# Critical vulnerability - aggiornate appena possibile **URL:** \ **Category:** IT\ **Created:** [January 8, 2013, 9:49pm UTC](https://www.ruby-forum.com/t/critical-vulnerability-aggiornate-appena-possibile/225437 "2013-01-08T21:49:54Z")\ **Posts on this page:** 1\ **Page:** 1
**Author:** ![aris](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/a/258eb7/32.png) [@aris](https://www.ruby-forum.com/u/aris)\ **Post date:** [January 8, 2013, 9:49pm UTC](https://www.ruby-forum.com/t/critical-vulnerability-aggiornate-appena-possibile/225437/1 "2013-01-08T21:49:54Z")
[https://groups.google.com/forum/#!topic/rubyonrails-security/61bkgvnSGTQ/discussion](https://groups.google.com/forum/#!topic/rubyonrails-security/61bkgvnSGTQ/discussion) There are multiple weaknesses in the parameter parsing code for Ruby on Rails which allows attackers to bypass authentication systems, inject arbitrary SQL, inject and execute arbitrary code, or perform a DoS attack on a Rails application. This vulnerability has been assigned the CVE identifier CVE-2013-0156. Versions Affected: ALL versions Not affected: NONE Fixed Versions: 3.2.11, 3.1.10, 3.0.19, 2.3.15 ## Impact The parameter parsing code of Ruby on Rails allows applications to automatically cast values from strings to certain data types. Unfortunately the type casting code supported certain conversions which were not suitable for performing on user-provided data including creating Symbols and parsing YAML. These unsuitable conversions can be used by an attacker to compromise a Rails application. Due to the critical nature of this vulnerability, and the fact that portions of it have been disclosed publicly, all users running an affected release should either upgrade or use one of the work arounds _immediately_. – David N. Welton [http://www.welton.it/davidw/](http://www.welton.it/davidw/) [http://www.dedasys.com/](http://www.dedasys.com/)