nori contains Improper Input Validation
High severity
GitHub Reviewed
Published
Oct 24, 2017
to the GitHub Advisory Database
•
Updated Aug 25, 2023
Package
Affected versions
>= 2.0.0, < 2.0.2
>= 1.1.0, < 1.1.4
>= 1.0.0, < 1.0.3
Patched versions
2.0.2
1.1.4
1.0.3
Description
Published to the GitHub Advisory Database
Oct 24, 2017
Reviewed
Jun 16, 2020
Last updated
Aug 25, 2023
Credits
-
tdunlap607 Analyst
The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
References