# Vulnerabilità Ruby 1.9 e 2.0 **URL:** \ **Category:** IT\ **Created:** [November 23, 2013, 11:19am UTC](https://www.ruby-forum.com/t/vulnerabilita-ruby-1-9-e-2-0/237673 "2013-11-23T11:19:11Z")\ **Posts on this page:** 3\ **Page:** 1
**Author:** ![musicdenotation](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/m/ea666f/32.png) [@musicdenotation](https://www.ruby-forum.com/u/musicdenotation)\ **Post date:** [November 23, 2013, 11:19am UTC](https://www.ruby-forum.com/t/vulnerabilita-ruby-1-9-e-2-0/237673/1 "2013-11-23T11:19:11Z")
[https://www.ruby-lang.org/en/news/2013/11/22/heap-overflow-in-floating-point-parsing-cve-2013-4164/](https://www.ruby-lang.org/en/news/2013/11/22/heap-overflow-in-floating-point-parsing-cve-2013-4164/) “Any time a string is converted to a floating point value, a specially crafted string can cause a heap overflow. This can lead to a denial of service attack via segmentation faults and possibly arbitrary code execution. Any program that converts input of unknown origin to floating point values (especially common when accepting JSON) are vulnerable.” La soluzione è rvm upgrade ruby-1.9.3-pxxx ruby-1.9.3-p484 rvm upgrade ruby-2.0.0-pxxx ruby-2.0.0-p353 Tutte le 1.8 sono e restano vulnerabili. Ah, c’è la 2.1 in preview, da aggiornare pure quella 🙂 Paolo ---
**Author:** ![pm3](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/a87d85/32.png) [@pm3](https://www.ruby-forum.com/u/pm3)\ **Post date:** [November 26, 2013, 11:57am UTC](https://www.ruby-forum.com/t/vulnerabilita-ruby-1-9-e-2-0/237673/2 "2013-11-26T11:57:21Z")
Ciao Paolo, grazie per la segnalazione di questa e di omniauth-facebook. Integro dicendo che a met ottobre anche la gemma cocaine stata aggiornata per delle security issue: una remote code execution. Ho scritto di tutte e tre le vulnerabilit sul mio blog: > **[Ruby and omniauth-facebook gem security issues this week](http://armoredcode.com/blog/ruby-and-omniauth-facebook-gem-security-issues-this-week/)** > > A couple of days ago, on Italian Ruby mailing list, Paolo Montrasio reported two security issues occured in the ruby... codesake-dawn [1] gi in grado di eseguire i check per la issue di relativa alla vulnerabilit di ruby, quella di omniauth-facebook e quella di cocaine (non ho rilasciato una nuova versione della gemma, solo messo nel repo i test) [1][GitHub - thesp0nge/dawnscanner: Dawn is a static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.](https://github.com/codesake/codesake-dawn) Qualcuno ha voglia di provare dawn assiema a brakeman e dirmi che ne pensa? Paolo On 23 November 2013 11:19, Paolo M. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > rvm upgrade ruby-1.9.3-pxxx ruby-1.9.3-p484 > Ml mailing list > removed\_email\_address@domain.invalid > [http://lists.ruby-it.org/mailman/listinfo/ml](http://lists.ruby-it.org/mailman/listinfo/ml) – $ cd /pub $ more beer The Application Security blog you really want to read: > **[Home](http://armoredcode.com)** > > {% if page.url == ---
**Author:** ![pm3](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/p/a87d85/32.png) [@pm3](https://www.ruby-forum.com/u/pm3)\ **Post date:** [November 26, 2013, 12:52pm UTC](https://www.ruby-forum.com/t/vulnerabilita-ruby-1-9-e-2-0/237673/3 "2013-11-26T12:52:17Z")
Ciao Paolo, grazie per la segnalazione di questa e di omniauth-facebook. Integro dicendo che a met ottobre anche la gemma cocaine stata aggiornata per delle security issue: una remote code execution. Ho scritto di tutte e tre le vulnerabilit sul mio blog: > **[Ruby and omniauth-facebook gem security issues this week](http://armoredcode.com/blog/ruby-and-omniauth-facebook-gem-security-issues-this-week/)** > > A couple of days ago, on Italian Ruby mailing list, Paolo Montrasio reported two security issues occured in the ruby... codesake-dawn [1] gi in grado di eseguire i check per la issue di relativa alla vulnerabilit di ruby, quella di omniauth-facebook e quella di cocaine (non ho rilasciato una nuova versione della gemma, solo messo nel repo i test) [1][GitHub - thesp0nge/dawnscanner: Dawn is a static analysis security scanner for ruby written web applications. It supports Sinatra, Padrino and Ruby on Rails frameworks.](https://github.com/codesake/codesake-dawn) Paolo On 23 November 2013 11:19, Paolo M. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > rvm upgrade ruby-1.9.3-pxxx ruby-1.9.3-p484 > Ml mailing list > removed\_email\_address@domain.invalid > [http://lists.ruby-it.org/mailman/listinfo/ml](http://lists.ruby-it.org/mailman/listinfo/ml) – $ cd /pub $ more beer The Application Security blog you really want to read: > **[Home](http://armoredcode.com)** > > {% if page.url ==