Ruby "mass assignment" vulnerabilities?

Justin Clift jclift at redhat.com
Mon Mar 5 09:14:08 UTC 2012


On 05/03/2012, at 4:52 PM, Kurt Seifried wrote:
<snip>
> I think this potentially warrants a CVE, thoughts/comments?

People more technical than me will be able to figure out the CVE bit.

From a non-technical perspective, it seems *extremely* crap of GitHub
to suspend the guy who exploited them.  He specifically did it to
*show them* the vulnerability.

Looks like his original attempted reporting of the flaw is here:
(days ago)

  https://github.com/rails/rails/issues/5228

Don't suppose we're after Ruby coders for the Security team? :)

Regards and best wishes,

Justin Clift


> -- Kurt Seifried Red Hat Security Response Team (SRT)

--
Aeolus Community Manager
http://www.aeolusproject.org




More information about the aeolus-devel mailing list