yaml - 修复 : Prior to 0. 1.6，libyaml 容易受到恶意 YAML 负载的堆溢出攻击

Question

添加 vcr gem 后运行 rspec 时出现以下错误。简单运行 gem install psych -- --enable-bundled-libyaml按照建议并不能解决问题。我正在使用 rbenv 和 ruby​​-build，我使用的是 ruby​​ 2.1.1。我该怎么做才能解决这个问题？

SafeYAML Warning
  ----------------

  You appear to have an outdated version of libyaml (0.1.4) installed on your system.

  Prior to 0.1.6, libyaml is vulnerable to a heap overflow exploit from malicious YAML payloads.

  For more info, see:
  https://www.ruby-lang.org/en/news/2014/03/29/heap-overflow-in-yaml-uri-escape-parsing-cve-2014-2525/

  The easiest thing to do right now is probably to update Psych to the latest version and enable
  the 'bundled-libyaml' option, which will install a vendored libyaml with the vulnerability patched:

  gem install psych -- --enable-bundled-libyaml

Answer 1

首先，您必须更新 Ruby-build ，他们最近修补了这个安全问题。现在，它安装 libyaml 0.1.6编译 Ruby。

$ rm -rf ~/.rbenv/plugins/ruby-build
$ git clone https://github.com/sstephenson/ruby-build.git ~/.rbenv/plugins/ruby-build

重新编译，重新安装 Ruby您使用的版本， 2.0.0-p451就我而言:

$ rbenv install 2.0.0-p451
rbenv: /home/ubuntu/.rbenv/versions/2.0.0-p451 already exists
continue with installation? (y/N) y
Downloading yaml-0.1.6.tar.gz...
-> http://dqw8nmjcqpjn7.cloudfront.net/5fe00cda18ca5daeb43762b80c38e06e
...

它适用于我的情况。