From owner-svn-ports-all@FreeBSD.ORG Sat Feb 16 14:41:45 2013 Return-Path: Delivered-To: svn-ports-all@freebsd.org Received: from mx1.freebsd.org (mx1.FreeBSD.org [8.8.178.115]) by hub.freebsd.org (Postfix) with ESMTP id A2C6CB3F; Sat, 16 Feb 2013 14:41:45 +0000 (UTC) (envelope-from swills@FreeBSD.org) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) by mx1.freebsd.org (Postfix) with ESMTP id 7CE07D5D; Sat, 16 Feb 2013 14:41:45 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.5/8.14.5) with ESMTP id r1GEfjDJ019704; Sat, 16 Feb 2013 14:41:45 GMT (envelope-from swills@svn.freebsd.org) Received: (from swills@localhost) by svn.freebsd.org (8.14.5/8.14.5/Submit) id r1GEfik8019703; Sat, 16 Feb 2013 14:41:44 GMT (envelope-from swills@svn.freebsd.org) Message-Id: <201302161441.r1GEfik8019703@svn.freebsd.org> From: Steve Wills Date: Sat, 16 Feb 2013 14:41:44 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r312355 - head/security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-all@freebsd.org X-Mailman-Version: 2.1.14 Precedence: list List-Id: SVN commit messages for the ports tree List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sat, 16 Feb 2013 14:41:45 -0000 Author: swills Date: Sat Feb 16 14:41:44 2013 New Revision: 312355 URL: http://svnweb.freebsd.org/changeset/ports/312355 Log: - Document ruby json issue Modified: head/security/vuxml/vuln.xml Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sat Feb 16 14:21:33 2013 (r312354) +++ head/security/vuxml/vuln.xml Sat Feb 16 14:41:44 2013 (r312355) @@ -51,6 +51,55 @@ Note: Please add new entries to the beg --> + + Ruby -- Denial of Service and Unsafe Object Creation Vulnerability in JSON + + + ruby + 1.9 + 1.9.3.385,1 + + + rubygem18-json + 1.7.7 + + + rubygem19-json + 1.7.7 + + + rubygem18-json_pure + 1.7.7 + + + rubygem19-json_pure + 1.7.7 + + + + +

Aaron Patterson reports:

+
When parsing certain JSON documents, the JSON gem can be coerced in + to creating Ruby symbols in a target system. Since Ruby symbols + are not garbage collected, this can result in a denial of service + attack.
+
The same technique can be used to create objects in a target system + that act like internal objects. These "act alike" objects can be + used to bypass certain security mechanisms and can be used as a + spring board for SQL injection attacks in Ruby on Rails.
+

+ + + + CVE-2013-0269 + + + 2013-02-11 + 2013-02-16 + + + Ruby -- XSS exploit of RDoc documentation generated by rdoc