Ruby "mass assignment" vulnerabilities?
Justin Clift
jclift at redhat.com
Mon Mar 5 09:14:08 UTC 2012
On 05/03/2012, at 4:52 PM, Kurt Seifried wrote:
<snip>
> I think this potentially warrants a CVE, thoughts/comments?
People more technical than me will be able to figure out the CVE bit.
From a non-technical perspective, it seems *extremely* crap of GitHub
to suspend the guy who exploited them. He specifically did it to
*show them* the vulnerability.
Looks like his original attempted reporting of the flaw is here:
(days ago)
https://github.com/rails/rails/issues/5228
Don't suppose we're after Ruby coders for the Security team? :)
Regards and best wishes,
Justin Clift
> -- Kurt Seifried Red Hat Security Response Team (SRT)
--
Aeolus Community Manager
http://www.aeolusproject.org
More information about the aeolus-devel
mailing list