Input validation error in ruby-activerecord (Alpine package)

1) Input validation error

EUVDB-ID: #VU33108

Risk: Medium

CVSSv3.1: 4.6 [CVSS:3.1/CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:L/E:U/RL:O/RC:C]

CVE-ID: CVE-2013-1854

CWE-ID: CWE-20 - Improper input validation

Exploit availability: No

Description

The vulnerability allows a remote non-authenticated attacker to perform service disruption.

The Active Record component in Ruby on Rails 2.3.x before 2.3.18, 3.1.x before 3.1.12, and 3.2.x before 3.2.13 processes certain queries by converting hash keys to symbols, which allows remote attackers to cause a denial of service via crafted input to a where method.

Mitigation

Install update from vendor's website.

Vulnerable software versions

libpng (Alpine package): 1.4.11-r0

ruby-activerecord (Alpine package): 2.3.17-r0

CPE2.3

• cpe:2.3:o:alpine:libpng_alpine_package:1.4.11-r0:*:*:*:*:alpine_linux:*:
• cpe:2.3:o:alpine:ruby-activerecord_alpine_package:2.3.17-r0:*:*:*:*:alpine_linux:*:

External links

http://git.alpinelinux.org/aports/commit/?id=4d356e414c5c3d77f1287eda21eefc80c36c3512
http://git.alpinelinux.org/aports/commit/?id=a17632e5416d2e45b6343688ab5ba0e5c73ea654

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability.