multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly restrict casts of string values, which allows remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a similar vulnerability to CVE-2013-0156.

There are packages installed that are affected by a vulnerability referenced in the following CVE:

  - multi_xml gem 0.5.2 for Ruby, as used in Grape before 0.2.6 and possibly other products, does not properly
    restrict casts of string values, which allows remote attackers to conduct object-injection attacks and
    execute arbitrary code, or cause a denial of service (memory and CPU consumption) involving nested XML
    entity references, by leveraging support for (1) YAML type conversion or (2) Symbol type conversion, a
    similar vulnerability to CVE-2013-0156. (CVE-2013-0175)

Fix for CVE-2013-0175.

Note that Tenable Network Security has extracted the preceding description block directly from the Fedora security advisory. Tenable has attempted to automatically clean and format it as much as possible without introducing additional issues.

ID	Name	Product	Family	Severity
422749	SCA: security update for multi_xml (GHSA-pchc-949f-53m5)	Tenable Cloud Security	SCA Checks	critical
422749	SCA: security update for multi_xml (GHSA-pchc-949f-53m5)	Tenable Self-Hosted Container Security	SCA Checks	critical
64252	Fedora 17 : rubygem-multi_xml-0.4.1-4.fc17 (2013-0839)	Nessus	Fedora Local Security Checks	high
64086	Fedora 18 : rubygem-multi_xml-0.4.1-5.fc18 (2013-0808)	Nessus	Fedora Local Security Checks	high

Detections

Analytics

CVE-2013-0175

critical

Tenable Plugins

critical

critical

high

high