Information disclosure in Newrelic Ruby Agent

CVE-2013-0284

Ruby agent 3.2.0 through 3.5.2 serializes sensitive data when communicating with servers operated by New Relic, which allows remote attackers to obtain sensitive information (database credentials and SQL statements) by sniffing the network and deserializing the data.

Vulnerability class: Information Disclosure

EPSS: 0.013 (66.4th percentile) — read the EPSS interpretation.

Affected products

Newrelic Ruby_agent — versions 3.2.0, 3.3.0, 3.3.1
N/a — versions n/a

Weakness classification (CWE)

CWE-200 — Information Disclosure

References

secalert@redhat.com (mailing-list, x_refsource_MLIST)
secalert@redhat.com (x_refsource_CONFIRM, Vendor Advisory)