Re:Multiple vulnerabilities in parameter parsing in Action Pack
by jrochkind1 on Tuesday January 08, 2013 @05:10PM
(#5028849)
3.2.11 not 3.2.10.
Which is in fact why it's probably wiser to list `gem 'rails', '~> 3.2.10'` (or 3.2.0 or anything) instead, and then `bundle update rials` will update you to latest 3.2.x (but never 3.3.x), in this case 3.2.11, instead of only to the exact version you specified (3.2.10, incorrectly).
Re:Multiple vulnerabilities in parameter parsing in Action Pack
by tptacek on Tuesday January 08, 2013 @04:00PM
(#5028481)
The advisory also provides several workarounds that dont' require you to update Rails, all pretty simple ("drop a file into config/initializers and reload) which also work.
Re:Multiple vulnerabilities in parameter parsing in Action Pack
by nathan_f77 on Tuesday January 08, 2013 @04:06PM
(#5028524)
You need rails 3.2.11, which has the patch.
Re:Multiple vulnerabilities in parameter parsing in Action Pack
by boundlessdreamz on Tuesday January 08, 2013 @04:13PM
(#5028555)
The fixed version is 3.2.11
Re:Multiple vulnerabilities in parameter parsing in Action Pack
by clickonchris on Wednesday January 09, 2013 @01:24PM
(#5032580)
whoops. sorry about that typo
update your Gemfile and set the version you want. In my case:
gem 'rails', '3.2.10'
locally, run
'bundle update rails' which will update your Gemfile.lock
check-in and deploy your code. If you are using capistranso, the default 'deploy' task should handle everything for you. Otherwise, run 'bundle update rails' on your production server.