CVE-2013-0277
Active Record contains deserialization of arbitrary YAML
CVE-2013-0277 is a high vulnerability (CVSS 10.0) in Rubyonrails Rails, published February 12, 2013. No source lists public exploit code. EPSS puts the chance of exploitation in the next 30 days at 7.50%, the 94th percentile. Fixed in activerecord 2.3.17.
- Severity
- 10.0 HighCVSS 2.0, NVD
- Exploit chance
- 7.50%EPSS, 94th percentile
- Exploitation
- None knownNot on CISA’s or ENISA’s lists
- Fixed in
2.3.17activerecord +7 more
Description
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
Exploit likelihood
Affected products
Affected packages
| Package | Affected | Fixed |
|---|---|---|
activerecordRubyGems | before 2.3.17 | 2.3.17 |
activerecordRubyGems | 3.0.0 up to 3.1.0 | 3.1.0 |
railsDebian:12 | before 2.3.14.1 | 2.3.14.1 |
railsDebian:13 | before 2.3.14.1 | 2.3.14.1 |
railsDebian:14 | before 2.3.14.1 | 2.3.14.1 |
railsDebian:6.0 From an advisory covering 2 CVEs | before 2.3.5-1.2+squeeze7, plus listed versions 2.3.5-1.22.3.5-1.2+squeeze0.12.3.5-1.2+squeeze12.3.5-1.2+squeeze22.3.5-1.2+squeeze3 Show 4 moreShow less2.3.5-1.2+squeeze42.3.5-1.2+squeeze4.12.3.5-1.2+squeeze52.3.5-1.2+squeeze6 | 2.3.5-1.2+squeeze7 |
activerecordRubyGems | before 2.3.17, plus listed versions 1.0.01.1.01.10.01.10.11.11.0 Show 45 moreShow less1.11.11.12.11.12.21.13.01.13.11.13.21.14.01.14.11.14.21.14.31.14.41.15.01.15.11.15.21.15.31.15.41.15.51.15.61.2.01.3.01.4.01.5.01.5.11.6.01.7.01.8.01.9.01.9.12.0.02.0.12.0.22.0.42.0.52.1.02.1.12.1.22.2.22.2.32.3.102.3.112.3.122.3.142.3.152.3.162.3.2 | 2.3.17 |
activerecordRubyGems | 3.0.0 up to 3.1.0, plus listed versions 3.0.13.0.103.0.10.rc13.0.113.0.12 Show 39 moreShow less3.0.12.rc13.0.133.0.13.rc13.0.143.0.153.0.163.0.173.0.183.0.193.0.23.0.203.0.33.0.43.0.4.rc13.0.53.0.5.rc13.0.63.0.6.rc13.0.6.rc23.0.73.0.7.rc13.0.7.rc23.0.83.0.8.rc13.0.8.rc23.0.8.rc43.0.93.0.9.rc13.0.9.rc33.0.9.rc43.0.9.rc53.1.0.beta13.1.0.rc13.1.0.rc23.1.0.rc33.1.0.rc43.1.0.rc53.1.0.rc63.1.0.rc8 | 3.1.0 |
What each source reports
NVD Score used
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
- Record
CVE-2013-0277- CVSS 2.0
- 10.0 High
AV:N/AC:L/Au:N/C:C/I:C/A:C - Updated
- 2026-11-02
CVE ListNo score
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
- Record
CVE-2013-0277- Updated
- 2026-11-02
EUVDEUVD-2017-0230No score
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
- Record
EUVD-2017-0230- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-fhj9-cjjh-27vmNo score
Active Record contains deserialization of arbitrary YAML
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
- Record
GHSA-fhj9-cjjh-27vm- Weakness
- CWE-502
- Updated
- 2026-11-02
OSVNo score
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
- Record
CVE-2013-0277- Updated
- 2026-11-02
OSVDEBIAN-CVE-2013-0277No score
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
- Record
DEBIAN-CVE-2013-0277- Updated
- 2026-11-02
OSVGHSA-fhj9-cjjh-27vmNo score
Active Record contains deserialization of arbitrary YAML
ActiveRecord in Ruby on Rails before 2.3.17 and 3.x before 3.1.0 allows remote attackers to cause a denial of service or execute arbitrary code via crafted serialized attributes that cause the +serialize+ helper to deserialize arbitrary YAML.
- Record
GHSA-fhj9-cjjh-27vm- Weakness
- CWE-502
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| affected, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, GitHub Advisories, NVD, OSV |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
securitytracker.com/id?1028109
puppet.com/security/cve/cve-2013-0277
support.apple.com/kb/HT5784
debian.org/security/2013/dsa-2620
lists.apple.com/archives/security-announce/2013/Jun/msg00000.html
osvdb.org/90073
Show 10 moreShow less
groups.google.com/group/rubyonrails-security/msg/302ec7ce90f13837?dmode=source&output=gplain
lists.opensuse.org/opensuse-updates/2013-03/msg00048.html
openwall.com/lists/oss-security/2013/02/11/6
weblog.rubyonrails.org/2013/2/11/SEC-ANN-Rails-3-2-12-3-1-11-and-2-3-17-have-been-released
secunia.com/advisories/52112
nvd.nist.gov/vuln/detail/CVE-2013-0277
github.com/rubysec/ruby-advisory-db/blob/master/gems/activerecord/CVE-2013-0277.yml
security-tracker.debian.org/tracker/CVE-2013-0277
Left out here: 9 versions. The JSON record has them.