TE
TechEcho
Home24h TopNewestBestAskShowJobs
GitHubTwitter
Home

TechEcho

A tech news platform built with Next.js, providing global tech news and discussions.

GitHubTwitter

Home

HomeNewestBestAskShowJobs

Resources

HackerNews APIOriginal HackerNewsNext.js

© 2025 TechEcho. All rights reserved.

MultiXml gem has same vulnerability as Rails' CVE-2013-0156 – patch now

44 pointsby fowlduckover 12 years ago

6 comments

jrochkind1over 12 years ago
Hmm, I'm not sure you could say it has "the same vulnerability".<p>It has the same vulnerability if you pass untrusted input to it, okay.<p>But the point of the Rails vulnerabilty is that every Rails app, by default, was set up to accept external user input and run it through an XML parser. Even if you didn't realize it.<p>If you are using MultiXml, you may or may not be passing untrusted user input to it, depends on what you did with it.<p>Right?
评论 #5041877 未加载
评论 #5042967 未加载
评论 #5041788 未加载
kanzureover 12 years ago
Yo dawgs, the mailchimp, aws-sdk, jenkins and twilio gems use HTTParty which uses multi_xml. You should look into this.
评论 #5041044 未加载
评论 #5040774 未加载
评论 #5040868 未加载
评论 #5040742 未加载
评论 #5041293 未加载
评论 #5041118 未加载
nelhageover 12 years ago
I strongly recommend loading something like this in your Ruby applications: <a href="https://gist.github.com/4507129" rel="nofollow">https://gist.github.com/4507129</a><p>It will prevent YAML.rb from instantiating arbitrary objects, which will close off this entire class of problems.<p>Obviously, if you <i>do</i> use YAML as a serialization format for arbitrary objects, this won't work, but odds are you aren't doing that.
评论 #5040966 未加载
fowlduckover 12 years ago
Grape is also affected:<p><a href="https://groups.google.com/forum/?fromgroups=#!topic/ruby-grape/qX38Iy1Bwo8" rel="nofollow">https://groups.google.com/forum/?fromgroups=#!topic/ruby-gra...</a>
fowlduckover 12 years ago
A version of multi_xml with this fix has been pushed:<p><a href="https://rubygems.org/gems/multi_xml/versions/0.5.2" rel="nofollow">https://rubygems.org/gems/multi_xml/versions/0.5.2</a>
jfirebaughover 12 years ago
I'm keeping track of a list of vulnerable gems here: <a href="https://gist.github.com/4532291" rel="nofollow">https://gist.github.com/4532291</a>