MultiXml gem has same vulnerability as Rails' CVE-2013-0156 – patch now
1–10 of 26 posts
Re: MultiXml gem has same vulnerability as Rails' CVE-2013-0156 – patch now
#2Yo dawgs, the mailchimp, aws-sdk, jenkins and twilio gems use HTTParty which uses multi_xml. You should look into this.
Re: MultiXml gem has same vulnerability as Rails' CVE-2013-0156 – patch now
#3Yo dawgs, the mailchimp, aws-sdk, jenkins and twilio gems use HTTParty which uses multi_xml. You should look into this.
Quick clarification: The multi_xml gem has _not_ been updated, so there is nothing to upgrade, correct? Just the monkey-patch fix?
Re: MultiXml gem has same vulnerability as Rails' CVE-2013-0156 – patch now
#4Yo dawgs, the mailchimp, aws-sdk, jenkins and twilio gems use HTTParty which uses multi_xml. You should look into this.
Quick clarification: The multi_xml gem has _not_ been updated, so there is nothing to upgrade, correct? Just the monkey-patch fix?
Oh hmm, I guess that's a good thing to point out. Yes, the multi_xml gem has not been upgraded, and the listed dependencies for httparty and mailchimp haven't changed either.
Re: MultiXml gem has same vulnerability as Rails' CVE-2013-0156 – patch now
#5Yo dawgs, the mailchimp, aws-sdk, jenkins and twilio gems use HTTParty which uses multi_xml. You should look into this.
Or reference HTTParty from git, which has been fixed, in your Gemfile:
https://github.com/jnunemaker/httparty/commit/53a812426dd321...
Correction: Although this might not have much to do with multi_xml if that security risk isn't mitigated.
Re: MultiXml gem has same vulnerability as Rails' CVE-2013-0156 – patch now
#6Yo dawgs, the mailchimp, aws-sdk, jenkins and twilio gems use HTTParty which uses multi_xml. You should look into this.
Or reference HTTParty from git, which has been fixed, in your Gemfile: https://github.com/jnunemaker/httparty/commit/53a812426dd321... Correction: Although this might not have much to do with multi_xml if that security risk isn't mitigated.
YAML can still be loaded from XML response bodies, it just doesn't parse response bodies that are pure YAML anymore. Something like yaml here.
Re: MultiXml gem has same vulnerability as Rails' CVE-2013-0156 – patch now
#7I strongly recommend loading something like this in your Ruby applications: https://gist.github.com/4507129
It will prevent YAML.rb from instantiating arbitrary objects, which will close off this entire class of problems.
Obviously, if you do use YAML as a serialization format for arbitrary objects, this won't work, but odds are you aren't doing that.
Re: MultiXml gem has same vulnerability as Rails' CVE-2013-0156 – patch now
#8Yo dawgs, the mailchimp, aws-sdk, jenkins and twilio gems use HTTParty which uses multi_xml. You should look into this.
Actually paperclip doesn't rely on HTTParty, but def check out your Gemfile.lock anyway -- it's a pretty common library dependency.
Re: MultiXml gem has same vulnerability as Rails' CVE-2013-0156 – patch now
#9Yo dawgs, the mailchimp, aws-sdk, jenkins and twilio gems use HTTParty which uses multi_xml. You should look into this.
Actually paperclip doesn't rely on HTTParty, but def check out your Gemfile.lock anyway -- it's a pretty common library dependency.
> Actually paperclip doesn't rely on HTTParty
Re: MultiXml gem has same vulnerability as Rails' CVE-2013-0156 – patch now
#10Earlier quoted context omitted.
Actually paperclip doesn't rely on HTTParty, but def check out your Gemfile.lock anyway -- it's a pretty common library dependency.
> Actually paperclip doesn't rely on HTTParty I thought it uses aws-sdk? Looks like it doesn't. Huh.. https://github.com/aws/aws-sdk-ruby/blob/master/Gemfile#L17
It's like ActiveRecord, where it comes with an adapter for several backends, but in order to use a backend you need to install a library gem which is not a dependency of ActiveRecord.