Important security update which affects all versions Spree 1.0.x or greater.

Exploits found within Core and API

Important security update which affects all versions Spree 1.0.x or greater.

Exploits found within Core and API Posted January 31, 2013 by Ryan Bigg Comments Please upgrade your Spree stores now to their latest gem versions 1.3.2, 1.2.4, 1.1.5 or 1.0.7. Thanks to the work of Egor Homakov , we have located and patched two serious exploits within Spree. The first allows a user to authenticate as a random user to the API , which could potentially lead them to authenticating as an admin user for the store. The second allows them to issue a Denial of Service attack against the store using an especially crafted URL . We have patched the 1-0-stable, 1-1-stable, 1-2-stable, 1-3-stable and master branches for Spree, as well as released new gem versions for the stable branches. We strongly advise all Spree stores to upgrade to their latest gem versions so that they are not affected by these exploits.

Full article: http://spreecommerce.com/blog/exploits-found-within-core-...

Tweets

@icicletech » 08 Feb '13, 10pm
Spree Commerce: Upgrade for exploits in the App & API. [link] Patch for those who can't upgrade [link]
@rodrigoospinto » 05 Feb '13, 4pm
RT @fnando: Exploits found within Core and API | Spree Commerce ~ [link]
@fnando » 05 Feb '13, 4pm
Exploits found within Core and API | Spree Commerce ~ [link]
@spreecommerce » 05 Feb '13, 2pm
Reminder that there are important security updates to Spree [link]
@olemoudi » 05 Feb '13, 7am
RT @homakov: Btw, I am not bad guy: spree bugs [link]
@homakov » 05 Feb '13, 7am
Btw, I am not bad guy: spree bugs [link]
@joneslee85 » 05 Feb '13, 12am
RT @spreecommerce: Important security update which affects all versions Spree 1.0.x or greater. [link]
@spreecommerce » 05 Feb '13, 12am
Important security update which affects all versions Spree 1.0.x or greater. [link]
@piotrgega » 05 Feb '13, 8am
RT @homakov: Btw, I am not bad guy: spree bugs [link]
@devilcoders » 05 Feb '13, 5am
RT @spreecommerce: Important security update which affects all versions Spree 1.0.x or greater. [link]
@GeekOnCoffee » 05 Feb '13, 12am
RT @spreecommerce: Important security update which affects all versions Spree 1.0.x or greater. [link]
@ryanbigg » 05 Feb '13, 12am
RT @spreecommerce: Important security update which affects all versions Spree 1.0.x or greater. [link]

Exploits found within Core and API

Important security update which affects all versions Spree 1.0.x or greater.

Tweets

Double Shot #1059

How #Running On Different Surfaces Affects Your...

A look at what's in store for Pivotal Tracker i...

Some Versions of Ruby on Rails Vulnerable to Ne...