| Package | Affected versions | Patched versions |
|---|---|---|
| awesome-bot | all versions | |
| bitcoin_vanity | all versions | |
| blockchain_wallet | all versions | |
| capistrano-colors | all versions | |
| coin_base | all versions | |
| coming-soon | all versions | |
| cron_parser | = 0.1.4≥ 1.0.13, ≤ 1.0.14 | |
| doge-coin | all versions | |
| omniauth_amazon | all versions | |
| rest-client | ≥ 1.6.10, < 1.7.0 | 1.7.0 |
| rest-client | ≥ 1.6.10, ≤ 1.6.13 |
The rest-client gem 1.6.10 through 1.6.13 for Ruby, as distributed on RubyGems.org, included a code-execution backdoor inserted by a third party. Users of an affected version should consider downgrading to the last non-affected version of 1.6.9, or upgrading to 1.7.x. Additionally, a set of other minor gems have been partially or completely yanked and are included in this advisory. These include cron_parser, coin_base, blockchain_wallet, awesome-bot, doge-coin, capistrano-colors, bitcoin_vanity, lita_coin, coming-soon, and omniauth_amazon.
Running one of these products? Scan your site to see whether it exposes a vulnerable version.
Scan my site free