CVE-2013-2065
UnknownEPSS 2.51%
Last modified
CVE-2013-2065 is a vulnerability of currently unknown severity. (1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypass intended $SAFE level restrictions.. EPSS estimates a 2.51% chance of exploitation in the next 30 days.
Description
(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypass intended $SAFE level restrictions.
Metrics
Weakness Enumeration
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Opensuse | Opensuse | 12.2 |
| Opensuse | Opensuse | 12.3 |
| Ruby-Lang | Ruby | 1.9 |
| Ruby-Lang | Ruby | 1.9.1 |
| Ruby-Lang | Ruby | 1.9.2 |
| Ruby-Lang | Ruby | 1.9.3 |
| Ruby-Lang | Ruby | 2.0 |
| Ruby-Lang | Ruby | 2.0.0 |
References
- https://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/Exploit, Patch, Vendor Advisory
- https://www.ruby-lang.org/en/news/2013/05/14/taint-bypass-dl-fiddle-cve-2013-2065/Exploit, Patch, Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2013-2065?
(1) DL and (2) Fiddle in Ruby 1.9 before 1.9.3 patchlevel 426, and 2.0 before 2.0.0 patchlevel 195, do not perform taint checking for native functions, which allows context-dependent attackers to bypass intended $SAFE level restrictions.
How severe is CVE-2013-2065?
Severity scoring for CVE-2013-2065 is pending analysis. The EPSS model estimates a 2.51% probability of exploitation in the next 30 days.
How do I fix CVE-2013-2065?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2013
- CVE-2013-2059OpenStack Identity (Keystone) Folsom 2012.2.4 and earlier, G…
- CVE-2013-2060The download_from_url function in OpenShift Origin allows re…9.8
- CVE-2013-2061The openvpn_decrypt function in crypto.c in OpenVPN 2.3.0 an…
- CVE-2013-2062Multiple integer overflows in X.org libXp 1.0.1 and earlier …
- CVE-2013-2063Integer overflow in X.org libXtst 1.2.1 and earlier allows X…
- CVE-2013-2064Integer overflow in X.org libxcb 1.9 and earlier allows X se…
- CVE-2013-2066Buffer overflow in X.org libXv 1.0.7 and earlier allows X se…
- CVE-2013-2067java/org/apache/catalina/authenticator/FormAuthenticator.jav…
- CVE-2013-2068Multiple directory traversal vulnerabilities in the AgentCon…
- CVE-2013-2069Red Hat livecd-tools before 13.4.4, 17.x before 17.17, 18.x …
- CVE-2013-2070http/modules/ngx_http_proxy_module.c in nginx 1.1.4 through …
- CVE-2013-2071java/org/apache/catalina/core/AsyncContextImpl.java in Apach…
Are you affected by CVE-2013-2065?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST