Ruby on Rails 3.0.20 and 2.3.16 Released to Address Extremely Critical Vulnerability #ccureit

Ruby on Rails 3.0.20 and 2.3.16 Released to Address Extremely Critical Vulnerability

Ruby on Rails 3.0.20 and 2.3.16 Released to Address Extremely Critical Vulnerability #ccureit

Ruby on Rails 3.0.20 and 2.3.16 have been released. Users are advised to update their installations as soon as possible because the new releases address an extremely critical vulnerability. Ruby on Rails 2.3.x and Ruby on Rails 3.0.x are affected by the security hole. The vulnerability, present in the JSON code, can be leveraged by hackers to bypass authentication, inject arbitrary SQL commands, execute arbitrary code, and even perform DOS attack against Rails applications. “The JSON Parsing code in Rails 2.3 and 3.0 support multiple parsing backends. One of the backends involves transforming the JSON into YAML, and passing that through the YAML parser. Using a specially crafted payload attackers can trick the backend into decoding a subset of YAML,” reads the

Full article: http://news.softpedia.com/news/Ruby-on-Rails-3-0-20-and-2...

Tweets

@infination » 30 Jan '13, 5pm
Ruby on Rails 3.0.20, 2.3.16 Released to Address Extremely Critical #Vulnerability [link] @softpedia #security #dev #infosec
@JARJISMe » 29 Jan '13, 10pm
RT @binitamshah: Ruby on Rails 3.0.20 and 2.3.16 Released to Address Extremely Critical Vulnerability : [link] #RoR #Security
@RealBelahzur » 29 Jan '13, 4pm
Ruby on Rails 3.0.20 and 2.3.16 Released to Address Extremely Critical Vulnerability [link] via @softpedia
@binitamshah » 29 Jan '13, 2pm
Ruby on Rails 3.0.20 and 2.3.16 Released to Address Extremely Critical Vulnerability : [link] #RoR #Security
@EduardKovacs » 29 Jan '13, 11am
Another extremely critical vulnerability fixed in Ruby on Rails. Download the updated version here [link]
@SPCoulson » 29 Jan '13, 10am
RT @CyberCrimeNEWS: Ruby on Rails 3.0.20 and 2.3.16 Released to Address Extremely Critical Vulnerability [link] #ccureit
@CyberCrimeNEWS » 29 Jan '13, 10am
Ruby on Rails 3.0.20 and 2.3.16 Released to Address Extremely Critical Vulnerability [link] #ccureit
@SecMash » 29 Jan '13, 10am
Ruby on Rails 3.0.20 and 2.3.16 Released to Address Extremely Critical Vulnerability [link] #InfoSec
@mmealexis » 29 Jan '13, 1pm
Ruby on Rails 3.0.20 and 2.3.16 Released to Address Extremely Critical Vulnerability [link]
@Secwis » 29 Jan '13, 10am
Ruby on Rails 3.0.20 and 2.3.16 Released to Address Extremely Critical Vulnerability [link]
@CcureIT » 29 Jan '13, 10am
Ruby on Rails 3.0.20 and 2.3.16 Released to Address Extremely Critical Vulnerability [link] #ccureit