{"containers": {"cna": {"affected": [{"product": "n/a", "vendor": "n/a", "versions": [{"status": "affected", "version": "n/a"}]}], "descriptions": [{"lang": "en", "value": "The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for YAML type conversion, a similar vulnerability to CVE-2013-0156."}], "problemTypes": [{"descriptions": [{"description": "n/a", "lang": "en", "type": "text"}]}], "providerMetadata": {"orgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "shortName": "redhat", "dateUpdated": "2013-04-09T20:00:00Z"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://github.com/jnunemaker/httparty/commit/53a812426dd32108d6cba4272b493aa03bc8c031"}, {"tags": ["x_refsource_MISC"], "url": "https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately"}, {"tags": ["x_refsource_MISC"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=917229"}, {"name": "58260", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/58260"}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-06T15:13:32.978Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://github.com/jnunemaker/httparty/commit/53a812426dd32108d6cba4272b493aa03bc8c031"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://bugzilla.redhat.com/show_bug.cgi?id=917229"}, {"name": "58260", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/58260"}]}]}, "cveMetadata": {"assignerOrgId": "53f830b8-0a3f-465b-8143-3b8a9948e749", "assignerShortName": "redhat", "cveId": "CVE-2013-1801", "state": "PUBLISHED", "dateReserved": "2013-02-19T00:00:00Z", "datePublished": "2013-04-09T20:00:00Z", "dateUpdated": "2024-08-06T15:13:32.978Z"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:jnunemaker:httparty:*:*:*:*:*:*:*:*", "matchCriteriaId": "2ED5857F-9ABD-45AA-8C4B-2B269C6C1481", "versionEndIncluding": "0.9.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.1.0:*:*:*:*:*:*:*", "matchCriteriaId": "D5A4B16E-13D0-4E9A-8C72-6A1081571865", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.1.1:*:*:*:*:*:*:*", "matchCriteriaId": "29711B3B-8476-4568-88F4-75ED5C0A7047", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.1.2:*:*:*:*:*:*:*", "matchCriteriaId": "44343172-7A9B-49BC-812D-0F43066D5591", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.1.3:*:*:*:*:*:*:*", "matchCriteriaId": "B7A18013-FA26-4DDA-A89C-21EC3A1B72F4", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.1.5:*:*:*:*:*:*:*", "matchCriteriaId": "F03732EB-484D-4331-BEAA-EB77E7A71C48", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.1.6:*:*:*:*:*:*:*", "matchCriteriaId": "EF35A697-E318-4A3B-8AE2-57735BFAA98C", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.1.7:*:*:*:*:*:*:*", "matchCriteriaId": "4D554267-914B-4C99-B601-5E667296A643", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.1.8:*:*:*:*:*:*:*", "matchCriteriaId": "0EDD40E9-7404-498C-81B6-B66867DFF1B4", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.2.0:*:*:*:*:*:*:*", "matchCriteriaId": "689F81DE-0A25-4E88-9E3B-C43AEEE567E1", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.2.1:*:*:*:*:*:*:*", "matchCriteriaId": "9F9521F0-11EE-4031-98BC-9E184670DF48", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.2.2:*:*:*:*:*:*:*", "matchCriteriaId": "55664D1C-3E21-4B80-85E5-E55144C0EAAD", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.2.3:*:*:*:*:*:*:*", "matchCriteriaId": "EB08A3C1-FDF3-411E-A155-58AAC8EB3E3A", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.2.4:*:*:*:*:*:*:*", "matchCriteriaId": "9B65C4F7-8BEF-4E10-9389-D1C857E96CA5", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.2.5:*:*:*:*:*:*:*", "matchCriteriaId": "18D8DA1C-74D9-4B73-B119-F5F80425C1FD", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.2.6:*:*:*:*:*:*:*", "matchCriteriaId": "ABDB453F-6346-424C-A382-7ADBE65994B4", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.2.7:*:*:*:*:*:*:*", "matchCriteriaId": "6213EA1B-6C9C-4F40-A8D7-92C43752F563", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.2.8:*:*:*:*:*:*:*", "matchCriteriaId": "B1C9B9E9-13C8-4B9E-9124-2F32F54D6915", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.2.9:*:*:*:*:*:*:*", "matchCriteriaId": "026952C2-36DE-4591-835F-1324CEAA1C82", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.2.10:*:*:*:*:*:*:*", "matchCriteriaId": "EA9AAB6C-7499-4C1B-A729-BC1DADA82B49", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.3.0:*:*:*:*:*:*:*", "matchCriteriaId": "14462D58-D4A2-4A66-BD52-716C32AF79F3", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.3.1:*:*:*:*:*:*:*", "matchCriteriaId": "E67E118F-BF27-460B-9371-CAB848266B59", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.4.0:*:*:*:*:*:*:*", "matchCriteriaId": "6DE27474-24BD-4097-BB17-E66CA4E01496", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.4.1:*:*:*:*:*:*:*", "matchCriteriaId": "9A205E25-6924-417D-A2BF-D2075FBFA595", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.4.2:*:*:*:*:*:*:*", "matchCriteriaId": "A970523F-713A-4D98-B97F-B49C0434BF21", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.4.3:*:*:*:*:*:*:*", "matchCriteriaId": "230E2E2E-C3FF-41F8-B6E0-C4E024B13102", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.4.4:*:*:*:*:*:*:*", "matchCriteriaId": "DCCA473E-7D3A-4BB2-8D5B-93CBDE4F801C", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.4.5:*:*:*:*:*:*:*", "matchCriteriaId": "93D8289A-8834-4952-9C93-29B8FB5F7830", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.5.0:*:*:*:*:*:*:*", "matchCriteriaId": "467AAA79-E7F6-4CE6-841F-34810B37060A", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.5.1:*:*:*:*:*:*:*", "matchCriteriaId": "35A1132A-8C54-48B2-9D63-C7CAE705927A", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.5.2:*:*:*:*:*:*:*", "matchCriteriaId": "A1093336-1197-42F1-8DD7-AA37D46636F6", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.6.0:*:*:*:*:*:*:*", "matchCriteriaId": "2EF331F5-CD97-4303-8D60-191722CBAB24", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.6.1:*:*:*:*:*:*:*", "matchCriteriaId": "84DEC960-1853-4494-8028-44D2E18C5D61", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.7.0:*:*:*:*:*:*:*", "matchCriteriaId": "65CD93F2-A028-443F-BA81-1EB96BFB3635", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.7.1:*:*:*:*:*:*:*", "matchCriteriaId": "FD0950F8-2B1C-4EC8-8C32-312AEEB215EA", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.7.2:*:*:*:*:*:*:*", "matchCriteriaId": "8C14DF30-2592-4032-BD1A-21B10A0E939B", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.7.3:*:*:*:*:*:*:*", "matchCriteriaId": "9BB05F5F-E22F-4AED-965E-9D632C7E65E5", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.7.4:*:*:*:*:*:*:*", "matchCriteriaId": "ECA12B0D-8A70-443B-B005-8DD505F3AA52", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.7.5:*:*:*:*:*:*:*", "matchCriteriaId": "EA83B2B5-DDCC-4C4C-BC8A-2726ACC87CA7", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.7.6:*:*:*:*:*:*:*", "matchCriteriaId": "0B42A50E-B624-4D06-9F67-CCC47B0A6CDF", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.7.7:*:*:*:*:*:*:*", "matchCriteriaId": "DADEDB3F-6D9B-4450-B6A9-ACFEF29DE94C", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.7.8:*:*:*:*:*:*:*", "matchCriteriaId": "C40FB5C7-BDA6-4367-A24B-BBB3048F9E1F", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.8.0:*:*:*:*:*:*:*", "matchCriteriaId": "6264245A-8779-45B1-B9EE-2EC7A2CF91D9", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.8.1:*:*:*:*:*:*:*", "matchCriteriaId": "62AABC5D-CAC9-4C4B-A182-EB9E0FB112B2", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.8.2:*:*:*:*:*:*:*", "matchCriteriaId": "45765FAD-3D80-498B-8CA3-E483ECF15DC2", "vulnerable": true}, {"criteria": "cpe:2.3:a:jnunemaker:httparty:0.8.3:*:*:*:*:*:*:*", "matchCriteriaId": "6E261B7B-47B7-4E8F-830E-28E232B7548A", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for YAML type conversion, a similar vulnerability to CVE-2013-0156."}, {"lang": "es", "value": "La gema httparty 0.9.0 y anteriores para Ruby no restringe adecuadamente las conversiones de los valores de cadena, lo que podr\u00eda permitir a atacantes remotos llevar a cabo ataques de inyecci\u00f3n de objetos y la ejecuci\u00f3n de c\u00f3digo arbitrario o provocar incluso una denegaci\u00f3n de servicio (consumo de memoria y CPU), aprovechando el soporte Action Pack para los conversores de tipo YALM . Vulnerabilidad similar a CVE-2013-0156."}], "id": "CVE-2013-1801", "lastModified": "2026-01-07T19:27:17.147", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "LOW", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 7.5, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 10.0, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": false}]}, "published": "2013-04-09T20:55:01.960", "references": [{"source": "secalert@redhat.com", "url": "http://www.securityfocus.com/bid/58260"}, {"source": "secalert@redhat.com", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=917229"}, {"source": "secalert@redhat.com", "tags": ["Exploit", "Patch"], "url": "https://github.com/jnunemaker/httparty/commit/53a812426dd32108d6cba4272b493aa03bc8c031"}, {"source": "secalert@redhat.com", "url": "https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "http://www.securityfocus.com/bid/58260"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=917229"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit", "Patch"], "url": "https://github.com/jnunemaker/httparty/commit/53a812426dd32108d6cba4272b493aa03bc8c031"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "url": "https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately"}], "sourceIdentifier": "secalert@redhat.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-264"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{}