multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
| Date Added | Due Date | Vulnerability Name | Required Action |
|---|---|---|---|
| N/A |
| Type | Version | Base score | Base severity | Vector |
|---|---|---|---|---|
| Primary | 2.0 | 7.5 | HIGH | AV:N/AC:L/Au:N/C:P/I:P/A:P |
| Hyperlink | Source | Resource |
|---|---|---|
| http://www.openwall.com/lists/oss-security/2013/01/11/9 | secalert@redhat.com | N/A |
| https://gist.github.com/nate/d7f6d9f4925f413621aa | secalert@redhat.com | N/A |
| https://github.com/sferik/multi_xml/pull/34 | secalert@redhat.com | N/A |
| https://groups.google.com/forum/?fromgroups=#%21topic/ruby-grape/fthDkMgIOa0 | secalert@redhat.com | N/A |
| https://news.ycombinator.com/item?id=5040457 | secalert@redhat.com | N/A |
| http://www.openwall.com/lists/oss-security/2013/01/11/9 | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| https://gist.github.com/nate/d7f6d9f4925f413621aa | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| https://github.com/sferik/multi_xml/pull/34 | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| https://groups.google.com/forum/?fromgroups=#%21topic/ruby-grape/fthDkMgIOa0 | af854a3a-2127-422b-91ae-364da2661108 | N/A |
| https://news.ycombinator.com/item?id=5040457 | af854a3a-2127-422b-91ae-364da2661108 | N/A |