Bug 903440 (CVE-2013-0333)

The Ruby on Rails project reports:

Vulnerability in JSON Parser in Ruby on Rails 3.0 and 2.3

There is a vulnerability in the JSON  code for Ruby on Rails which allows 
attackers to bypass authentication systems, inject arbitrary SQL, inject and 
execute arbitrary code, or perform a DoS attack on a Rails application. This 
vulnerability has been assigned the CVE identifier CVE-2013-0333.

Versions Affected:  2.3.x, 3.0.x
Not Affected:       3.1.x, 3.2.x
Fixed Versions:     3.0.20, 2.3.16

Impact
------
The JSON Parsing code in Rails 2.3 and 3.0 support multiple parsing backends. 
One of the backends involves transforming the JSON into YAML, and passing that 
through the YAML parser.  Using a specially crafted payload attackers can trick
the backend into decoding a subset of YAML.

Note: This is a seperate vulnerability to CVE-2013-0156, if you are running a 
2.3 or 3.0 application you must still take action to protect your application.

Releases
--------
The 3.0.20 and 2.3.16 releases are available at the normal locations.

Workarounds
-----------
To work around this vulnerability you need to switch backends to the JsonGem 
backend.  Place this code in an application initializer:

  ActiveSupport::JSON.backend = "JSONGem"

If you are running Ruby 1.8 you will need to ensure that the json or json_pure 
gems are installed and in your application's Gemfile.  Ruby 1.9 includes this 
code already.

Patches
-------
To aid users who aren't able to upgrade immediately we have provided patches 
for the two supported release series.  They are in git-am format and consist 
of a single changeset.

* 2-3-json-parser.patch - Patch for 2.3 series
* 3-0-json-parser.patch - Patch for 3.0 series

Please note that only the 2.3.x, 3.1.x and 3.2.x series are supported at 
present.  Users of earlier unsupported releases are advised to upgrade as soon 
as possible as we cannot guarantee the continued availability of security 
fixes for unsupported releases.

Credits
-------

Thanks to Lawrence Pit of Mirror42 for discovering the vulnerability and 
working responsibly with us to ensure we shipped a fix.