RHSA-2013:0701: Moderate: ruby193-ruby, rubygem-json and rubygem-rdoc security update

Ruby is an extensible, interpreted, object-oriented, scripting language. Ithas features to process text files and to do system management tasks.A flaw in rubygem-json and ruby193-rubygem-json allowed remote attacks bycreating different types of malicious objects. For example, it couldinitiate a denial of service attack through resource consumption by using aJSON document to create arbitrary Ruby symbols, which were never garbagecollected. It could also be exploited to create internal objects whichcould allow a SQL injection attack. (CVE-2013-0269)It was found that documentation created by rubygem-rdoc andruby193-rubygem-rdoc was vulnerable to a cross-site scripting (XSS) attack.If such documentation was accessible over a network, and a remote attackercould trick a user into visiting a specially-crafted URL, it would lead toarbitrary web script execution in the context of the user's session. Asrubygem-rdoc and ruby193-rubygem-rdoc are used for creating documentationfor Ruby source files (such as classes, modules, and so on), it is not acommon scenario to make such documentation accessible over the network.(CVE-2013-0256)Red Hat would like to thank Ruby on Rails upstream for reportingCVE-2013-0269, and Eric Hodel of RDoc upstream for reporting CVE-2013-0256.Upstream acknowledges Thomas Hollstegge of Zweitag and Ben Murphy as theoriginal reporters of CVE-2013-0269, and Evgeny Ermakov as the originalreporter of CVE-2013-0256.Users of Red Hat OpenShift Enterprise 1.1.3 are advised to upgrade to theseupdated packages, which correct these issues.