Red Hat Security Advisory: ruby193-ruby, rubygem-json and rubygem-rdoc security update

Fixed packages 20

Vulnerabilities 2

• Medium —
  CVE-2013-0256

  RDoc contains XSS vulnerability

  darkfish.js in RDoc 2.3.0 through 3.12 and 4.x before 4.0.0.preview2.1, as used in Ruby, does not properly generate documents, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted URL.

  rdoc RubyGems
  Mar 1, 2013
• High —
  CVE-2013-0269 Public exploit EPSS 14%

  JSON gem has Improper Input Validation vulnerability

  The JSON gem before 1.5.5, 1.6.x before 1.6.8, and 1.7.x before 1.7.7 for Ruby allows remote attackers to cause a denial of service (resource consumption) or bypass the mass assignment protection mechanism via a crafted JSON document that triggers the creatio…

  json ruby-json Debian RubyGems
  Feb 13, 2013

References

• article
  https://access.redhat.com/security/updates/classification/#moderate
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=907820
• report
  https://bugzilla.redhat.com/show_bug.cgi?id=909029
• advisory
  https://security.access.redhat.com/data/csaf/v2/advisories/2013/rhsa-2013_0701.json
• report
  https://access.redhat.com/security/cve/CVE-2013-0256
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-0256
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-0256
• article
  http://www.ruby-lang.org/en/news/2013/02/06/rdoc-xss-cve-2013-0256/
• report
  https://access.redhat.com/security/cve/CVE-2013-0269
• advisory
  https://www.cve.org/CVERecord?id=CVE-2013-0269
• advisory
  https://nvd.nist.gov/vuln/detail/CVE-2013-0269
• article
  http://www.ruby-lang.org/en/news/2013/02/22/json-dos-cve-2013-0269/