The httparty gem 0.9.0 and earlier for Ruby does not properly restrict casts of string values, which might allow remote attackers to conduct object-injection attacks and execute arbitrary code, or cause a denial of service (memory and CPU consumption) by leveraging Action Pack support for YAML type conversion, a similar vulnerability to CVE-2013-0156.
References
Configurations
Configuration 1 (hide)
|
History
07 Jan 2026, 19:27
| Type | Values Removed | Values Added |
|---|---|---|
| First Time |
Jnunemaker
Jnunemaker httparty |
|
| CPE | cpe:2.3:a:john_nunemaker:httparty:0.4.3:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.7.6:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.7.3:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.1.6:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.2.7:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.7.8:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.4.5:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.2.6:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.5.0:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:*:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.2.1:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.8.3:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.5.1:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.6.0:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.7.1:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.8.1:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.4.4:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.4.1:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.1.2:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.7.0:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.7.5:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.5.2:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.4.0:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.2.0:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.1.8:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.2.4:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.2.9:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.3.1:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.4.2:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.7.2:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.7.7:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.2.5:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.8.0:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.8.2:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.2.8:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.2.10:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.1.1:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.2.2:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.1.3:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.1.7:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.1.0:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.1.5:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.6.1:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.2.3:*:*:*:*:*:*:* cpe:2.3:a:john_nunemaker:httparty:0.3.0:*:*:*:*:*:*:* |
cpe:2.3:a:jnunemaker:httparty:0.4.2:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.8.2:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.1.0:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.3.1:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.4.0:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.2.5:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.7.3:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.2.6:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.7.4:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.1.1:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.2.8:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.1.3:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.1.8:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.2.10:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.8.0:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.7.2:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.1.7:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.1.2:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.8.3:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.1.5:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.2.4:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:*:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.4.1:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.7.1:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.2.7:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.2.0:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.3.0:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.2.2:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.5.0:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.7.6:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.6.0:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.7.7:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.2.3:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.5.2:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.4.4:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.5.1:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.2.9:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.7.5:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.7.8:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.8.1:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.4.3:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.4.5:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.7.0:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.2.1:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.6.1:*:*:*:*:*:*:* cpe:2.3:a:jnunemaker:httparty:0.1.6:*:*:*:*:*:*:* |
21 Nov 2024, 01:50
| Type | Values Removed | Values Added |
|---|---|---|
| References | () http://www.securityfocus.com/bid/58260 - | |
| References | () https://bugzilla.redhat.com/show_bug.cgi?id=917229 - | |
| References | () https://github.com/jnunemaker/httparty/commit/53a812426dd32108d6cba4272b493aa03bc8c031 - Exploit, Patch | |
| References | () https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately - |
Information
Published : 2013-04-09 20:55
Updated : 2026-01-07 19:27
NVD link : CVE-2013-1801
Mitre link : CVE-2013-1801
CVE.ORG link : CVE-2013-1801
JSON object : View
Products Affected
jnunemaker
- httparty
CWE
CWE-264
Permissions, Privileges, and Access Controls