Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3
by postmodern_mod3 on Monday January 28, 2013 @06:45PM
(#5131497)
Checkout the lengthy write-up for the original vulnerability.
http://ronin-ruby.github.com/blog/2013/01/09/rails-pocs.html
[ Parent
| on HN ]
Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3
by matthuggins on Tuesday January 29, 2013 @09:56AM
(#5134277)
Thanks for the link, but it looks like that's for CVE-2013-0156 and CVE-2013-0155. This HN post is about CVE-2013-0333. It does look like there's a newer blog post about this issue though: http://ronin-ruby.github.com/blog/2013/01/28/new-rails-poc.h...
Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3
by postmodern_mod3 on Tuesday January 29, 2013 @07:28PM
(#5137338)
Took a while to write a new blog post. Still, CVE-2013-0333 relies on the same YAML deserialization technique as CVE-2013-0156, so all the previous information is still relevant.