Bug 453844 (CVE-2013-0333) – <dev-ruby/rails-{2.3.16,3.0.20}: JSON parsing ACE (CVE-2013-0333)

• Product: Gentoo Security
• Status: RESOLVED FIXED

[Description Alex Legler (RETIRED) 2013-01-24 15:12:36 UTC]

Michael Koziarski informed us about this issue via linux-distros:

There is a vulnerability in the JSON  code for Ruby on Rails which
allows attackers to bypass authentication systems, inject arbitrary SQL,
inject and execute arbitrary code, or perform a DoS attack on a Rails
application. This vulnerability has been assigned the CVE identifier
CVE-2013-0333.

Versions Affected:  2.3.x, 3.0.x
Not Affected:       3.1.x, 3.2.x
Fixed Versions:     3.0.20, 2.3.16

Impact
------
The JSON Parsing code in Rails 2.3 and 3.0 support multiple parsing
backends.  One of the backends involves transforming the JSON into YAML,
and passing that through the YAML parser.  Using a specially crafted
payload attackers can trick the backend into decoding a subset of YAML.

Note: This is a seperate vulnerability to CVE-2013-0156, if you are
running a 2.3 or 3.0 application you must still take action to protect
your application.

Releases
--------
The 3.0.20 and 2.3.16 releases are available at the normal locations.

Workarounds
-----------
To work around this vulnerability you need to switch backends to the
JsonGem backend.  Place this code in an application initializer:

  ActiveSupport::JSON.backend = "JSONGem"

If you are running Ruby 1.8 you will need to ensure that the json or
json_pure gems are installed and in your application's Gemfile.  Ruby
1.9 includes this code already.

[Comment 1 Alex Legler (RETIRED) 2013-01-24 15:15:41 UTC]

Hans, do we wait for official packages to appear or do we patch and try to squeeze arches in in the remaining 4 days? The patch seems to be restricted to activesupport.

[Comment 2 Hans de Graaff 2013-01-28 21:41:22 UTC]

dev-ruby/rails:2.3 and dependencies are now in the tree, so these can be marked stable.

[Comment 3 Hans de Graaff 2013-01-28 22:25:33 UTC]

Rails 3.0 is now also in the tree.

[Comment 4 Sean Amoss (RETIRED) 2013-01-31 13:39:08 UTC]

Opening this up as it is now public. 

Arches, please test and mark stable:

=dev-ruby/activesupport-2.3.16
=dev-ruby/activeresource-2.3.16
=dev-ruby/actionpack-2.3.16
=dev-ruby/actionmailer-2.3.16
=dev-ruby/activerecord-2.3.16
=dev-ruby/rails-2.3.16

Target KEYWORDS: "amd64 ppc ppc64 x86"

[Comment 5 GLSAMaker/CVETool Bot 2013-01-31 13:39:23 UTC]

CVE-2013-0333 (http://nvd.nist.gov/nvd.cfm?cvename=CVE-2013-0333):
  lib/active_support/json/backends/yaml.rb in Ruby on Rails 2.3.x before
  2.3.16 and 3.0.x before 3.0.20 does not properly convert JSON data to YAML
  data for processing by a YAML parser, which allows remote attackers to
  execute arbitrary code, conduct SQL injection attacks, or bypass
  authentication via crafted data that triggers unsafe decoding, a different
  vulnerability than CVE-2013-0156.

[Comment 6 Agostino Sarubbo 2013-01-31 17:44:08 UTC]

amd64 stable

[Comment 7 Agostino Sarubbo 2013-01-31 17:45:21 UTC]

x86 stable

[Comment 8 Agostino Sarubbo 2013-01-31 17:46:32 UTC]

ppc stable

[Comment 9 Agostino Sarubbo 2013-01-31 17:47:43 UTC]

ppc64 stable

[Comment 10 Sean Amoss (RETIRED) 2013-01-31 18:50:09 UTC]

Added on existing GLSA draft.

[Comment 11 GLSAMaker/CVETool Bot 2014-12-14 20:36:06 UTC]

This issue was resolved and addressed in
 GLSA 201412-28 at http://security.gentoo.org/glsa/glsa-201412-28.xml
by GLSA coordinator Sean Amoss (ackle).