Описание
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
Отчет
Red Hat Satellite tools ship RubyGem Json 1.4.6 which is earlier than affected 1.5.5 version however, this version of RubyGem is not affected to the flaw. We may update RubyGem in a future release.
Затронутые пакеты
| Платформа | Пакет | Состояние | Рекомендация | Релиз |
|---|---|---|---|---|
| Red Hat Enterprise MRG 2 | rubygem-json | Affected | ||
| Red Hat JBoss SOA Platform 4 | jruby | Will not fix | ||
| Red Hat JBoss SOA Platform 5 | jruby | Affected | ||
| Red Hat Satellite 6 | satellite-tools | Not affected | ||
| Fuse ESB Enterprise 7.1.0 | Fixed | RHSA-2013:1028 | 09.07.2013 | |
| Red Hat JBoss Fuse 6.0 | Fixed | RHSA-2013:1185 | 29.08.2013 | |
| Red Hat JBoss SOA Platform 5.3 | Fixed | RHSA-2013:1147 | 08.08.2013 | |
| Red Hat Subscription Asset Manager 1.2 | candlepin | Fixed | RHSA-2013:0686 | 26.03.2013 |
| Red Hat Subscription Asset Manager 1.2 | katello | Fixed | RHSA-2013:0686 | 26.03.2013 |
| Red Hat Subscription Asset Manager 1.2 | katello-configure | Fixed | RHSA-2013:0686 | 26.03.2013 |
Показывать по
Дополнительная информация
Статус:
7.5 High
CVSS2
Связанные уязвимости
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creation of arbitrary Ruby symbols or certain internal objects, as demonstrated by conducting a SQL injection attack against Ruby on Rails, aka "Unsafe Object Creation Vulnerability."
The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 ...
7.5 High
CVSS2