# Vulnerabilità Rails e i18n

**URL:** <https://www.ruby-forum.com/t/vulnerabilita-rails-e-i18n/237945>\
**Category:** IT\
**Created:** [December 7, 2013, 10:12am UTC](https://www.ruby-forum.com/t/vulnerabilita-rails-e-i18n/237945 "2013-12-07T10:12:00Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![musicdenotation](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ea666f/32.png) [@musicdenotation](https://www.ruby-forum.com/u/musicdenotation)\
**Post date:** [December 7, 2013, 10:12am UTC](https://www.ruby-forum.com/t/vulnerabilita-rails-e-i18n/237945/1 "2013-12-07T10:12:00Z")

</div>

I dettagli sono a [About Secunia Research | Flexera](http://secunia.com/advisories/55864/)

In breve:

1. Con i18n si può fare cross site scripting, si deve aggiornare alla  
0.6.6 o 0.5.1. Rails 4.0.1 ha una versione vulnerabile della gemma.

2. Rails oltre alla vulnerabilità di i18n ne ha altre con cui fare XSS e  
una con cui fare DoS del server su cui gira l’applicazione web. Si deve  
aggiornare a 4.0.2 e 3.2.16

Buon lavoro! ☹

Paolo

---

<div class="post-metadata">

**Author:** ![pm3](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/a87d85/32.png) [@pm3](https://www.ruby-forum.com/u/pm3)\
**Post date:** [December 7, 2013, 11:02am UTC](https://www.ruby-forum.com/t/vulnerabilita-rails-e-i18n/237945/2 "2013-12-07T11:02:44Z")

</div>

Grazie della segnalazione!

Il giorno 07 dicembre 2013 10:12, Paolo M.  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid)ha scritto:

---

<div class="post-metadata">

**Author:** ![pm3](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/a87d85/32.png) [@pm3](https://www.ruby-forum.com/u/pm3)\
**Post date:** [December 11, 2013, 4:09pm UTC](https://www.ruby-forum.com/t/vulnerabilita-rails-e-i18n/237945/3 "2013-12-11T16:09:31Z")

</div>

Ciao a tutti, integro con il mio post:

> **[Updates from the Ruby security world: 6 new vulnerabilities as X'mas gift](http://armoredcode.com/blog/updates-from-the-ruby-security-world-6-new-vulnerabilities-as-xmas-gift/)**
>
> Wow, last week it was very busy in the ruby security annonuncement discussion group. A bunch of six new vulnerabilities...

I controlli saranno introdotti in codesake-dawn tra oggi e domani.

Paolo

2013/12/7 Alessandro V. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid):

> > 1. Con i18n si pu fare cross site scripting, si deve aggiornare alla  
> > –  
> > Posted via [http://www.ruby-forum.com/](http://www.ruby-forum.com/).
> > 
> > * * *
> > 
> > Ml mailing list  
> > removed\_email\_address@domain.invalid  
> > [http://lists.ruby-it.org/mailman/listinfo/ml](http://lists.ruby-it.org/mailman/listinfo/ml)
> 
> * * *
> 
> Ml mailing list  
> removed\_email\_address@domain.invalid  
> [http://lists.ruby-it.org/mailman/listinfo/ml](http://lists.ruby-it.org/mailman/listinfo/ml)

–  
$ cd /pub  
$ more beer

The Application Security blog you really want to read:

> **[Home](http://armoredcode.com)**
>
> {% if page.url ==