SQL injection vulnerability hits all Ruby on Rails versions

ronjor · Jan 3, 2013

The Ruby on Rails developers are warning of an SQL injection vulnerability that affects all current versions of the web framework. New releases of Ruby on Rails – 3.2.10, 3.1.9 and 3.0.18 – are now available. It is recommended that all users update immediately. For users unable to update, there are patches available for supported versions 3.2 and 3.1 and older versions 3.0 and 2.3.
Click to expand...

http://www.h-online.com/security/ne...-hits-all-Ruby-on-Rails-versions-1776203.html

ronjor · Jan 9, 2013

Ruby on Rails patches more critical vulnerabilities

It's the second time this month that Ruby on Rails has released updated versions for serious software flaws
Jeremy Kirk

Those using the Ruby on Rails web application framework on their websites are being advised to update the software immediately after multiple new vulnerabilities were found. It's the second time this month that Rails has been patched because of serious flaws.
Click to expand...

https://www.computerworld.com/s/art...n_Rails_patches_more_critical_vulnerabilities

siljaline · Jan 9, 2013

• Extremely critical Ruby on Rails bug threatens more than 200,000 sites •

Hundreds of thousands of websites are potentially at risk following the discovery of an extremely critical vulnerability in the Ruby on Rails framework that gives remote attackers the ability to execute malicious code on the underlying servers.

The bug is present in Rails versions spanning the past six years and in default configurations gives hackers a simple and reliable way to pilfer database contents, run system commands, and cause websites to crash, according to Ben Murphy, one of the developers who has confirmed the vulnerability. As of last week, the framework was used by more than 240,000 websites including Github, Hulu, and Basecamp, underscoring the seriousness of the threat.
Click to expand...

Article

ronjor · Jan 29, 2013

Rails developers close another "extremely critical" flaw

The Rails developers have released Ruby on Rails 3.0.20 and 2.3.16 which contain one, and only one, "extremely critical security fix". The problem only affects Rails 3.0.x and 2.3.x with Rails 3.1.x and 3.2.x not affected. Users of the 2.3 and 3.0 branches are advised to update as soon as possible, or to apply patches if they cannot upgrade. If they cannot do that either, a workaround of setting

ActiveSupport::JSON.backend = "JSONGem"
Click to expand...

http://www.h-online.com/security/ne...-another-extremely-critical-flaw-1793511.html

siljaline · Jan 30, 2013

Ruby on Rails receives the third security patch in less than a month

Developers of the Ruby on Rails Web development framework released versions 3.0.20 and 2.3.16 of the software on Monday in order to address a critical remote code execution vulnerability.

This is the third security update released in January for Ruby on Rails, an increasingly popular framework for developing Web applications using the Ruby programming language that was used to build websites like Hulu, GroupOn, GitHub, Scribd and others.
Click to expand...

Article

ronjor · Feb 12, 2013

More Rails security fixes released

Rails icon The Ruby on Rails Developers have released updates to Rails 3.2, 3.1 and 2.3 and made users aware of an update to the JSON gem to close an important security flaw. Most notable of the problems is CVE-2013-0277, another problem with serialised attributes in YAML. The flaw, which only affects Rails 2.3 and 3.0, can be exploited so that a crafted request would deserialize arbitrary YAML inside the server with the risk of denial of service or remote code execution. The Rails developers have released a fix for Rails 2.3, 2.3.17, but there will be no fix for Rails 3.0 in line with maintenance policy. The advisory contains patches for various versions of Rails for use where users cannot upgrade easily.
Click to expand...

http://www.h-online.com/security/news/item/More-Rails-security-fixes-released-1802628.html

ronjor · Mar 19, 2013

Rails updates to 3.2.13 to close denial of service and XSS holes

The Rails developers have released Rails version 3.2.13, 3.1.12 and 2.3.18 to close four security holes in the web application framework. The developers recommend that users upgrade as soon as possible with the latest Rails gems. For those unable to update, patches are available with the various bug notifications. The flaws affect all versions of Rails, but in line with the Rails maintenance policy, only the three branches, 3.2, 3.1 and 2.3 are being updated. Note that Rails 3.2.13 also contains many other non-security changes as part of a general bug fix release; the RC1 release has details of many of those changes.
Click to expand...

http://www.h-online.com/security/ne...-denial-of-service-and-XSS-holes-1825605.html

ronjor · May 28, 2013

Critical Ruby on Rails bug exploited in wild, hacked servers join botnet

by Dan Goodin

Attackers are exploiting an extremely critical vulnerability in the Ruby on Rails framework to commandeer servers and make them part of a malicious network of hacked machines, a security researcher said.

Ars first warned of the threat in early January, shortly after Rails maintainers issued a patch for the vulnerability. Ars warned at the time that the vulnerability gave attackers the ability to remotely execute malicious code on underlying servers. Criminals' success in exploiting the bug to make vulnerable machines join a botnet suggests that many server administrators still haven't installed the critical update, more than four months after it was issued.
Click to expand...

http://arstechnica.com/security/201...exploited-in-wild-hacked-servers-join-botnet/

TheKid7 · May 29, 2013

Ruby on Rails Exploit Builds IRC Botnet of Compromised Servers:

http://threatpost.com/ruby-on-rails-exploit-builds-irc-botnet-of-compromised-servers/

ronjor · Nov 27, 2013

Ruby on Rails CookieStore Vulnerability Plagues Prominent Websites

by Chris Brook

A lingering security issue in Ruby on Rails that stems from a setting in the framework’s cookie-based storage mechanism is still present in almost 2,000 websites.
Click to expand...

http://threatpost.com/ruby-on-rails-cookiestore-vulnerability-plagues-prominent-websites/103038

ronjor · Dec 4, 2013

Ruby on Rails security updates patch XSS, DoS vulnerabilities

By Lucian Constantin | IDG News Service

The updates also strengthen the protection for a vulnerability patched in January
Click to expand...

http://www.infoworld.com/d/security/ruby-rails-security-updates-patch-xss-dos-vulnerabilities-232092

siljaline · Dec 4, 2013

Spotted elsewhere but reported by Lucian Constantin.
Ruby on Rails security updates patch XSS, DoS vulnerabilities
http://www.networkworld.com/news/2013/120413-ruby-on-rails-security-updates-276578.html

ronjor · Jul 5, 2014

Ruby on Rails patches tackle SQL injection vulnerabilities

The two vulnerabilities affect Rails applications that use PostgreSQL as a database system

By Lucian Constantin
July 4, 2014 08:04 AM ET

IDG News Service - Two SQL injection vulnerabilities were patched in Ruby on Rails, a popular open-source Web development framework used by some high-profile websites.
Click to expand...

http://www.computerworld.com/s/arti..._patches_tackle_SQL_injection_vulnerabilities

Log in or Sign up

SQL injection vulnerability hits all Ruby on Rails versions

ronjor Global Moderator

ronjor Global Moderator

siljaline Registered Member

ronjor Global Moderator

siljaline Registered Member

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

TheKid7 Registered Member

ronjor Global Moderator

ronjor Global Moderator

siljaline Registered Member

ronjor Global Moderator

Log in or Sign up

SQL injection vulnerability hits all Ruby on Rails versions

ronjor Global Moderator

ronjor Global Moderator

siljaline Registered Member

ronjor Global Moderator

siljaline Registered Member

ronjor Global Moderator

ronjor Global Moderator

ronjor Global Moderator

TheKid7 Registered Member

ronjor Global Moderator

ronjor Global Moderator

siljaline Registered Member

ronjor Global Moderator

Useful Searches