nof malicious objects. For example, it could initiate a denial of service\n(DoS) attack through resource consumption by using a JSON document to\ncreate arbitrary Ruby symbols, which were never garbage collected. It\ncould also be exploited to create internal objects which could allow a SQL\ninjection attack. (CVE-2013-0269)\n\nA flaw in ActiveRecord in Ruby on Rails allowed remote attackers to\ncircumvent attribute protections and to insert their own crafted requests\nto change protected attribute values. (CVE-2013-0276)\n\nHTML markup was not properly escaped when filling in the username field in\nthe Notifications form of the Subscription Asset Manager UI. This meant\nthat HTML code used in the value was then applied in the UI page when the\nentry was viewed. This could have allowed malicious HTML code to be\nentered. The field value is now validated and any HTML tags are escaped.\n(CVE-2013-1823)\n\nThese updated packages also include bug fixes and enhancements:\n\n* Previously, no SELinux policy for the subscription service was included\nwith the Subscription Asset Manager packages. The candlepin-selinux package\nis now included with SELinux policies for the subscription server. \n(BZ#906901)\n\n* When attempting to use the subscription service\u0027s CA certificate to\nvalidate a manifest during import, the comparison failed. The upstream\nsubscription service which generated the manifest is a different service\nthan the local subscription service; thus, they have different CA\ncertificates. This caused importing a manifest to fail with the error\n\u0027archive failed signature\u0027. This has been fixed so that the proper\ncertificate is used for verification. (BZ#918778)\n\nAll users of Subscription Asset Manager are recommended to update to the\nlatest packages.",
"title": "Details"
},
{
"category": "legal_disclaimer",
"text": "This content is licensed under the Creative Commons Attribution 4.0 International License (https://creativecommons.org/licenses/by/4.0/). If you distribute this content, or a modified version of it, you must provide attribution to Red Hat Inc. and provide a link to the original.",
"title": "Terms of Use"
}
],
"publisher": {
"category": "vendor",
"contact_details": "https://access.redhat.com/security/team/contact/",
"issuing_authority": "Red Hat Product Security is responsible for vulnerability handling across all Red Hat products and services.",
"name": "Red Hat Product Security",
"namespace": "https://www.redhat.com"
},
"references": [
{
"category": "self",
"summary": "https://access.redhat.com/errata/RHSA-2013:0686",
"url": "https://access.redhat.com/errata/RHSA-2013:0686"
},
{
"category": "external",
"summary": "https://access.redhat.com/security/updates/classification/#moderate",
"url": "https://access.redhat.com/security/updates/classification/#moderate"
},
{
"category": "external",
"summary": "906207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=906207"
},
{
"category": "external",
"summary": "906901",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=906901"
},
{
"category": "external",
"summary": "907820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=907820"
},
{
"category": "external",
"summary": "908613",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=908613"
},
{
"category": "external",
"summary": "909029",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=909029"
},
{
"category": "external",
"summary": "909071",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=909071"
},
{
"category": "external",
"summary": "909528",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=909528"
},
{
"category": "external",
"summary": "918778",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=918778"
},
{
"category": "external",
"summary": "918784",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=918784"
},
{
"category": "external",
"summary": "922190",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=922190"
},
{
"category": "self",
"summary": "Canonical URL",
"url": "https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0686.json"
}
],
"title": "Red Hat Security Advisory: Subscription Asset Manager 1.2.1 update",
"tracking": {
"current_release_date": "2024-11-22T06:54:39+00:00",
"generator": {
"date": "2024-11-22T06:54:39+00:00",
"engine": {
"name": "Red Hat SDEngine",
"version": "4.2.1"
}
},
"id": "RHSA-2013:0686",
"initial_release_date": "2013-03-26T19:10:00+00:00",
"revision_history": [
{
"date": "2013-03-26T19:10:00+00:00",
"number": "1",
"summary": "Initial version"
},
{
"date": "2013-03-26T19:16:44+00:00",
"number": "2",
"summary": "Last updated version"
},
{
"date": "2024-11-22T06:54:39+00:00",
"number": "3",
"summary": "Last generated version"
}
],
"status": "final",
"version": "3"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Subscription Asset Manager for RHEL 6 Server",
"product": {
"name": "Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12",
"product_identification_helper": {
"cpe": "cpe:/a:rhel_sam:1.2::el6"
}
}
}
],
"category": "product_family",
"name": "Red Hat Subscription Asset Manager"
},
{
"branches": [
{
"category": "product_version",
"name": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"product": {
"name": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"product_id": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-rails_warden-doc@0.5.5-2.el6cf?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"product": {
"name": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"product_id": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-rails_warden@0.5.5-2.el6cf?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"product": {
"name": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"product_id": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-delayed_job@2.1.4-3.el6cf?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"product": {
"name": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"product_id": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-delayed_job-doc@2.1.4-3.el6cf?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"product": {
"name": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"product_id": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri-doc@1.5.0-0.9.beta4.el6cf?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"product": {
"name": "rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"product_id": "rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-actionpack@3.0.10-12.el6cf?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "candlepin-0:0.7.24-1.el6_3.noarch",
"product": {
"name": "candlepin-0:0.7.24-1.el6_3.noarch",
"product_id": "candlepin-0:0.7.24-1.el6_3.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/candlepin@0.7.24-1.el6_3?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"product": {
"name": "candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"product_id": "candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/candlepin-tomcat6@0.7.24-1.el6_3?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"product": {
"name": "candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"product_id": "candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/candlepin-selinux@0.7.24-1.el6_3?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "candlepin-devel-0:0.7.24-1.el6_3.noarch",
"product": {
"name": "candlepin-devel-0:0.7.24-1.el6_3.noarch",
"product_id": "candlepin-devel-0:0.7.24-1.el6_3.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/candlepin-devel@0.7.24-1.el6_3?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-rack-1:1.3.0-4.el6cf.noarch",
"product": {
"name": "rubygem-rack-1:1.3.0-4.el6cf.noarch",
"product_id": "rubygem-rack-1:1.3.0-4.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-rack@1.3.0-4.el6cf?arch=noarch\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"product": {
"name": "rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"product_id": "rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-activemodel-doc@3.0.10-3.el6cf?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"product": {
"name": "rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"product_id": "rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-activemodel@3.0.10-3.el6cf?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"product": {
"name": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"product_id": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-rdoc-doc@3.8-6.el6cf?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "rubygem-rdoc-0:3.8-6.el6cf.noarch",
"product": {
"name": "rubygem-rdoc-0:3.8-6.el6cf.noarch",
"product_id": "rubygem-rdoc-0:3.8-6.el6cf.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-rdoc@3.8-6.el6cf?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"product": {
"name": "katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"product_id": "katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/katello-headpin@1.2.1.1-1h.el6_4?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"product": {
"name": "katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"product_id": "katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/katello-glue-candlepin@1.2.1.1-1h.el6_4?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "katello-common-0:1.2.1.1-1h.el6_4.noarch",
"product": {
"name": "katello-common-0:1.2.1.1-1h.el6_4.noarch",
"product_id": "katello-common-0:1.2.1.1-1h.el6_4.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/katello-common@1.2.1.1-1h.el6_4?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"product": {
"name": "katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"product_id": "katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/katello-headpin-all@1.2.1.1-1h.el6_4?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "thumbslug-0:0.0.28.1-1.el6_4.noarch",
"product": {
"name": "thumbslug-0:0.0.28.1-1.el6_4.noarch",
"product_id": "thumbslug-0:0.0.28.1-1.el6_4.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thumbslug@0.0.28.1-1.el6_4?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch",
"product": {
"name": "thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch",
"product_id": "thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thumbslug-selinux@0.0.28.1-1.el6_4?arch=noarch"
}
}
},
{
"category": "product_version",
"name": "katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"product": {
"name": "katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"product_id": "katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/katello-configure@1.2.3.1-4h.el6_4?arch=noarch"
}
}
}
],
"category": "architecture",
"name": "noarch"
},
{
"branches": [
{
"category": "product_version",
"name": "rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"product": {
"name": "rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"product_id": "rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-rails_warden@0.5.5-2.el6cf?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"product": {
"name": "rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"product_id": "rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-delayed_job@2.1.4-3.el6cf?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"product": {
"name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"product_id": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri@1.5.0-0.9.beta4.el6cf?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-actionpack-1:3.0.10-12.el6cf.src",
"product": {
"name": "rubygem-actionpack-1:3.0.10-12.el6cf.src",
"product_id": "rubygem-actionpack-1:3.0.10-12.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-actionpack@3.0.10-12.el6cf?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "candlepin-0:0.7.24-1.el6_3.src",
"product": {
"name": "candlepin-0:0.7.24-1.el6_3.src",
"product_id": "candlepin-0:0.7.24-1.el6_3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/candlepin@0.7.24-1.el6_3?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-rack-1:1.3.0-4.el6cf.src",
"product": {
"name": "rubygem-rack-1:1.3.0-4.el6cf.src",
"product_id": "rubygem-rack-1:1.3.0-4.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-rack@1.3.0-4.el6cf?arch=src\u0026epoch=1"
}
}
},
{
"category": "product_version",
"name": "rubygem-activemodel-0:3.0.10-3.el6cf.src",
"product": {
"name": "rubygem-activemodel-0:3.0.10-3.el6cf.src",
"product_id": "rubygem-activemodel-0:3.0.10-3.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-activemodel@3.0.10-3.el6cf?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-rdoc-0:3.8-6.el6cf.src",
"product": {
"name": "rubygem-rdoc-0:3.8-6.el6cf.src",
"product_id": "rubygem-rdoc-0:3.8-6.el6cf.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-rdoc@3.8-6.el6cf?arch=src"
}
}
},
{
"category": "product_version",
"name": "katello-0:1.2.1.1-1h.el6_4.src",
"product": {
"name": "katello-0:1.2.1.1-1h.el6_4.src",
"product_id": "katello-0:1.2.1.1-1h.el6_4.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/katello@1.2.1.1-1h.el6_4?arch=src"
}
}
},
{
"category": "product_version",
"name": "rubygem-json-0:1.7.3-2.el6_3.src",
"product": {
"name": "rubygem-json-0:1.7.3-2.el6_3.src",
"product_id": "rubygem-json-0:1.7.3-2.el6_3.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-json@1.7.3-2.el6_3?arch=src"
}
}
},
{
"category": "product_version",
"name": "thumbslug-0:0.0.28.1-1.el6_4.src",
"product": {
"name": "thumbslug-0:0.0.28.1-1.el6_4.src",
"product_id": "thumbslug-0:0.0.28.1-1.el6_4.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/thumbslug@0.0.28.1-1.el6_4?arch=src"
}
}
},
{
"category": "product_version",
"name": "katello-configure-0:1.2.3.1-4h.el6_4.src",
"product": {
"name": "katello-configure-0:1.2.3.1-4h.el6_4.src",
"product_id": "katello-configure-0:1.2.3.1-4h.el6_4.src",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/katello-configure@1.2.3.1-4h.el6_4?arch=src"
}
}
}
],
"category": "architecture",
"name": "src"
},
{
"branches": [
{
"category": "product_version",
"name": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"product": {
"name": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"product_id": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri-debuginfo@1.5.0-0.9.beta4.el6cf?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"product": {
"name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"product_id": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-nokogiri@1.5.0-0.9.beta4.el6cf?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"product": {
"name": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"product_id": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/ruby-nokogiri@1.5.0-0.9.beta4.el6cf?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"product": {
"name": "rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"product_id": "rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-json-debuginfo@1.7.3-2.el6_3?arch=x86_64"
}
}
},
{
"category": "product_version",
"name": "rubygem-json-0:1.7.3-2.el6_3.x86_64",
"product": {
"name": "rubygem-json-0:1.7.3-2.el6_3.x86_64",
"product_id": "rubygem-json-0:1.7.3-2.el6_3.x86_64",
"product_identification_helper": {
"purl": "pkg:rpm/redhat/rubygem-json@1.7.3-2.el6_3?arch=x86_64"
}
}
}
],
"category": "architecture",
"name": "x86_64"
}
],
"category": "vendor",
"name": "Red Hat"
}
],
"relationships": [
{
"category": "default_component_of",
"full_product_name": {
"name": "candlepin-0:0.7.24-1.el6_3.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch"
},
"product_reference": "candlepin-0:0.7.24-1.el6_3.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "candlepin-0:0.7.24-1.el6_3.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src"
},
"product_reference": "candlepin-0:0.7.24-1.el6_3.src",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "candlepin-devel-0:0.7.24-1.el6_3.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch"
},
"product_reference": "candlepin-devel-0:0.7.24-1.el6_3.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "candlepin-selinux-0:0.7.24-1.el6_3.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch"
},
"product_reference": "candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "candlepin-tomcat6-0:0.7.24-1.el6_3.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch"
},
"product_reference": "candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "katello-0:1.2.1.1-1h.el6_4.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src"
},
"product_reference": "katello-0:1.2.1.1-1h.el6_4.src",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "katello-common-0:1.2.1.1-1h.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch"
},
"product_reference": "katello-common-0:1.2.1.1-1h.el6_4.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "katello-configure-0:1.2.3.1-4h.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch"
},
"product_reference": "katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "katello-configure-0:1.2.3.1-4h.el6_4.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src"
},
"product_reference": "katello-configure-0:1.2.3.1-4h.el6_4.src",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch"
},
"product_reference": "katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "katello-headpin-0:1.2.1.1-1h.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch"
},
"product_reference": "katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch"
},
"product_reference": "katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64 as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64"
},
"product_reference": "ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-actionpack-1:3.0.10-12.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch"
},
"product_reference": "rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-actionpack-1:3.0.10-12.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src"
},
"product_reference": "rubygem-actionpack-1:3.0.10-12.el6cf.src",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activemodel-0:3.0.10-3.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch"
},
"product_reference": "rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activemodel-0:3.0.10-3.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src"
},
"product_reference": "rubygem-activemodel-0:3.0.10-3.el6cf.src",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch"
},
"product_reference": "rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch"
},
"product_reference": "rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-delayed_job-0:2.1.4-3.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src"
},
"product_reference": "rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch"
},
"product_reference": "rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-json-0:1.7.3-2.el6_3.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src"
},
"product_reference": "rubygem-json-0:1.7.3-2.el6_3.src",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-json-0:1.7.3-2.el6_3.x86_64 as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64"
},
"product_reference": "rubygem-json-0:1.7.3-2.el6_3.x86_64",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64 as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64"
},
"product_reference": "rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src"
},
"product_reference": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64 as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64"
},
"product_reference": "rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64 as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64"
},
"product_reference": "rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch"
},
"product_reference": "rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-rack-1:1.3.0-4.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch"
},
"product_reference": "rubygem-rack-1:1.3.0-4.el6cf.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-rack-1:1.3.0-4.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src"
},
"product_reference": "rubygem-rack-1:1.3.0-4.el6cf.src",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch"
},
"product_reference": "rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-rails_warden-0:0.5.5-2.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src"
},
"product_reference": "rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch"
},
"product_reference": "rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-rdoc-0:3.8-6.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch"
},
"product_reference": "rubygem-rdoc-0:3.8-6.el6cf.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-rdoc-0:3.8-6.el6cf.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src"
},
"product_reference": "rubygem-rdoc-0:3.8-6.el6cf.src",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch"
},
"product_reference": "rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thumbslug-0:0.0.28.1-1.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch"
},
"product_reference": "thumbslug-0:0.0.28.1-1.el6_4.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thumbslug-0:0.0.28.1-1.el6_4.src as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src"
},
"product_reference": "thumbslug-0:0.0.28.1-1.el6_4.src",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
},
{
"category": "default_component_of",
"full_product_name": {
"name": "thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch as a component of Red Hat Subscription Asset Manager for RHEL 6 Server",
"product_id": "6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
},
"product_reference": "thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch",
"relates_to_product_reference": "6Server-SubscriptionAssetManager12"
}
]
},
"vulnerabilities": [
{
"acknowledgments": [
{
"names": [
"Dominic Cleal"
]
},
{
"names": [
"James Laska"
],
"organization": "Red Hat",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2012-6116",
"discovery_date": "2012-11-16T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "906207"
}
],
"notes": [
{
"category": "description",
"text": "modules/certs/manifests/config.pp in katello-configure before 1.3.3.pulpv2 in Katello uses weak permissions (666) for the Candlepin bootstrap RPM, which allows local users to modify the Candlepin CA certificate by writing to this file.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Candlepin: bootstrap RPM deploys CA certificate file with mode 666",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
"6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
"6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-6116"
},
{
"category": "external",
"summary": "RHBZ#906207",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=906207"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-6116",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6116"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6116",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6116"
}
],
"release_date": "2013-02-21T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-03-26T19:10:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
"6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
"6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0686"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "LOCAL",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 4.6,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:L/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
"6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
"6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Candlepin: bootstrap RPM deploys CA certificate file with mode 666"
},
{
"cve": "CVE-2012-6119",
"discovery_date": "2013-02-01T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "908613"
}
],
"notes": [
{
"category": "description",
"text": "Candlepin before 0.7.24, as used in Red Hat Subscription Asset Manager before 1.2.1, does not properly check manifest signatures, which allows local users to modify manifests.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Candlepin: Re-enable manifest signature checking",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
"6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
"6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2012-6119"
},
{
"category": "external",
"summary": "RHBZ#908613",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=908613"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2012-6119",
"url": "https://www.cve.org/CVERecord?id=CVE-2012-6119"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2012-6119",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2012-6119"
}
],
"release_date": "2012-06-27T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-03-26T19:10:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
"6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
"6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0686"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "SINGLE",
"availabilityImpact": "NONE",
"baseScore": 4.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:S/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
"6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
"6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "Candlepin: Re-enable manifest signature checking"
},
{
"acknowledgments": [
{
"names": [
"Eric Hodel"
],
"organization": "RDoc upstream"
},
{
"names": [
"Evgeny Ermakov"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2013-0256",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2013-02-05T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "907820"
}
],
"notes": [
{
"category": "description",
"text": "darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
"6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
"6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-0256"
},
{
"category": "external",
"summary": "RHBZ#907820",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=907820"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-0256",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0256"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0256",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0256"
},
{
"category": "external",
"summary": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/",
"url": "http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/"
}
],
"release_date": "2013-02-06T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-03-26T19:10:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
"6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
"6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0686"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
"6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
"6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-rdoc: Cross-site scripting in the documentation created by Darkfish Rdoc HTML generator / template"
},
{
"cve": "CVE-2013-0263",
"discovery_date": "2013-02-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "909071"
}
],
"notes": [
{
"category": "description",
"text": "Rack::Session::Cookie in Rack 1.5.x before 1.5.2, 1.4.x before 1.4.5, 1.3.x before 1.3.10, 1.2.x before 1.2.8, and 1.1.x before 1.1.6 allows remote attackers to guess the session cookie, gain privileges, and execute arbitrary code via a timing attack involving an HMAC comparison function that does not run in constant time.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-rack: Timing attack in cookie sessions",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
"6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
"6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-0263"
},
{
"category": "external",
"summary": "RHBZ#909071",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=909071"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-0263",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0263"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0263",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0263"
}
],
"release_date": "2013-02-08T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-03-26T19:10:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
"6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
"6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0686"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "NONE",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N",
"version": "2.0"
},
"products": [
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
"6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
"6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-rack: Timing attack in cookie sessions"
},
{
"acknowledgments": [
{
"names": [
"Ruby on Rails upstream"
]
},
{
"names": [
"Thomas Hollstegge"
],
"organization": "Zweitag",
"summary": "Acknowledged by upstream."
},
{
"names": [
"Ben Murphy"
],
"summary": "Acknowledged by upstream."
}
],
"cve": "CVE-2013-0269",
"cwe": {
"id": "CWE-502",
"name": "Deserialization of Untrusted Data"
},
"discovery_date": "2013-02-07T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "909029"
}
],
"notes": [
{
"category": "description",
"text": "The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka \"Unsafe Object Creation Vulnerability.\"",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-json: Denial of Service and SQL Injection",
"title": "Vulnerability summary"
},
{
"category": "other",
"text": "Red Hat Satellite tools ship RubyGem Json 1.4.6 which is earlier than affected 1.5.5 version however, this version of RubyGem is not affected to the flaw. We may update RubyGem in a future release.",
"title": "Statement"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
"6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
"6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-0269"
},
{
"category": "external",
"summary": "RHBZ#909029",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=909029"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-0269",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0269"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0269",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0269"
},
{
"category": "external",
"summary": "http://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/",
"url": "http://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/"
}
],
"release_date": "2013-02-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-03-26T19:10:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
"6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
"6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0686"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"products": [
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
"6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
"6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-json: Denial of Service and SQL Injection"
},
{
"cve": "CVE-2013-0276",
"discovery_date": "2013-02-08T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "909528"
}
],
"notes": [
{
"category": "description",
"text": "ActiveRecord in Ruby on Rails before 2.3.17, 3.1.x before 3.1.11, and 3.2.x before 3.2.12 allows remote attackers to bypass the attr_protected protection mechanism and modify protected model attributes via a crafted request.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "rubygem-activerecord/rubygem-activemodel: circumvention of attr_protected",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
"6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
"6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-0276"
},
{
"category": "external",
"summary": "RHBZ#909528",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=909528"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-0276",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-0276"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-0276",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0276"
}
],
"release_date": "2013-02-11T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-03-26T19:10:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
"6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
"6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0686"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 5.0,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
"6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
"6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Moderate"
}
],
"title": "rubygem-activerecord/rubygem-activemodel: circumvention of attr_protected"
},
{
"acknowledgments": [
{
"names": [
"Sureshkumar Thirugnanasambandan"
],
"organization": "Red Hat Quality Engineering Team",
"summary": "This issue was discovered by Red Hat."
}
],
"cve": "CVE-2013-1823",
"cwe": {
"id": "CWE-79",
"name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
},
"discovery_date": "2013-02-12T00:00:00+00:00",
"ids": [
{
"system_name": "Red Hat Bugzilla ID",
"text": "918784"
}
],
"notes": [
{
"category": "description",
"text": "Cross-site scripting (XSS) vulnerability in the Notifications form in Red Hat Subscription Asset Manager before 1.2.1 allows remote attackers to inject arbitrary web script or HTML via the username field.",
"title": "Vulnerability description"
},
{
"category": "summary",
"text": "Katello: Notifications page Username XSS",
"title": "Vulnerability summary"
},
{
"category": "general",
"text": "The CVSS score(s) listed for this vulnerability do not reflect the associated product\u0027s status, and are included for informational purposes to better understand the severity of this vulnerability.",
"title": "CVSS score applicability"
}
],
"product_status": {
"fixed": [
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
"6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
"6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
]
},
"references": [
{
"category": "self",
"summary": "Canonical URL",
"url": "https://access.redhat.com/security/cve/CVE-2013-1823"
},
{
"category": "external",
"summary": "RHBZ#918784",
"url": "https://bugzilla.redhat.com/show_bug.cgi?id=918784"
},
{
"category": "external",
"summary": "https://www.cve.org/CVERecord?id=CVE-2013-1823",
"url": "https://www.cve.org/CVERecord?id=CVE-2013-1823"
},
{
"category": "external",
"summary": "https://nvd.nist.gov/vuln/detail/CVE-2013-1823",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-1823"
}
],
"release_date": "2013-03-26T00:00:00+00:00",
"remediations": [
{
"category": "vendor_fix",
"date": "2013-03-26T19:10:00+00:00",
"details": "Before applying this update, make sure all previously-released errata\nrelevant to your system have been applied.\n\nThis update is available via the Red Hat Network. Details on how to\nuse the Red Hat Network to apply this update are available at\nhttps://access.redhat.com/knowledge/articles/11258",
"product_ids": [
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
"6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
"6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
],
"restart_required": {
"category": "none"
},
"url": "https://access.redhat.com/errata/RHSA-2013:0686"
}
],
"scores": [
{
"cvss_v2": {
"accessComplexity": "MEDIUM",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "NONE",
"baseScore": 4.3,
"confidentialityImpact": "NONE",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N",
"version": "2.0"
},
"products": [
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-0:0.7.24-1.el6_3.src",
"6Server-SubscriptionAssetManager12:candlepin-devel-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-selinux-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:candlepin-tomcat6-0:0.7.24-1.el6_3.noarch",
"6Server-SubscriptionAssetManager12:katello-0:1.2.1.1-1h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-common-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-configure-0:1.2.3.1-4h.el6_4.src",
"6Server-SubscriptionAssetManager12:katello-glue-candlepin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:katello-headpin-all-0:1.2.1.1-1h.el6_4.noarch",
"6Server-SubscriptionAssetManager12:ruby-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-actionpack-1:3.0.10-12.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-0:3.0.10-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-activemodel-doc-0:3.0.10-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-0:2.1.4-3.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-delayed_job-doc-0:2.1.4-3.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.src",
"6Server-SubscriptionAssetManager12:rubygem-json-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-json-debuginfo-0:1.7.3-2.el6_3.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-debuginfo-0:1.5.0-0.9.beta4.el6cf.x86_64",
"6Server-SubscriptionAssetManager12:rubygem-nokogiri-doc-0:1.5.0-0.9.beta4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rack-1:1.3.0-4.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-0:0.5.5-2.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rails_warden-doc-0:0.5.5-2.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-0:3.8-6.el6cf.src",
"6Server-SubscriptionAssetManager12:rubygem-rdoc-doc-0:3.8-6.el6cf.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.noarch",
"6Server-SubscriptionAssetManager12:thumbslug-0:0.0.28.1-1.el6_4.src",
"6Server-SubscriptionAssetManager12:thumbslug-selinux-0:0.0.28.1-1.el6_4.noarch"
]
}
],
"threats": [
{
"category": "impact",
"details": "Low"
}
],
"title": "Katello: Notifications page Username XSS"
}
]
}
wid-sec-w-2023-1601
Vulnerability from csaf_certbund
Published
2013-08-08 22:00
Modified
2023-06-29 22:00
Summary
Red Hat JBoss Enterprise SOA Platform: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
JBoss Enterprise SOA Platform ist eine Infrastruktur zur Automatisierung von ESB und Businessprozessen.
Angriff
Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise SOA Platform ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen zu manipulieren oder um einen Denial of Service Angriff durchzuführen.
Betroffene Betriebssysteme
- Linux
{
"document": {
"aggregate_severity": {
"text": "mittel"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "JBoss Enterprise SOA Platform ist eine Infrastruktur zur Automatisierung von ESB und Businessprozessen.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer Angreifer kann mehrere Schwachstellen in Red Hat JBoss Enterprise SOA Platform ausnutzen, um Sicherheitsvorkehrungen zu umgehen, um Informationen zu manipulieren oder um einen Denial of Service Angriff durchzuf\u00fchren.",
"title": "Angriff"
},
{
"category": "general",
"text": "- Linux",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2023-1601 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2013/wid-sec-w-2023-1601.json"
},
{
"category": "self",
"summary": "WID-SEC-2023-1601 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-1601"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2023:3954 vom 2023-06-29",
"url": "https://access.redhat.com/errata/RHSA-2023:3954"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2013:1147-1 vom 2013-08-08",
"url": "https://rhn.redhat.com/errata/RHSA-2013-1147.html"
},
{
"category": "external",
"summary": "Debian Security Advisory DSA-2738-1 vom 2013-08-19",
"url": "http://www.debian.org/security/2013/dsa-2738"
},
{
"category": "external",
"summary": "RedHat Security Advisory RHSA-2013-1185 vom 2013-08-29",
"url": "https://rhn.redhat.com/errata/RHSA-2013-1185.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2014:1834-1 vom 2014-11-10",
"url": "http://rhn.redhat.com/errata/RHSA-2014-1834.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2014:1833-1 vom 2014-11-10",
"url": "http://rhn.redhat.com/errata/RHSA-2014-1833.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2014:2019-1 vom 2014-12-18",
"url": "http://rhn.redhat.com/errata/RHSA-2014-2019.html"
},
{
"category": "external",
"summary": "Red Hat Security Advisory RHSA-2017:0868 vom 2017-04-04",
"url": "https://access.redhat.com/errata/RHSA-2017:0868"
}
],
"source_lang": "en-US",
"title": "Red Hat JBoss Enterprise SOA Platform: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2023-06-29T22:00:00.000+00:00",
"generator": {
"date": "2024-08-15T17:53:55.866+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.5"
}
},
"id": "WID-SEC-W-2023-1601",
"initial_release_date": "2013-08-08T22:00:00.000+00:00",
"revision_history": [
{
"date": "2013-08-08T22:00:00.000+00:00",
"number": "1",
"summary": "Initial Release"
},
{
"date": "2013-08-08T22:00:00.000+00:00",
"number": "2",
"summary": "Version nicht vorhanden"
},
{
"date": "2013-08-19T22:00:00.000+00:00",
"number": "3",
"summary": "New remediations available"
},
{
"date": "2013-08-29T22:00:00.000+00:00",
"number": "4",
"summary": "New remediations available"
},
{
"date": "2014-11-10T23:00:00.000+00:00",
"number": "5",
"summary": "New remediations available"
},
{
"date": "2014-12-18T23:00:00.000+00:00",
"number": "6",
"summary": "New remediations available"
},
{
"date": "2014-12-18T23:00:00.000+00:00",
"number": "7",
"summary": "Version nicht vorhanden"
},
{
"date": "2017-04-03T22:00:00.000+00:00",
"number": "8",
"summary": "New remediations available"
},
{
"date": "2023-06-29T22:00:00.000+00:00",
"number": "9",
"summary": "Neue Updates von Red Hat aufgenommen"
}
],
"status": "final",
"version": "9"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Red Hat Enterprise Linux",
"product": {
"name": "Red Hat Enterprise Linux",
"product_id": "67646",
"product_identification_helper": {
"cpe": "cpe:/o:redhat:enterprise_linux:-"
}
}
},
{
"branches": [
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Application Platform 6 EL5",
"product": {
"name": "Red Hat JBoss Enterprise Application Platform 6 EL5",
"product_id": "T001224",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6:el5"
}
}
},
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise Application Platform 6 EL6",
"product": {
"name": "Red Hat JBoss Enterprise Application Platform 6 EL6",
"product_id": "T001225",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_application_platform:6:el6"
}
}
}
],
"category": "product_name",
"name": "JBoss Enterprise Application Platform"
},
{
"category": "product_name",
"name": "Red Hat JBoss Enterprise SOA Platform 5.3.1",
"product": {
"name": "Red Hat JBoss Enterprise SOA Platform 5.3.1",
"product_id": "198379",
"product_identification_helper": {
"cpe": "cpe:/a:redhat:jboss_enterprise_soa_platform:5.3.1"
}
}
}
],
"category": "vendor",
"name": "Red Hat"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2012-5783",
"notes": [
{
"category": "description",
"text": "Es besteht eine Schwachstelle bez\u00fcglich der \u00dcberpr\u00fcfung von SSL Zertifikaten in der Jakarta Commons HttpClient Komponente. Diese Schwachstelle wird dadurch verursacht, dass betroffene Software den Hostnamen des Servers nicht mit dem Domainnamen aus dem Common Name (CN) oder \"SubjectAltName\" Feld des X.509 Zertifikates abgleicht. Ein entfernter, anonymer Angreifer kann diese Schwachstelle mittels eines man-in-the-middle Angriffs ausnutzen, um Sicherheitsfunktionen zu umgehen und um einen Benutzer zu t\u00e4uschen, dass er sich auf einer vertrauten Internetseite befindet. F\u00fcr die Ausnutzung dieser Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"67646",
"T001225",
"T001224",
"198379"
]
},
"release_date": "2013-08-08T22:00:00.000+00:00",
"title": "CVE-2012-5783"
},
{
"cve": "CVE-2013-0269",
"notes": [
{
"category": "description",
"text": "Es existiert eine Schwachstelle in \"JSON gem\" welches mit Red Hat JBoss SOA Platform. Diese Schwachstelle tritt w\u00e4hrend der Verarbeitung speziell manipulierter JSON Dokumente auf. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um beliebigen SQL-Code zu injizieren, um einen Denial of Service herbeizuf\u00fchren oder um Sicherheitsfunktionen zu umgehen."
}
],
"product_status": {
"known_affected": [
"198379"
]
},
"release_date": "2013-08-08T22:00:00.000+00:00",
"title": "CVE-2013-0269"
},
{
"cve": "CVE-2013-1821",
"notes": [
{
"category": "description",
"text": "In Ruby besteht eine Denial of Service Schwachstelle. Diese Schwachstelle befindet sich im REXML Parser und tritt w\u00e4hrend der Verarbeitung speziell manipulierter XML Dokumente auf. Ein entfernter, anonymer Angreifer kann diese Schwachstelle ausnutzen, um einen Denial of Service Angriff durchzuf\u00fchren. Zur erfolgreichen Ausnutzung dieser Schwachstelle muss der Angreifer den Anwender dazu bringen eine manipulierte XML Datei zu \u00f6ffnen."
}
],
"product_status": {
"known_affected": [
"198379"
]
},
"release_date": "2013-08-08T22:00:00.000+00:00",
"title": "CVE-2013-1821"
}
]
}
gsd-2013-0269
Vulnerability from gsd
Modified
2013-02-12 00:00
Details
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2013-0269",
"description": "The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka \"Unsafe Object Creation Vulnerability.\"",
"id": "GSD-2013-0269",
"references": [
"https://www.suse.com/security/cve/CVE-2013-0269.html",
"https://access.redhat.com/errata/RHSA-2013:1185",
"https://access.redhat.com/errata/RHSA-2013:1147",
"https://access.redhat.com/errata/RHSA-2013:1028",
"https://access.redhat.com/errata/RHSA-2013:0701",
"https://access.redhat.com/errata/RHSA-2013:0686"
]
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "json",
"purl": "pkg:gem/json"
}
}
],
"aliases": [
"CVE-2013-0269",
"OSVDB-101137"
],
"details": "The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka \"Unsafe Object Creation Vulnerability.\"",
"id": "GSD-2013-0269",
"modified": "2013-02-12T00:00:00.000Z",
"published": "2013-02-12T00:00:00.000Z",
"references": [
{
"type": "WEB",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0269"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": 9.0,
"type": "CVSS_V2"
}
],
"summary": "CVE-2013-0269 rubygem-json: Denial of Service and SQL Injection"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2013-0269",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "n/a",
"version": {
"version_data": [
{
"version_affected": "=",
"version_value": "n/a"
}
]
}
}
]
},
"vendor_name": "n/a"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka \"Unsafe Object Creation Vulnerability.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "n/a"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://rhn.redhat.com/errata/RHSA-2013-0686.html",
"refsource": "MISC",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0686.html"
},
{
"name": "http://secunia.com/advisories/52774",
"refsource": "MISC",
"url": "http://secunia.com/advisories/52774"
},
{
"name": "http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/",
"refsource": "MISC",
"url": "http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/"
},
{
"name": "http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html",
"refsource": "MISC",
"url": "http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html"
},
{
"name": "http://rhn.redhat.com/errata/RHSA-2013-1028.html",
"refsource": "MISC",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1028.html"
},
{
"name": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html",
"refsource": "MISC",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html"
},
{
"name": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html",
"refsource": "MISC",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html"
},
{
"name": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00034.html",
"refsource": "MISC",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00034.html"
},
{
"name": "http://rhn.redhat.com/errata/RHSA-2013-0701.html",
"refsource": "MISC",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0701.html"
},
{
"name": "http://rhn.redhat.com/errata/RHSA-2013-1147.html",
"refsource": "MISC",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1147.html"
},
{
"name": "http://secunia.com/advisories/52075",
"refsource": "MISC",
"url": "http://secunia.com/advisories/52075"
},
{
"name": "http://secunia.com/advisories/52902",
"refsource": "MISC",
"url": "http://secunia.com/advisories/52902"
},
{
"name": "http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed",
"refsource": "MISC",
"url": "http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed"
},
{
"name": "http://www.openwall.com/lists/oss-security/2013/02/11/7",
"refsource": "MISC",
"url": "http://www.openwall.com/lists/oss-security/2013/02/11/7"
},
{
"name": "http://www.openwall.com/lists/oss-security/2013/02/11/8",
"refsource": "MISC",
"url": "http://www.openwall.com/lists/oss-security/2013/02/11/8"
},
{
"name": "http://www.osvdb.org/90074",
"refsource": "MISC",
"url": "http://www.osvdb.org/90074"
},
{
"name": "http://www.securityfocus.com/bid/57899",
"refsource": "MISC",
"url": "http://www.securityfocus.com/bid/57899"
},
{
"name": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2013\u0026m=slackware-security.426862",
"refsource": "MISC",
"url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2013\u0026m=slackware-security.426862"
},
{
"name": "http://www.ubuntu.com/usn/USN-1733-1",
"refsource": "MISC",
"url": "http://www.ubuntu.com/usn/USN-1733-1"
},
{
"name": "http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection",
"refsource": "MISC",
"url": "http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection"
},
{
"name": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82010",
"refsource": "MISC",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82010"
},
{
"name": "https://groups.google.com/group/rubyonrails-security/msg/d8e0db6e08c81428?dmode=source\u0026output=gplain",
"refsource": "MISC",
"url": "https://groups.google.com/group/rubyonrails-security/msg/d8e0db6e08c81428?dmode=source\u0026output=gplain"
},
{
"name": "https://puppet.com/security/cve/cve-2013-0269",
"refsource": "MISC",
"url": "https://puppet.com/security/cve/cve-2013-0269"
}
]
}
},
"github.com/rubysec/ruby-advisory-db": {
"cve": "2013-0269",
"cvss_v2": 9.0,
"date": "2013-02-12",
"description": "The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka \"Unsafe Object Creation Vulnerability.\"",
"gem": "json",
"osvdb": 101137,
"patched_versions": [
"~\u003e 1.5.5",
"~\u003e 1.6.8",
"\u003e= 1.7.7"
],
"title": "CVE-2013-0269 rubygem-json: Denial of Service and SQL Injection",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0269"
},
"gitlab.com": {
"advisories": [
{
"affected_range": "\u003c1.5.5 || \u003e=1.6.0 \u003c1.6.8 || \u003e=1.7.0 \u003c1.7.7",
"affected_versions": "All versions before 1.5.5, all versions starting from 1.6.0 before 1.6.8, all versions starting from 1.7.0 before 1.7.7",
"cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe_ids": [
"CWE-1035",
"CWE-20",
"CWE-937"
],
"date": "2017-12-08",
"description": "When parsing certain JSON documents, the JSON gem can be coerced in to creating Ruby symbols in a target system. Since Ruby symbols are not garbage collected, this can result in a denial of service attack. The same technique can be used to create objects in a target system that act like internal objects. These \"act alike\" objects can be used to bypass certain security mechanisms and can be used as a spring board for SQL injection attacks in Ruby on Rails.",
"fixed_versions": [
"1.5.5",
"1.6.8",
"1.7.7"
],
"identifier": "CVE-2013-0269",
"identifiers": [
"CVE-2013-0269"
],
"not_impacted": "NONE",
"package_slug": "gem/json",
"pubdate": "2013-02-12",
"solution": "Upgrade, patches and workarounds available (see source)",
"title": "Denial of Service and Unsafe Object Creation Vulnerability",
"urls": [
"https://groups.google.com/forum/?fromgroups=#!topic/rubyonrails-security/4_YvCpLzL58"
],
"uuid": "fd4699b1-3c7c-4b66-b4a9-d640990c6764"
},
{
"affected_range": "[1.7.1,1.7.3)",
"affected_versions": "All versions starting from 1.7.1 before 1.7.3",
"cvss_v2": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"cwe_ids": [
"CWE-1035",
"CWE-20",
"CWE-937"
],
"date": "2017-12-08",
"description": "This package allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka.",
"fixed_versions": [
"1.7.3"
],
"identifier": "CVE-2013-0269",
"identifiers": [
"CVE-2013-0269"
],
"package_slug": "maven/org.jruby/jruby",
"pubdate": "2013-02-12",
"solution": "Upgrade to version 1.7.3 or above.",
"title": "Denial of Service and SQL Injection",
"urls": [
"https://bugzilla.redhat.com/show_bug.cgi?id=CVE-2013-0269"
],
"uuid": "dbe17325-e976-41dc-b8df-fb185e139033"
}
]
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:rubygems:json_gem:1.7.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubygems:json_gem:1.7.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubygems:json_gem:1.6.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubygems:json_gem:1.6.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubygems:json_gem:1.7.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubygems:json_gem:1.7.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubygems:json_gem:1.6.5:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubygems:json_gem:1.6.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubygems:json_gem:1.5.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubygems:json_gem:1.5.1:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubygems:json_gem:1.7.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubygems:json_gem:1.7.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubygems:json_gem:1.7.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubygems:json_gem:1.6.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubygems:json_gem:1.6.2:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubygems:json_gem:1.5.0:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubygems:json_gem:1.6.7:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubygems:json_gem:1.6.6:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubygems:json_gem:1.5.4:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:rubygems:json_gem:1.5.3:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secalert@redhat.com",
"ID": "CVE-2013-0269"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka \"Unsafe Object Creation Vulnerability.\""
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection",
"refsource": "MISC",
"tags": [],
"url": "http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection"
},
{
"name": "[oss-security] 20130211 Patch update for [CVE-2013-0269]",
"refsource": "MLIST",
"tags": [],
"url": "http://www.openwall.com/lists/oss-security/2013/02/11/8"
},
{
"name": "90074",
"refsource": "OSVDB",
"tags": [],
"url": "http://www.osvdb.org/90074"
},
{
"name": "57899",
"refsource": "BID",
"tags": [],
"url": "http://www.securityfocus.com/bid/57899"
},
{
"name": "52075",
"refsource": "SECUNIA",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/52075"
},
{
"name": "http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/",
"refsource": "CONFIRM",
"tags": [
"Vendor Advisory"
],
"url": "http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/"
},
{
"name": "[oss-security] 20130211 Denial of Service and Unsafe Object Creation Vulnerability in JSON [CVE-2013-0269]",
"refsource": "MLIST",
"tags": [],
"url": "http://www.openwall.com/lists/oss-security/2013/02/11/7"
},
{
"name": "USN-1733-1",
"refsource": "UBUNTU",
"tags": [],
"url": "http://www.ubuntu.com/usn/USN-1733-1"
},
{
"name": "http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed",
"refsource": "CONFIRM",
"tags": [],
"url": "http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed"
},
{
"name": "[rubyonrails-security] 20130211 Denial of Service and Unsafe Object Creation Vulnerability in JSON [CVE-2013-0269]",
"refsource": "MLIST",
"tags": [],
"url": "https://groups.google.com/group/rubyonrails-security/msg/d8e0db6e08c81428?dmode=source\u0026output=gplain"
},
{
"name": "52774",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/52774"
},
{
"name": "RHSA-2013:0686",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0686.html"
},
{
"name": "52902",
"refsource": "SECUNIA",
"tags": [],
"url": "http://secunia.com/advisories/52902"
},
{
"name": "openSUSE-SU-2013:0603",
"refsource": "SUSE",
"tags": [],
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00034.html"
},
{
"name": "RHSA-2013:0701",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2013-0701.html"
},
{
"name": "SUSE-SU-2013:0609",
"refsource": "SUSE",
"tags": [],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html"
},
{
"name": "SUSE-SU-2013:0647",
"refsource": "SUSE",
"tags": [],
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html"
},
{
"name": "RHSA-2013:1028",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1028.html"
},
{
"name": "RHSA-2013:1147",
"refsource": "REDHAT",
"tags": [],
"url": "http://rhn.redhat.com/errata/RHSA-2013-1147.html"
},
{
"name": "APPLE-SA-2013-10-22-5",
"refsource": "APPLE",
"tags": [],
"url": "http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html"
},
{
"name": "SSA:2013-075-01",
"refsource": "SLACKWARE",
"tags": [],
"url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2013\u0026m=slackware-security.426862"
},
{
"name": "json-ruby-security-bypass(82010)",
"refsource": "XF",
"tags": [],
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82010"
},
{
"name": "https://puppet.com/security/cve/cve-2013-0269",
"refsource": "CONFIRM",
"tags": [],
"url": "https://puppet.com/security/cve/cve-2013-0269"
}
]
}
},
"impact": {
"baseMetricV2": {
"cvssV2": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"severity": "HIGH",
"userInteractionRequired": false
}
},
"lastModifiedDate": "2017-12-09T02:29Z",
"publishedDate": "2013-02-13T01:55Z"
}
}
}
ghsa-x457-cw4h-hq5f
Vulnerability from github
Published
2017-10-24 18:33
Modified
2023-06-01 19:55
VLAI Severity ?
Summary
JSON gem has Improper Input Validation vulnerability
Details
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
{
"affected": [
{
"package": {
"ecosystem": "RubyGems",
"name": "json"
},
"ranges": [
{
"events": [
{
"introduced": "0"
},
{
"fixed": "1.5.5"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "json"
},
"ranges": [
{
"events": [
{
"introduced": "1.6.0"
},
{
"fixed": "1.6.8"
}
],
"type": "ECOSYSTEM"
}
]
},
{
"package": {
"ecosystem": "RubyGems",
"name": "json"
},
"ranges": [
{
"events": [
{
"introduced": "1.7.0"
},
{
"fixed": "1.7.7"
}
],
"type": "ECOSYSTEM"
}
]
}
],
"aliases": [
"CVE-2013-0269"
],
"database_specific": {
"cwe_ids": [
"CWE-20"
],
"github_reviewed": true,
"github_reviewed_at": "2020-06-16T22:01:58Z",
"nvd_published_at": "2013-02-13T01:55:05Z",
"severity": "HIGH"
},
"details": "The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka \"Unsafe Object Creation Vulnerability.\"",
"id": "GHSA-x457-cw4h-hq5f",
"modified": "2023-06-01T19:55:21Z",
"published": "2017-10-24T18:33:37Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2013-0269"
},
{
"type": "WEB",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82010"
},
{
"type": "PACKAGE",
"url": "https://github.com/flori/json"
},
{
"type": "WEB",
"url": "https://github.com/rubysec/ruby-advisory-db/blob/master/gems/json/CVE-2013-0269.yml"
},
{
"type": "WEB",
"url": "https://groups.google.com/group/rubyonrails-security/msg/d8e0db6e08c81428?dmode=source\u0026output=gplain"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20130228082541/http://www.securityfocus.com/bid/57899"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20160331131233/http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed"
},
{
"type": "WEB",
"url": "https://web.archive.org/web/20160808163226/https://puppet.com/security/cve/cve-2013-0269"
},
{
"type": "WEB",
"url": "http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html"
},
{
"type": "WEB",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00034.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0686.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0701.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1028.html"
},
{
"type": "WEB",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1147.html"
},
{
"type": "WEB",
"url": "http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/02/11/7"
},
{
"type": "WEB",
"url": "http://www.openwall.com/lists/oss-security/2013/02/11/8"
},
{
"type": "WEB",
"url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2013\u0026m=slackware-security.426862"
},
{
"type": "WEB",
"url": "http://www.ubuntu.com/usn/USN-1733-1"
},
{
"type": "WEB",
"url": "http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection"
}
],
"schema_version": "1.4.0",
"severity": [],
"summary": "JSON gem has Improper Input Validation vulnerability"
}
fkie_cve-2013-0269
Vulnerability from fkie_nvd
Published
2013-02-13 01:55
Modified
2025-04-11 00:51
Severity ?
Summary
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
References
| ▶ | URL | Tags | |
|---|---|---|---|
| secalert@redhat.com | http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html | ||
| secalert@redhat.com | http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html | ||
| secalert@redhat.com | http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html | ||
| secalert@redhat.com | http://lists.opensuse.org/opensuse-updates/2013-04/msg00034.html | ||
| secalert@redhat.com | http://rhn.redhat.com/errata/RHSA-2013-0686.html | ||
| secalert@redhat.com | http://rhn.redhat.com/errata/RHSA-2013-0701.html | ||
| secalert@redhat.com | http://rhn.redhat.com/errata/RHSA-2013-1028.html | ||
| secalert@redhat.com | http://rhn.redhat.com/errata/RHSA-2013-1147.html | ||
| secalert@redhat.com | http://secunia.com/advisories/52075 | Vendor Advisory | |
| secalert@redhat.com | http://secunia.com/advisories/52774 | ||
| secalert@redhat.com | http://secunia.com/advisories/52902 | ||
| secalert@redhat.com | http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed | ||
| secalert@redhat.com | http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/ | Vendor Advisory | |
| secalert@redhat.com | http://www.openwall.com/lists/oss-security/2013/02/11/7 | ||
| secalert@redhat.com | http://www.openwall.com/lists/oss-security/2013/02/11/8 | ||
| secalert@redhat.com | http://www.osvdb.org/90074 | ||
| secalert@redhat.com | http://www.securityfocus.com/bid/57899 | ||
| secalert@redhat.com | http://www.slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.426862 | ||
| secalert@redhat.com | http://www.ubuntu.com/usn/USN-1733-1 | ||
| secalert@redhat.com | http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection | ||
| secalert@redhat.com | https://exchange.xforce.ibmcloud.com/vulnerabilities/82010 | ||
| secalert@redhat.com | https://groups.google.com/group/rubyonrails-security/msg/d8e0db6e08c81428?dmode=source&output=gplain | ||
| secalert@redhat.com | https://puppet.com/security/cve/cve-2013-0269 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://lists.opensuse.org/opensuse-updates/2013-04/msg00034.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2013-0686.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2013-0701.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2013-1028.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://rhn.redhat.com/errata/RHSA-2013-1147.html | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/52075 | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/52774 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://secunia.com/advisories/52902 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/ | Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2013/02/11/7 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.openwall.com/lists/oss-security/2013/02/11/8 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.osvdb.org/90074 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.securityfocus.com/bid/57899 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.slackware.com/security/viewer.php?l=slackware-security&y=2013&m=slackware-security.426862 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.ubuntu.com/usn/USN-1733-1 | ||
| af854a3a-2127-422b-91ae-364da2661108 | http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://exchange.xforce.ibmcloud.com/vulnerabilities/82010 | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://groups.google.com/group/rubyonrails-security/msg/d8e0db6e08c81428?dmode=source&output=gplain | ||
| af854a3a-2127-422b-91ae-364da2661108 | https://puppet.com/security/cve/cve-2013-0269 |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| rubygems | json_gem | 1.5.0 | |
| rubygems | json_gem | 1.5.1 | |
| rubygems | json_gem | 1.5.2 | |
| rubygems | json_gem | 1.5.3 | |
| rubygems | json_gem | 1.5.4 | |
| rubygems | json_gem | 1.6.0 | |
| rubygems | json_gem | 1.6.1 | |
| rubygems | json_gem | 1.6.2 | |
| rubygems | json_gem | 1.6.3 | |
| rubygems | json_gem | 1.6.4 | |
| rubygems | json_gem | 1.6.5 | |
| rubygems | json_gem | 1.6.6 | |
| rubygems | json_gem | 1.6.7 | |
| rubygems | json_gem | 1.7.0 | |
| rubygems | json_gem | 1.7.1 | |
| rubygems | json_gem | 1.7.2 | |
| rubygems | json_gem | 1.7.3 | |
| rubygems | json_gem | 1.7.4 | |
| rubygems | json_gem | 1.7.5 | |
| rubygems | json_gem | 1.7.6 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:rubygems:json_gem:1.5.0:*:*:*:*:*:*:*",
"matchCriteriaId": "1A6068E1-1BB1-4FBE-A4DA-C303B2E65E1D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubygems:json_gem:1.5.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6572D2E9-1D09-4245-BEB3-A3BCF3C4455C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubygems:json_gem:1.5.2:*:*:*:*:*:*:*",
"matchCriteriaId": "56DF3383-1E82-4FA0-B92F-1C96DAB5C12C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubygems:json_gem:1.5.3:*:*:*:*:*:*:*",
"matchCriteriaId": "3EFA5025-DFED-4540-B773-5777ACE013C3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubygems:json_gem:1.5.4:*:*:*:*:*:*:*",
"matchCriteriaId": "9EB792B2-FF20-4C39-B2DD-171E6B8317F4",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubygems:json_gem:1.6.0:*:*:*:*:*:*:*",
"matchCriteriaId": "A65B497E-F658-4E6D-810C-97C56FF0AAF1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubygems:json_gem:1.6.1:*:*:*:*:*:*:*",
"matchCriteriaId": "6D8A1269-441E-48E1-A0F2-949C49FFAEC3",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubygems:json_gem:1.6.2:*:*:*:*:*:*:*",
"matchCriteriaId": "DC0420E6-84C8-4210-AB79-875564741330",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubygems:json_gem:1.6.3:*:*:*:*:*:*:*",
"matchCriteriaId": "73665EA1-E35D-469D-8898-163FB8DF34AB",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubygems:json_gem:1.6.4:*:*:*:*:*:*:*",
"matchCriteriaId": "0AB8EC9A-8CC4-4A71-A026-6FB98DA1A35F",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubygems:json_gem:1.6.5:*:*:*:*:*:*:*",
"matchCriteriaId": "530A8D3B-AFF0-4316-A4B5-B222A73CD9E8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubygems:json_gem:1.6.6:*:*:*:*:*:*:*",
"matchCriteriaId": "89AE459A-4169-47F4-9B40-344002352C61",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubygems:json_gem:1.6.7:*:*:*:*:*:*:*",
"matchCriteriaId": "9FC8E7A7-7A94-497E-B8C2-B4A0CBD4BD7B",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubygems:json_gem:1.7.0:*:*:*:*:*:*:*",
"matchCriteriaId": "D696FD5D-3DAD-4AAB-A3C7-1865739922D8",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubygems:json_gem:1.7.1:*:*:*:*:*:*:*",
"matchCriteriaId": "88A3B72B-5784-4169-88DA-9EF51C5CE907",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubygems:json_gem:1.7.2:*:*:*:*:*:*:*",
"matchCriteriaId": "0B59F779-5E90-40E3-ABC8-58A7EC3C7E17",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubygems:json_gem:1.7.3:*:*:*:*:*:*:*",
"matchCriteriaId": "979B9AA8-3E70-4BCF-8C2F-3C872AF8A7B0",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubygems:json_gem:1.7.4:*:*:*:*:*:*:*",
"matchCriteriaId": "7DCB75C6-3E7A-41C7-8513-8766C4ED73F7",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubygems:json_gem:1.7.5:*:*:*:*:*:*:*",
"matchCriteriaId": "717A9E8C-9E3E-4F55-8CD4-D9E6CF670C5C",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:rubygems:json_gem:1.7.6:*:*:*:*:*:*:*",
"matchCriteriaId": "52D8BF48-03A7-4EFA-B626-A92C8570CB86",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka \"Unsafe Object Creation Vulnerability.\""
},
{
"lang": "es",
"value": "El JSON gem v1.7.x anteriores a 1.7.7, v1.6.x anteriores a v1.6.8, y v1.5.x anteriores a v1.5.5 permite a atacantes remotos provocar una denegaci\u00f3n de servicio (consumo de recursos) o evitar el mecanismo de protecci\u00f3n de asignaci\u00f3n masiva a trav\u00e9s de un documento JSON manipulado que lanza la creaci\u00f3n de s\u00edmbolos arbitrarios en Ruby o ciertos objetos internos, como se demostr\u00f3 como se ha demostrado mediante la realizaci\u00f3n de un ataque de inyecci\u00f3n SQL en Ruby on Rails, tambi\u00e9n conocido como \"Vulnerabilidad de creaci\u00f3n de objetos no seguro\"."
}
],
"id": "CVE-2013-0269",
"lastModified": "2025-04-11T00:51:21.963",
"metrics": {
"cvssMetricV2": [
{
"acInsufInfo": false,
"baseSeverity": "HIGH",
"cvssData": {
"accessComplexity": "LOW",
"accessVector": "NETWORK",
"authentication": "NONE",
"availabilityImpact": "PARTIAL",
"baseScore": 7.5,
"confidentialityImpact": "PARTIAL",
"integrityImpact": "PARTIAL",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"version": "2.0"
},
"exploitabilityScore": 10.0,
"impactScore": 6.4,
"obtainAllPrivilege": false,
"obtainOtherPrivilege": false,
"obtainUserPrivilege": false,
"source": "nvd@nist.gov",
"type": "Primary",
"userInteractionRequired": false
}
]
},
"published": "2013-02-13T01:55:05.107",
"references": [
{
"source": "secalert@redhat.com",
"url": "http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html"
},
{
"source": "secalert@redhat.com",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00034.html"
},
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0686.html"
},
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0701.html"
},
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1028.html"
},
{
"source": "secalert@redhat.com",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1147.html"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/52075"
},
{
"source": "secalert@redhat.com",
"url": "http://secunia.com/advisories/52774"
},
{
"source": "secalert@redhat.com",
"url": "http://secunia.com/advisories/52902"
},
{
"source": "secalert@redhat.com",
"url": "http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed"
},
{
"source": "secalert@redhat.com",
"tags": [
"Vendor Advisory"
],
"url": "http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2013/02/11/7"
},
{
"source": "secalert@redhat.com",
"url": "http://www.openwall.com/lists/oss-security/2013/02/11/8"
},
{
"source": "secalert@redhat.com",
"url": "http://www.osvdb.org/90074"
},
{
"source": "secalert@redhat.com",
"url": "http://www.securityfocus.com/bid/57899"
},
{
"source": "secalert@redhat.com",
"url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2013\u0026m=slackware-security.426862"
},
{
"source": "secalert@redhat.com",
"url": "http://www.ubuntu.com/usn/USN-1733-1"
},
{
"source": "secalert@redhat.com",
"url": "http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection"
},
{
"source": "secalert@redhat.com",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82010"
},
{
"source": "secalert@redhat.com",
"url": "https://groups.google.com/group/rubyonrails-security/msg/d8e0db6e08c81428?dmode=source\u0026output=gplain"
},
{
"source": "secalert@redhat.com",
"url": "https://puppet.com/security/cve/cve-2013-0269"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.apple.com/archives/security-announce/2013/Oct/msg00006.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00001.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00015.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://lists.opensuse.org/opensuse-updates/2013-04/msg00034.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0686.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2013-0701.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1028.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://rhn.redhat.com/errata/RHSA-2013-1147.html"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://secunia.com/advisories/52075"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/52774"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://secunia.com/advisories/52902"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Vendor Advisory"
],
"url": "http://weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released/"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2013/02/11/7"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.openwall.com/lists/oss-security/2013/02/11/8"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.osvdb.org/90074"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.securityfocus.com/bid/57899"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.slackware.com/security/viewer.php?l=slackware-security\u0026y=2013\u0026m=slackware-security.426862"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.ubuntu.com/usn/USN-1733-1"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "http://www.zweitag.de/en/blog/ruby-on-rails-vulnerable-to-mass-assignment-and-sql-injection"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://exchange.xforce.ibmcloud.com/vulnerabilities/82010"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://groups.google.com/group/rubyonrails-security/msg/d8e0db6e08c81428?dmode=source\u0026output=gplain"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"url": "https://puppet.com/security/cve/cve-2013-0269"
}
],
"sourceIdentifier": "secalert@redhat.com",
"vulnStatus": "Deferred",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-20"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…