Comment by slashdotdash | Hacker News Reader

Top New Best Ask Show Jobs

Comment by slashdotdash | Hacker News Reader

Three vulnerabilities announced at the same time...

* [CVE-2013-1855] XSS vulnerability in sanitize_css in Action Pack [1]

* [CVE-2013-1856] XML Parsing Vulnerability affecting JRuby users [2]

* [CVE-2013-1857] XSS Vulnerability in the `sanitize` helper of Ruby on Rails [3]

Two of these affect all Rails versions, not just JRuby, so are more serious.

[1] https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...

[2] https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...

[3] https://groups.google.com/forum/?fromgroups=#!topic/rubyonra...

There's supposed to be 4, but google groups seems to be swallowing my announcement emails. :'(

Here is the fourth one:

https://groups.google.com/forum/#!topic/ruby-security-ann/o0...

I was gonna post 'em all, but my second one got auto-dead'd. Probably tripped the spam filter.

Is it possible to update the title of this post to remove the "affecting JRuby users" portion? The current title will give non-JRuby users a false sense of security.

This vulnerability is only applicable to JRuby users who use the JDOM parser. JDOM is not usable on non-JRuby platforms.

CVE-2013-1855 & CVE-2013-1857 are applicable to ALL Ruby users, not just JRuby.

Oh, I read you now. Since the link goes to just the JRuby-related announcement, I'm going to leave it in place for now, but please go ahead and submit the other two (especially the sanitize() one) - the spam filter seems to be upset at me. :)

Reply on news.ycombinator.com