{"id":"CVE-2013-1802","aliases":["DEBIAN-CVE-2013-1802","DLA-172-1","EUVD-2017-0204","GHSA-9h36-4jf2-hx53","UBUNTU-CVE-2013-1802"],"status":"published","title":"extlib does not properly restrict casts of string values","description":"The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.","severity":{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary","from":"nvd"},"epss":{"day":"2026-11-09","score":0.03415,"percentile":0.88978,"model":"v2026.06.15"},"facts":{"in_kev":false,"known_exploited":false,"public_exploit":false,"fix_available":true},"cwes":["CWE-264","CWE-704"],"published":"2013-04-09T20:00:00Z","modified":"2026-09-01T20:03:15Z","fixes":[{"ecosystem":"RubyGems","package":"extlib","fixed_in":["0.9.16"],"sources":["ghsa","osv"]},{"ecosystem":"Debian:12","package":"ruby-extlib","fixed_in":["0.9.15-3"],"sources":["osv"]},{"ecosystem":"Debian:13","package":"ruby-extlib","fixed_in":["0.9.15-3"],"sources":["osv"]},{"ecosystem":"Debian:14","package":"ruby-extlib","fixed_in":["0.9.15-3"],"sources":["osv"]},{"ecosystem":"Debian:6.0","package":"libextlib-ruby","fixed_in":["0.9.13-2+deb6u1"],"sources":["osv"]}],"affected":[{"source":"ghsa","ecosystem":"RubyGems","package":"extlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.16"}]}]},{"source":"osv","ecosystem":"Debian:12","package":"ruby-extlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.15-3"}]}]},{"source":"osv","ecosystem":"Debian:13","package":"ruby-extlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.15-3"}]}]},{"source":"osv","ecosystem":"Debian:14","package":"ruby-extlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.15-3"}]}]},{"source":"osv","ecosystem":"Debian:6.0","package":"libextlib-ruby","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.13-2+deb6u1"}]}],"versions":["0.9.13-2"]},{"source":"osv","ecosystem":"RubyGems","package":"extlib","ranges":[{"type":"ECOSYSTEM","events":[{"introduced":"0"},{"fixed":"0.9.16"}]}],"versions":["0.9.10","0.9.11","0.9.12","0.9.13","0.9.14","0.9.15","0.9.2","0.9.3","0.9.4","0.9.5","0.9.6","0.9.7","0.9.8","0.9.9"]}],"products":[{"vendor":"dan_kubb","product":"extlib"}],"references":[{"url":"https://github.com/datamapper/extlib/compare/b4f98174ec35ac96f76a08d5624fad05d22879b5...4540e7102b803624cc2eade4bb8aaaa934fc31c5","tags":["x_refsource_CONFIRM","x_transferred","Exploit","Patch","evidence","fix","web"]},{"url":"http://lists.opensuse.org/opensuse-security-announce/2013-04/msg00002.html","tags":["vendor-advisory","x_refsource_SUSE","x_transferred","web"]},{"url":"https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately","tags":["x_refsource_MISC","x_transferred","web"]},{"url":"https://bugzilla.redhat.com/show_bug.cgi?id=917233","tags":["x_refsource_MISC","x_transferred","report","web"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2013-1802","tags":["advisory"]},{"url":"https://web.archive.org/web/20130203232028/https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately","tags":["web"]},{"url":"https://github.com/rubysec/ruby-advisory-db/blob/master/gems/extlib/CVE-2013-1802.yml","tags":["web"]},{"url":"https://github.com/advisories/GHSA-9h36-4jf2-hx53"},{"url":"https://security-tracker.debian.org/tracker/CVE-2013-1802","tags":["advisory"]},{"url":"https://github.com/datamapper/extlib","tags":["package"]},{"url":"https://ubuntu.com/security/CVE-2013-1802","tags":["report"]},{"url":"https://www.cve.org/CVERecord?id=CVE-2013-1802","tags":["report"]}],"sources":{"cve":[{"id":"CVE-2013-1802","description":"The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.","status":"published","published":"2013-04-09T20:00:00Z","modified":"2024-08-06T15:13:33.181Z","updated_at":"2026-11-02T14:34:58.193873Z"}],"euvd":[{"id":"EUVD-2017-0204","description":"The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.","status":"published","published":"2013-04-09T20:00:00Z","modified":"2024-08-06T15:13:33Z","updated_at":"2026-11-03T01:56:40.540333Z"}],"ghsa":[{"id":"GHSA-9h36-4jf2-hx53","title":"extlib does not properly restrict casts of string values","description":"The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.","status":"published","published":"2017-10-24T18:33:37Z","modified":"2023-08-28T19:10:38Z","cwes":["CWE-704"],"updated_at":"2026-11-02T14:37:01.345964Z"}],"nvd":[{"id":"CVE-2013-1802","description":"The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.","status":"published","published":"2013-04-09T20:55:01.977Z","modified":"2026-06-16T23:52:08.993Z","cvss":[{"version":"2.0","score":7.5,"vector":"AV:N/AC:L/Au:N/C:P/I:P/A:P","level":"high","assessor":"primary"}],"cwes":["CWE-264"],"updated_at":"2026-11-02T14:02:24.091325Z"}],"osv":[{"id":"CVE-2013-1802","description":"The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.","status":"published","published":"2013-04-09T20:55:01Z","modified":"2026-04-10T03:42:43.805089Z","updated_at":"2026-11-02T15:43:58.802805Z"},{"id":"DEBIAN-CVE-2013-1802","description":"The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.","status":"published","published":"2013-04-09T20:55:01.977Z","modified":"2026-09-01T20:03:15.032485058Z","updated_at":"2026-11-02T15:45:25.218101Z"},{"id":"DLA-172-1","title":"libextlib-ruby - security update","status":"published","published":"2015-03-14T00:00:00Z","modified":"2026-03-09T01:22:55.480232Z","updated_at":"2026-11-02T15:46:09.777694Z"},{"id":"GHSA-9h36-4jf2-hx53","title":"extlib does not properly restrict casts of string values","description":"The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.","status":"published","published":"2017-10-24T18:33:37Z","modified":"2024-12-03T06:13:32.447283Z","cwes":["CWE-704"],"updated_at":"2026-11-02T15:46:43.875515Z"},{"id":"UBUNTU-CVE-2013-1802","description":"The extlib gem 0.9.15 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.","status":"withdrawn","published":"2013-04-09T20:55:00Z","modified":"2025-07-16T08:10:41.942808Z","updated_at":"2026-11-02T15:54:06.854805Z"}]}}