CVE:CVE-2013-1756
CNNVD:CNNVD-201302-634
Dragonfly gem for Ruby是英国软件开发者Mark Evans所研发的一款用于动态处理Rails、Sinatra等框架的图像上传的Ruby Gem。
Dragonfly gem for Ruby 0.7.0和0.9.12版本中存在安全漏洞。当程序与Ruby on Rails一起使用时，远程攻击者可通过发送特制的请求利用该漏洞执行任意代码。
solution:Upgrade mark_evans dragonfly_gem to a higher version than 0.7.0,0.7.1,0.7.2,0.7.3,0.7.4,0.7.5,0.7.6,0.7.7,0.8.0,0.8.1,0.8.2,0.8.4,0.8.5,0.9.0,0.9.1,0.9.2,0.9.3,0.9.4,0.9.5,0.9.6,0.9.7,0.9.8,0.9.9,0.9.10,0.9.11,0.9.12,and avoid the version 0.7.0,0.7.1,0.7.2,0.7.3,0.7.4,0.7.5,0.7.6,0.7.7,0.8.0,0.8.1,0.8.2,0.8.4,0.8.5,0.9.0,0.9.1,0.9.2,0.9.3,0.9.4,0.9.5,0.9.6,0.9.7,0.9.8,0.9.9,0.9.10,0.9.11,0.9.12