Bug 917236 (CVE-2013-1800)

Summary: CVE-2013-1800 rubygem-crack: YAML parameter parsing vulnerability
Product: [Other] Security Response Reporter: Kurt Seifried <kseifried>
Component: vulnerabilityAssignee: Red Hat Product Security <security-response-team>
Status: CLOSED ERRATA QA Contact:
Severity: high Docs Contact:
Priority: high    
Version: unspecifiedCC: bkabrda, bkearney, bleanhar, bressers, ccoleman, cpelland, dajohnso, dmcphers, jeckersb, jialiu, katello-bugs, khong, lmeyer, lzhuang, mastahnke, mjc, mmccune, morazi, tkramer
Target Milestone: ---Keywords: Security
Target Release: ---   
Hardware: All   
OS: Linux   
Whiteboard:
Fixed In Version: Doc Type: Bug Fix
Doc Text:
Story Points: ---
Clone Of: Environment:
Last Closed: 2014-03-15 04:43:56 UTC Type: ---
Regression: --- Mount Type: ---
Documentation: --- CRM:
Verified Versions: Category: ---
oVirt Team: --- RHEL 7.3 requirements from Atomic Host:
Cloudforms Team: --- Target Upstream Version:
Embargoed:
Bug Depends On: 917237, 917238, 917239, 917240, 917241, 1030770    
Bug Blocks: 917245, 1028279    

Description Kurt Seifried 2013-03-02 08:59:52 UTC 
Tasha Drew reports:

Researchers investigating the Rails parameter parsing vulnerability discovered 
that the same or similar vulnerable code had made its way into multiple other 
libraries. If your application uses these libraries to process untrusted data, 
it may still be vulnerable even if you have upgraded Rails. Check your Gemfile 
and Gemfile.lock for vulnerable versions of the following libraries, and if you
are using one, update it immediately.

You can update each of these by using "bundle update <gem name>". 

Vulnerable: <= 0.3.1
Fixed in: 0.3.2

Upstream fix:

https://github.com/jnunemaker/crack/commit/e3da1212a1f84a898ee3601336d1dbbf118fb5f6

References:

https://support.cloud.engineyard.com/entries/22915701-january-14-2013-security-vulnerabilities-httparty-extlib-crack-nori-update-these-gems-immediately
https://rubygems.org/gems/crack/
Comment 1 Kurt Seifried 2013-03-02 09:02:31 UTC 
Created rubygem-crack tracking bugs for this issue

Affects: epel-all [bug 917237]
Comment 2 Kurt Seifried 2013-03-02 09:03:15 UTC 
Created rubygem-crack tracking bugs for this issue

Affects: fedora-all [bug 917238]
Comment 5 Kurt Seifried 2013-07-26 06:20:19 UTC 
Statement removed due to typo.