CVE-2013-1800
crack does not properly restrict casts of string values
The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Exploit likelihood
What each source reports
NVD Score used
The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
- Record
CVE-2013-1800- CVSS 2.0
- 7.5 High
AV:N/AC:L/Au:N/C:P/I:P/A:P - Weakness
- CWE-264
- Updated
- 2026-11-02
CVE List No score
The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
- Record
CVE-2013-1800- Updated
- 2026-11-02
EUVDEUVD-2017-0271 No score
The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
- Record
EUVD-2017-0271- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-m7fq-cf8q-35q7 No score
crack does not properly restrict casts of string values
The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
- Record
GHSA-m7fq-cf8q-35q7- Weakness
- CWE-74, CWE-704
- Updated
- 2026-11-02
OSV No score
The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
- Record
CVE-2013-1800- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-1800 No score
The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
- Record
DEBIAN-CVE-2013-1800- Updated
- 2026-11-02
OSVGHSA-m7fq-cf8q-35q7 No score
crack does not properly restrict casts of string values
The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
- Record
GHSA-m7fq-cf8q-35q7- Weakness
- CWE-704, CWE-74
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-1800 No score
The crack gem 0.3.1 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
- Record
UBUNTU-CVE-2013-1800- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
crackRubyGems |
before 0.3.2 | 0.3.2 |
ruby-crackDebian:12 |
before 0.3.2-1 | 0.3.2-1 |
ruby-crackDebian:13 |
before 0.3.2-1 | 0.3.2-1 |
ruby-crackDebian:14 |
before 0.3.2-1 | 0.3.2-1 |
crackRubyGems |
before 0.3.2, plus listed versions 0.1.10.1.20.1.30.1.40.1.5 Show 6 moreShow less0.1.60.1.70.1.80.2.00.3.00.3.1 |
0.3.2 |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-1800 is a high vulnerability (CVSS 7.5) in John Nunemaker Crack, published April 9, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 4.95%, the 92nd percentile. Fixed in crack 0.3.2.
References
bugzilla.redhat.com/show_bug.cgi?id=917236
secunia.com/advisories/52897
bugzilla.novell.com/show_bug.cgi?id=804721
lists.opensuse.org/opensuse-security-announce/2013-04/msg00003.html
support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately
github.com/jnunemaker/crack/commit/e3da1212a1f84a898ee3601336d1dbbf118fb5f6
Show 8 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-1800
web.archive.org/web/20130203232028/https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately
security-tracker.debian.org/tracker/CVE-2013-1800
ubuntu.com/security/CVE-2013-1800
cve.org/CVERecord?id=CVE-2013-1800