REDHAT-BUG-917236: High severity jnunemaker crack vulnerability
Tasha Drew reports:
Researchers investigating the Rails parameter parsing vulnerability discovered that the same or similar vulnerable code had made its way into multiple other libraries. If your application uses these libraries to process untrusted data, it may still be vulnerable even if you have upgraded Rails. Check your Gemfile and Gemfile.lock for vulnerable versions of the following libraries, and if you are using one, update it immediately.
You can update each of these by using "bundle update <gem name>".
Vulnerable: <= 0.3.1 Fixed in: 0.3.2
Upstream fix:
https://github.com/jnunemaker/crack/commit/e3da1212a1f84a898ee3601336d1dbbf118fb5f6
References:
https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately https://rubygems.org/gems/crack/
Affected Software
Event History
Frequently Asked Questions
What is the severity of REDHAT-BUG-917236?
The severity of REDHAT-BUG-917236 is considered moderate due to its potential impact on applications using affected libraries.
How do I fix REDHAT-BUG-917236?
To fix REDHAT-BUG-917236, update the affected library 'crack' to version 0.3.2 or later.
What applications are affected by REDHAT-BUG-917236?
Applications that utilize the 'jnunemaker crack' library version up to and including 0.3.1 are affected by REDHAT-BUG-917236.
What causes REDHAT-BUG-917236?
REDHAT-BUG-917236 is caused by a vulnerability in the parameter parsing logic of the 'crack' library, which can lead to processing untrusted data inappropriately.
Is there a workaround for REDHAT-BUG-917236?
There are no known effective workarounds for REDHAT-BUG-917236 other than upgrading to a patched version of the affected library.