Active Record contains deserialization of arbitrary YAML

2017-10-2418:33:37

Google

osv.dev

0.099 Low

EPSS

Percentile

94.9%

JSON

ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.

CPENameOperatorVersion
activerecordeq1.10.0
activerecordeq1.15.0
activerecordeq3.0.1
activerecordeq1.14.1
activerecordeq1.15.2
activerecordeq2.0.1
activerecordeq1.11.0
activerecordeq1.5.0
activerecordeq2.3.6
activerecordeq3.0.9.rc1

Name	Operator	Version
activerecord	eq	1.10.0
activerecord	eq	1.15.0
activerecord	eq	3.0.1
activerecord	eq	1.14.1
activerecord	eq	1.15.2
activerecord	eq	2.0.1
activerecord	eq	1.11.0
activerecord	eq	1.5.0
activerecord	eq	2.3.6
activerecord	eq	3.0.9.rc1