News for hackers. Stuff that matters.

A comment on If Your Business Uses Rails 2.3 You Need To Move To A Supported Option ASAP. Parent comment

Re: If Your Business Uses Rails 2.3 You Need To Move To A Su... by signifiers on Monday June 17, 2013 @03:49PM (#5895474)
The backporting involved here is non-trivial. If the past 9 months are any indication, I would expect we haven't seen the last of the serious YAML vulnerabilities yet: http://www.cvedetails.com/vulnerability-list/vendor_id-12043...
[ Parent | on HN ]
Re: If Your Business Uses Rails 2.3 You Need To Move To A Su... by tomjen3 on Monday June 17, 2013 @04:21PM (#5895684)
My guess is that mostly no apps depend on that idiotic YAML can parse and execute anything anybody sends us feature, so wouldn't you forward secure rails (harden it?) by replacing YAML with a parser that only parse things?
[ Parent | on HN ]
Re: If Your Business Uses Rails 2.3 You Need To Move To A Su... by rst on Monday June 17, 2013 @05:54PM (#5896226)
One of the few things Rails LTS adds to prior 2.3 branches is a "hardened" set of security settings that turns off rarely-used and potentially vulnerable arg-parsing code.
[ Parent | on HN ]