CVE:CVE-2013-1801
CNNVD:CNNVD-201303-024
Ruby HTTParty是Ruby的一个简单的HTTP/REST客户端库。
Ruby httparty gem 0.9.0和较早的版本没有正确限制字符串值的类型转换。这使得攻击者可以通过利用Action Pack对YAML类型转换或Symbol转换的支持，实施注入攻击并执行任意代码，或导致拒绝服务（内存和CUP耗尽）。
solution:Upgrade john_nunemaker httparty to a higher version than 0.9.0,0.1.0,0.1.1,0.1.2,0.1.3,0.1.5,0.1.6,0.1.7,0.1.8,0.2.0,0.2.1,0.2.2,0.2.3,0.2.4,0.2.5,0.2.6,0.2.7,0.2.8,0.2.9,0.2.10,0.3.0,0.3.1,0.4.0,0.4.1,0.4.2,0.4.3,0.4.4,0.4.5,0.5.0,0.5.1,0.5.2,0.6.0,0.6.1,0.7.0,0.7.1,0.7.2,0.7.3,0.7.4,0.7.5,0.7.6,0.7.7,0.7.8,0.8.0,0.8.1,0.8.2,0.8.3,and avoid the version (,0.9.0],0.1.0,0.1.1,0.1.2,0.1.3,0.1.5,0.1.6,0.1.7,0.1.8,0.2.0,0.2.1,0.2.2,0.2.3,0.2.4,0.2.5,0.2.6,0.2.7,0.2.8,0.2.9,0.2.10,0.3.0,0.3.1,0.4.0,0.4.1,0.4.2,0.4.3,0.4.4,0.4.5,0.5.0,0.5.1,0.5.2,0.6.0,0.6.1,0.7.0,0.7.1,0.7.2,0.7.3,0.7.4,0.7.5,0.7.6,0.7.7,0.7.8,0.8.0,0.8.1,0.8.2,0.8.3