REDHAT-BUG-750306: XSS
A cross-site scripting (XSS) flaw was found in the way the regular expression engine of the JRuby, Java implementation of the Ruby programming language, processed certain invalid UTF-8 byte sequences. A remote attacker could use this flaw to execute arbitrary HTML or web script via specially-crafted input provided to an JRuby application.
References: [1] http://www.jruby.org/2010/04/26/jruby-1-4-1-xss-vulnerability.html [2] https://bugs.gentoo.org/showbug.cgi?id=317435
Proposed upstream solution (is to upgrage to jcodings-v1.0.3): [3] http://repo1.maven.org/maven2/org/jruby/jcodings/jcodings/1.0.3/jcodings-1.0.3.jar
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-750306?
REDHAT-BUG-750306 is classified as a high severity vulnerability due to its potential for remote code execution.
How do I fix REDHAT-BUG-750306?
To fix REDHAT-BUG-750306, update JRuby to a version higher than 1.4.1.
What type of vulnerability is REDHAT-BUG-750306?
REDHAT-BUG-750306 is a cross-site scripting (XSS) vulnerability.
What could an attacker do with REDHAT-BUG-750306?
An attacker could exploit REDHAT-BUG-750306 to execute arbitrary HTML or web scripts remotely.
Which software is affected by REDHAT-BUG-750306?
REDHAT-BUG-750306 affects JRuby versions up to, but not including, 1.4.1.