Candidate: CVE-2013-0285
PublicDate: 2013-04-09 20:55:00 UTC
References: 
 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2013-0285
Description:
 The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3
 for Ruby does not properly restrict casts of string values, which allows
 remote attackers to conduct object-injection attacks and execute arbitrary
 code, or cause a denial of service (memory and CPU consumption) involving
 nested XML entity references, by leveraging Action Pack support for (1)
 YAML type conversion or (2) Symbol type conversion, a similar vulnerability
 to CVE-2013-0156.
Ubuntu-Description: 
Notes: 
 mdeslaur> in Oneiric+, rails package is just for transition
Bugs: 
Priority: medium
Discovered-by:
Assigned-to: 
CVSS: 

Patches_rails:
 upstream: https://groups.google.com/group/rubyonrails-security/attach/c1432d0f8c70e89d/2-3-xml_parsing.patch?part=3 (2.3)
 upstream: https://groups.google.com/group/rubyonrails-security/attach/c1432d0f8c70e89d/3-0-xml_parsing.patch?part=4 (3.0)
 upstream: https://groups.google.com/group/rubyonrails-security/attach/c1432d0f8c70e89d/3-1-xml_parsing.patch?part=5 (3.1)
 upstream: https://groups.google.com/group/rubyonrails-security/attach/c1432d0f8c70e89d/3-2-xml_parsing.patch?part=6 (3.2)
upstream_rails: released (3.2.11, 3.1.10, 3.0.19, 2.3.15)
hardy_rails: ignored (reached end-of-life)
lucid_rails: ignored (reached end-of-life)
oneiric_rails: not-affected (contains no code)
precise_rails: not-affected (contains no code)
precise/esm_rails: DNE (precise was not-affected [contains no code])
quantal_rails: not-affected (contains no code)
raring_rails: not-affected (contains no code)
saucy_rails: not-affected (contains no code)
trusty_rails: not-affected (contains no code)
trusty/esm_rails: DNE (trusty was not-affected [contains no code])
utopic_rails: not-affected (contains no code)
vivid_rails: not-affected (contains no code)
vivid/stable-phone-overlay_rails: DNE
vivid/ubuntu-core_rails: DNE
wily_rails: not-affected (contains no code)
xenial_rails: not-affected (contains no code)
yakkety_rails: not-affected (contains no code)
zesty_rails: not-affected (contains no code)
devel_rails: not-affected (contains no code)

Patches_ruby-actionpack-2.3:
 upstream: https://groups.google.com/group/rubyonrails-security/attach/c1432d0f8c70e89d/2-3-xml_parsing.patch?part=3 (2.3)
upstream_ruby-actionpack-2.3: ignored (reached end-of-life)
hardy_ruby-actionpack-2.3: DNE
lucid_ruby-actionpack-2.3: DNE
oneiric_ruby-actionpack-2.3: ignored (reached end-of-life)
precise_ruby-actionpack-2.3: ignored (reached end-of-life)
precise/esm_ruby-actionpack-2.3: DNE (precise was needed)
quantal_ruby-actionpack-2.3: ignored (reached end-of-life)
raring_ruby-actionpack-2.3: ignored (reached end-of-life)
saucy_ruby-actionpack-2.3: ignored (reached end-of-life)
trusty_ruby-actionpack-2.3: DNE
trusty/esm_ruby-actionpack-2.3: DNE
utopic_ruby-actionpack-2.3: DNE
vivid_ruby-actionpack-2.3: DNE
vivid/stable-phone-overlay_ruby-actionpack-2.3: DNE
vivid/ubuntu-core_ruby-actionpack-2.3: DNE
wily_ruby-actionpack-2.3: DNE
xenial_ruby-actionpack-2.3: DNE
yakkety_ruby-actionpack-2.3: DNE
zesty_ruby-actionpack-2.3: DNE
devel_ruby-actionpack-2.3: DNE

Patches_ruby-actionpack-3.2:
 upstream: https://groups.google.com/group/rubyonrails-security/attach/c1432d0f8c70e89d/3-2-xml_parsing.patch?part=6 (3.2)
upstream_ruby-actionpack-3.2: released (3.2.11)
hardy_ruby-actionpack-3.2: DNE
lucid_ruby-actionpack-3.2: DNE
oneiric_ruby-actionpack-3.2: DNE
precise_ruby-actionpack-3.2: DNE
precise/esm_ruby-actionpack-3.2: DNE
quantal_ruby-actionpack-3.2: ignored (reached end-of-life)
raring_ruby-actionpack-3.2: ignored (reached end-of-life)
saucy_ruby-actionpack-3.2: not-affected (3.2.13-7)
trusty_ruby-actionpack-3.2: not-affected (3.2.16-3)
trusty/esm_ruby-actionpack-3.2: DNE (trusty was not-affected [3.2.16-3])
utopic_ruby-actionpack-3.2: DNE
vivid_ruby-actionpack-3.2: DNE
vivid/stable-phone-overlay_ruby-actionpack-3.2: DNE
vivid/ubuntu-core_ruby-actionpack-3.2: DNE
wily_ruby-actionpack-3.2: DNE
xenial_ruby-actionpack-3.2: DNE
yakkety_ruby-actionpack-3.2: DNE
zesty_ruby-actionpack-3.2: DNE
devel_ruby-actionpack-3.2: DNE