Alpine: multiple ruby-actionmailer packages: security update to 3.2.8-r0 (deprecated)

critical Tenable Cloud Security Plugin ID 401182

Description

There are packages installed that are affected by multiple vulnerabilities referenced in the following CVEs:

- Ruby on Rails 3.0.x before 3.0.19, 3.1.x before 3.1.10, and 3.2.x before 3.2.11 does not properly consider
differences in parameter handling between the Active Record component and the JSON implementation, which
allows remote attackers to bypass intended database-query restrictions and perform NULL checks or trigger
missing WHERE clauses via a crafted request, as demonstrated by certain "[nil]" values, a related issue to
CVE-2012-2660 and CVE-2012-2694. (CVE-2013-0155)

- active_support/core_ext/hash/conversions.rb in Ruby on Rails before 2.3.15, 3.0.x before 3.0.19, 3.1.x
before 3.1.10, and 3.2.x before 3.2.11 does not properly restrict casts of string values, which allows
remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of
service (memory and CPU consumption) involving nested XML entity references, by leveraging Action Pack
support for (1) YAML type conversion or (2) Symbol type conversion. (CVE-2013-0156)

Plugin Details

Severity: Critical

ID: 401182

Version: Revision 1.25

Type: Local

Family: Alpine Linux Local Security Checks

Published: 8/16/2023

Updated: 7/2/2026

Supported Sensors: Agentless Assessment, Tenable Cloud Security, Tenable Self-Hosted Container Security

Risk Information

VPR

Risk Factor: Medium

Score: 5.6

Percentile: 96.53

CVSS v2

Risk Factor: High

Base Score: 7.5

Temporal Score: 6.2

Vector: CVSS2#AV:N/AC:L/Au:N/C:P/I:P/A:P

CVSS Score Source: CVE-2013-0156

CVSS v3

Risk Factor: Critical

Base Score: 9.8

Temporal Score: 9.1

Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

Temporal Vector: CVSS:3.0/E:F/RL:O/RC:C

Vulnerability Information

Exploit Available: true

Exploit Ease: Exploits are available

Patch Publication Date: 1/10/2013

Vulnerability Publication Date: 1/8/2013

Exploitable With

Metasploit (Ruby on Rails XML Processor YAML Deserialization Code Execution)

Reference Information

CVE: CVE-2013-0155, CVE-2013-0156

BID: 57187, 57192

Detections

Analytics