News for hackers. Stuff that matters.

A comment on Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3. Parent comment

Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by kawsper on Monday January 28, 2013 @08:36PM (#5131866)
Only seems to be working for servers not running 1.8.7.

Our old app runs 1.8.7, is there a POC out for that?

[ Parent | on HN ]
Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by postmodern_mod3 on Monday January 28, 2013 @09:18PM (#5131992)
@benmmurphy seems to be the only one who knows how to get RCE via Syck (1.8.x YAML parser). https://twitter.com/benmmurphy/status/296025302986014720
[ Parent | on HN ]
Re:Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3 by rmc on Wednesday January 30, 2013 @09:37AM (#5139613)
Doesn't matter, upgrade.

They won't always tell you if they have an exploit.

[ Parent | on HN ]