CVE-2013-4389
actionmailer email address processing causes Denial of service
4.3 MediumFix available
Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.
Exploit likelihood
3.14%Up 1.8 points since Feb 4, 2022
What each source reports
NVD Score used
Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.
- Record
CVE-2013-4389- CVSS 2.0
- 4.3 Medium
AV:N/AC:M/Au:N/C:N/I:N/A:P - Weakness
- CWE-134
- Updated
- 2026-11-02
CVE List No score
Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.
- Record
CVE-2013-4389- Updated
- 2026-11-02
EUVDEUVD-2017-0301 No score
Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.
- Record
EUVD-2017-0301- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-rg5m-3fqp-6px8 No score
actionmailer email address processing causes Denial of service
Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.
- Record
GHSA-rg5m-3fqp-6px8- Weakness
- CWE-134
- Updated
- 2026-11-02
OSVGHSA-rg5m-3fqp-6px8 No score
actionmailer email address processing causes Denial of service
Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.
- Record
GHSA-rg5m-3fqp-6px8- Weakness
- CWE-134
- Updated
- 2026-11-02
OSVUBUNTU-CVE-2013-4389 No score
Multiple format string vulnerabilities in log_subscriber.rb files in the log subscriber component in Action Mailer in Ruby on Rails 3.x before 3.2.15 allow remote attackers to cause a denial of service via a crafted e-mail address that is improperly handled during construction of a log message.
- Record
UBUNTU-CVE-2013-4389- Updated
- 2026-11-02
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
actionmailerRubyGems |
3.0.0 up to 3.2.15 | 3.2.15 |
ruby-actionmailer-3.2Debian:7 |
before 3.2.6-2+deb7u1, plus listed versions 3.2.6-2 |
3.2.6-2+deb7u1 |
ruby-actionpack-3.2Debian:7 |
before 3.2.6-6+deb7u1, plus listed versions 3.2.6-6 |
3.2.6-6+deb7u1 |
actionmailerRubyGems |
3.0.0 up to 3.2.15, plus listed versions 3.0.13.0.103.0.10.rc13.0.113.0.12 Show 45 moreShow less3.0.12.rc13.0.133.0.13.rc13.0.143.0.153.0.163.0.173.0.183.0.193.0.23.0.203.0.33.0.43.0.4.rc13.0.53.0.5.rc13.0.63.0.6.rc13.0.6.rc23.0.73.0.7.rc13.0.7.rc23.0.83.0.8.rc13.0.8.rc23.0.8.rc43.0.93.0.9.rc13.0.9.rc33.0.9.rc43.0.9.rc53.1.03.1.0.beta13.1.0.rc13.1.0.rc23.1.0.rc33.1.0.rc43.1.0.rc53.1.0.rc63.1.0.rc83.1.13.1.1.rc13.1.1.rc23.1.1.rc33.1.10 |
3.2.15 |
cfmeRed Hat:cloudforms_managementengine:5::el6 |
before 0:5.4.0.5-1.el6cf | 0:5.4.0.5-1.el6cf |
cfme-applianceRed Hat:cloudforms_managementengine:5::el6 |
before 0:5.4.0.5-1.el6cf | 0:5.4.0.5-1.el6cf |
cfme-debuginfoRed Hat:cloudforms_managementengine:5::el6 |
before 0:5.4.0.5-1.el6cf | 0:5.4.0.5-1.el6cf |
cfme-gemsetRed Hat:cloudforms_managementengine:5::el6 |
before 0:5.4.0.5-1.el6cf | 0:5.4.0.5-1.el6cf |
cfme-libRed Hat:cloudforms_managementengine:5::el6 |
before 0:5.4.0.5-1.el6cf | 0:5.4.0.5-1.el6cf |
cfme-vnc-pluginRed Hat:cloudforms_managementengine:5::el6 |
before 0:1.0.0-2.el6cf | 0:1.0.0-2.el6cf |
Show 42 moreShow less
| Package | Affected | Fixed |
|---|---|---|
cfme-vnc-plugin-debuginfoRed Hat:cloudforms_managementengine:5::el6 |
before 0:1.0.0-2.el6cf | 0:1.0.0-2.el6cf |
libdnetRed Hat:cloudforms_managementengine:5::el6 |
before 0:1.12-11.el6cf | 0:1.12-11.el6cf |
libdnet-debuginfoRed Hat:cloudforms_managementengine:5::el6 |
before 0:1.12-11.el6cf | 0:1.12-11.el6cf |
libdnet-develRed Hat:cloudforms_managementengine:5::el6 |
before 0:1.12-11.el6cf | 0:1.12-11.el6cf |
libdnet-progsRed Hat:cloudforms_managementengine:5::el6 |
before 0:1.12-11.el6cf | 0:1.12-11.el6cf |
lshwRed Hat:cloudforms_managementengine:5::el6 |
before 0:B.02.16-4.el6cf | 0:B.02.16-4.el6cf |
lshw-debuginfoRed Hat:cloudforms_managementengine:5::el6 |
before 0:B.02.16-4.el6cf | 0:B.02.16-4.el6cf |
lshw-guiRed Hat:cloudforms_managementengine:5::el6 |
before 0:B.02.16-4.el6cf | 0:B.02.16-4.el6cf |
netapp-manageability-sdkRed Hat:cloudforms_managementengine:5::el6 |
before 0:4.0P1-3.el6cf | 0:4.0P1-3.el6cf |
netapp-manageability-sdk-develRed Hat:cloudforms_managementengine:5::el6 |
before 0:4.0P1-3.el6cf | 0:4.0P1-3.el6cf |
open-vm-toolsRed Hat:cloudforms_managementengine:5::el6 |
before 0:9.2.3-5.el6cf | 0:9.2.3-5.el6cf |
open-vm-tools-debuginfoRed Hat:cloudforms_managementengine:5::el6 |
before 0:9.2.3-5.el6cf | 0:9.2.3-5.el6cf |
open-vm-tools-desktopRed Hat:cloudforms_managementengine:5::el6 |
before 0:9.2.3-5.el6cf | 0:9.2.3-5.el6cf |
open-vm-tools-develRed Hat:cloudforms_managementengine:5::el6 |
before 0:9.2.3-5.el6cf | 0:9.2.3-5.el6cf |
princeRed Hat:cloudforms_managementengine:5::el6 |
before 0:9.0r2-4.el6cf | 0:9.0r2-4.el6cf |
pyliblzmaRed Hat:cloudforms_managementengine:5::el6 |
before 0:0.5.3-7.el6cf | 0:0.5.3-7.el6cf |
pyliblzma-debuginfoRed Hat:cloudforms_managementengine:5::el6 |
before 0:0.5.3-7.el6cf | 0:0.5.3-7.el6cf |
ruby200-rubygem-bcrypt-rubyRed Hat:cloudforms_managementengine:5::el6 |
before 0:3.0.1-2.el6cf | 0:3.0.1-2.el6cf |
ruby200-rubygem-bcrypt-ruby-debuginfoRed Hat:cloudforms_managementengine:5::el6 |
before 0:3.0.1-2.el6cf | 0:3.0.1-2.el6cf |
ruby200-rubygem-eventmachineRed Hat:cloudforms_managementengine:5::el6 |
before 0:1.0.7-2.el6cf | 0:1.0.7-2.el6cf |
ruby200-rubygem-eventmachine-debuginfoRed Hat:cloudforms_managementengine:5::el6 |
before 0:1.0.7-2.el6cf | 0:1.0.7-2.el6cf |
ruby200-rubygem-ffiRed Hat:cloudforms_managementengine:5::el6 |
before 0:1.9.8-1.el6cf | 0:1.9.8-1.el6cf |
ruby200-rubygem-ffi-debuginfoRed Hat:cloudforms_managementengine:5::el6 |
before 0:1.9.8-1.el6cf | 0:1.9.8-1.el6cf |
ruby200-rubygem-io-extraRed Hat:cloudforms_managementengine:5::el6 |
before 0:1.2.8-1.el6cf | 0:1.2.8-1.el6cf |
ruby200-rubygem-io-extra-debuginfoRed Hat:cloudforms_managementengine:5::el6 |
before 0:1.2.8-1.el6cf | 0:1.2.8-1.el6cf |
ruby200-rubygem-jsonRed Hat:cloudforms_managementengine:5::el6 |
before 0:1.8.2-2.el6cf | 0:1.8.2-2.el6cf |
ruby200-rubygem-json-debuginfoRed Hat:cloudforms_managementengine:5::el6 |
before 0:1.8.2-2.el6cf | 0:1.8.2-2.el6cf |
ruby200-rubygem-nokogiriRed Hat:cloudforms_managementengine:5::el6 |
before 0:1.5.11-2.el6cf | 0:1.5.11-2.el6cf |
ruby200-rubygem-nokogiri-debuginfoRed Hat:cloudforms_managementengine:5::el6 |
before 0:1.5.11-2.el6cf | 0:1.5.11-2.el6cf |
ruby200-rubygem-pgRed Hat:cloudforms_managementengine:5::el6 |
before 0:0.12.2-9.el6cf | 0:0.12.2-9.el6cf |
ruby200-rubygem-pg-debuginfoRed Hat:cloudforms_managementengine:5::el6 |
before 0:0.12.2-9.el6cf | 0:0.12.2-9.el6cf |
ruby200-rubygem-psychRed Hat:cloudforms_managementengine:5::el6 |
before 0:2.0.13-1.el6cf | 0:2.0.13-1.el6cf |
ruby200-rubygem-psych-debuginfoRed Hat:cloudforms_managementengine:5::el6 |
before 0:2.0.13-1.el6cf | 0:2.0.13-1.el6cf |
ruby200-rubygem-qpid_messagingRed Hat:cloudforms_managementengine:5::el6 |
before 0:0.20.2-5.el6cf | 0:0.20.2-5.el6cf |
ruby200-rubygem-qpid_messaging-debuginfoRed Hat:cloudforms_managementengine:5::el6 |
before 0:0.20.2-5.el6cf | 0:0.20.2-5.el6cf |
ruby200-rubygem-therubyracerRed Hat:cloudforms_managementengine:5::el6 |
before 0:0.11.0-5.el6cf | 0:0.11.0-5.el6cf |
ruby200-rubygem-therubyracer-debuginfoRed Hat:cloudforms_managementengine:5::el6 |
before 0:0.11.0-5.el6cf | 0:0.11.0-5.el6cf |
ruby200-rubygem-thinRed Hat:cloudforms_managementengine:5::el6 |
before 0:1.3.1-9.el6cf | 0:1.3.1-9.el6cf |
ruby200-rubygem-thin-debuginfoRed Hat:cloudforms_managementengine:5::el6 |
before 0:1.3.1-9.el6cf | 0:1.3.1-9.el6cf |
sneakernet_caRed Hat:cloudforms_managementengine:5::el6 |
before 0:0.1-2.el6cf | 0:0.1-2.el6cf |
wmiRed Hat:cloudforms_managementengine:5::el6 |
before 0:1.3.14-1.el6cf | 0:1.3.14-1.el6cf |
wmi-debuginfoRed Hat:cloudforms_managementengine:5::el6 |
before 0:1.3.14-1.el6cf | 0:1.3.14-1.el6cf |
History
| Recorded | Changed | Sources |
|---|---|---|
| affected | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2013-4389 is a medium vulnerability (CVSS 4.3) in Rubyonrails Rails, published October 17, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 3.14%, the 87th percentile. Fixed in actionmailer 3.2.15.
References
debian.org/security/2014/dsa-2887
lists.opensuse.org/opensuse-updates/2014-01/msg00003.html
groups.google.com/forum/message/raw?msg=ruby-security-ann/yvlR1Vx44c8/elKJkpO2KVgJ
Show 194 moreShow less
nvd.nist.gov/vuln/detail/CVE-2013-4389
github.com/advisories/GHSA-rg5m-3fqp-6px8
web.archive.org/web/20201208175929/https://groups.google.com/forum/message/raw?msg=ruby-security-ann/yvlR1Vx44c8/elKJkpO2KVgJ
access.redhat.com/errata/RHBA-2015:1100
bugzilla.redhat.com/show_bug.cgi?id=1146178
security.access.redhat.com/data/csaf/v2/advisories/2015/rhba-2015_1100.json
cve.org/CVERecord?id=CVE-2013-4389
ubuntu.com/security/CVE-2013-4389
This page doesn't list everything
Left out here: 48 versions and 228 references. The JSON record has them.