| Package | Affected versions | Patched versions |
|---|---|---|
| nori | ≥ 1.0.0, < 1.0.3≥ 1.1.0, < 1.1.4≥ 2.0.0, < 2.0.2 | 1.0.31.1.42.0.2 |
| nori gem | = 1.0.0= 1.0.1= 1.0.2= 1.1.0= 1.1.1= 1.1.2= 1.1.3= 2.0.0= 2.0.1 |
The nori gem 2.0.x before 2.0.2, 1.1.x before 1.1.4, and 1.0.x before 1.0.3 for Ruby does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free