Predictive Vulnerability Intelligence.

Product

  • Product
  • Pricing
  • Documentation

Company

  • About
  • Partnerships
  • Blog
  • Support

Legal

  • Terms
  • Privacy
  • Data Licensing

© 2026 FAUCET Technologies LLC. All rights reserved.

CVE-2013-4389

19
FAUCET Score

CVE-2013-4389 describes multiple format string vulnerabilities in Action Mailer's log subscriber component in Ruby on Rails 3.x before version 3.2.15, affecting various Debian and OpenSUSE distributions. An unauthenticated remote attacker can trigger a denial of service by sending a specially crafted email address that is mishandled during log message construction. This vulnerability has a CVSS score of 4.3, indicating a medium attack complexity and partial availability impact, but no confidentiality or integrity impact. There is no evidence of active exploitation, publicly available exploit code, or significant community discussion or media coverage.

Impacted Technologies

VendorProductVersion(s)CPE
>= 3.0.0, < 3.2.15CPE matchmatch criteria
cpe:2.3:a:rubyonrails:rails:*:*:*:*:*:*:*:*
12.2CPE matchmatch criteria
cpe:2.3:o:opensuse:opensuse:12.2:*:*:*:*:*:*:*
12.3CPE matchmatch criteria
cpe:2.3:o:opensuse:opensuse:12.3:*:*:*:*:*:*:*
13.1CPE matchmatch criteria
cpe:2.3:o:opensuse:opensuse:13.1:*:*:*:*:*:*:*
7.0CPE matchmatch criteria
cpe:2.3:o:debian:debian_linux:7.0:*:*:*:*:*:*:*

CVSS Data

CVSS version used by this source: 2.0

4.3MEDIUM

AV:N/AC:M/Au:N/C:N/I:N/A:P

Confidentiality Impact
NONE
Integrity Impact
NONE
Availability Impact
PARTIAL
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Exploitability Score
8.6
Impact Score
2.9
CvssVersion
2.0

Exploit Intelligence

EPSS Score
3.14%
Probability of exploitation in next 30 days
EPSS Percentile
86.5%
Percentile rank of EPSS score among Peer Group
As of 2026-07-28
Model: v2026.06.15
This CVE's current EPSS score of 0.0314 is in the 80th percentile among its peer group of 19,958 CVEs.

Social Chatter

The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.

Media Mentions

No media coverage found for this CVE.

The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.

Remediation

Patch Available

Vendor Patches (29)

redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.4Fixed in: wmi-0:1.3.14-1.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.4Fixed in: cfme-0:5.4.0.5-1.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.4Fixed in: cfme-gemset-0:5.4.0.5-1.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.4Fixed in: cfme-vnc-plugin-0:1.0.0-2.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.4Fixed in: libdnet-0:1.12-11.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.4Fixed in: lshw-0:B.02.16-4.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.4Fixed in: netapp-manageability-sdk-0:4.0P1-3.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.4Fixed in: open-vm-tools-0:9.2.3-5.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.4Fixed in: prince-0:9.0r2-4.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.4Fixed in: pyliblzma-0:0.5.3-7.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.4Fixed in: ruby200-rubygem-bcrypt-ruby-0:3.0.1-2.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.4Fixed in: ruby200-rubygem-eventmachine-0:1.0.7-2.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.4Fixed in: ruby200-rubygem-ffi-0:1.9.8-1.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.4Fixed in: ruby200-rubygem-io-extra-0:1.2.8-1.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.4Fixed in: ruby200-rubygem-json-0:1.8.2-2.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.4Fixed in: ruby200-rubygem-nokogiri-0:1.5.11-2.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.4Fixed in: ruby200-rubygem-pg-0:0.12.2-9.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.4Fixed in: ruby200-rubygem-psych-0:2.0.13-1.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.4Fixed in: ruby200-rubygem-qpid_messaging-0:0.20.2-5.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.4Fixed in: ruby200-rubygem-therubyracer-0:0.11.0-5.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.4Fixed in: ruby200-rubygem-thin-0:1.3.1-9.el6cf
View patch
redhatpatch availablevia redhat_api
Product: CloudForms Management Engine 5.4Fixed in: sneakernet_ca-0:0.1-2.el6cf
View patch
rubygemspatch availablevia ghsa
Product: actionmailerFixed in: 3.2.15
redhatend of lifevia redhat_api
Product: OpenShift Enterprise 1Fixed in: ruby193-rubygem-actionmailer
redhatend of lifevia redhat_api
Product: Red Hat OpenStack Platform 3Fixed in: ruby193-rubygem-actionmailer
redhatend of lifevia redhat_api
Product: Red Hat OpenStack Platform 4Fixed in: ruby193-rubygem-actionmailer
redhatend of lifevia redhat_api
Product: Red Hat Satellite 6Fixed in: ruby193-rubygem-actionmailer
redhatend of lifevia redhat_api
Product: Red Hat Software CollectionsFixed in: ruby193-rubygem-actionmailer
redhatend of lifevia redhat_api
Product: Red Hat Subscription Asset ManagerFixed in: ruby193-rubygem-actionmailer

Vendor Advisories (2)

rubygemsGHSA-rg5m-3fqp-6px8medium

actionmailer email address processing causes Denial of service

Oct 24, 2017
redhatCVE-2013-4389Low

rubygem-actionmailer: email address processing DoS

Oct 16, 2013

References

lists.opensuse.org / opensuse-updates/2013-12/msg00091.html
Mailing ListThird Party Advisory
lists.opensuse.org / opensuse-updates/2013-12/msg00094.html
Mailing ListThird Party Advisory
lists.opensuse.org / opensuse-updates/2014-01/msg00003.html
Mailing ListThird Party Advisory
groups.google.com / forum/message/raw
Broken LinkExploit
debian.org / security/2014/dsa-2887
Third Party Advisory
debian.org / security/2014/dsa-2888
Third Party Advisory