4

I received this Heroku vulnerability email:

https://www.ruby-lang.org/en/news/2014/03/29/heap-overflow-in-yaml-uri-escape-parsing-cve-2014-2525/?mkt_tok=3RkMMJWWfF9wsRonuKjAZKXonjHpfsX%2B6u8vXaO%2FlMI%2F0ER3fOvrPUfGjI4ASsNjI%2BSLDwEYGJlv6SgFQrjAMapmyLgLUhE%3D

In the email, it says:

Check if you’re affected

Run the following on your app:

 $ heroku run “ruby -rpsych -e \”p Psych.libyaml_version.join(‘.’)\”” -a <app name>

If you see the following error message, then you are not vulnerable and can ignore the rest of this email:

  <internal:lib/rubygems/custom_require>:29:in `require': no such file to load -- psych (LoadError)
  from <internal:lib/rubygems/custom_require>:29:in `require'

Unfortunately, when I run it, there was an error (using Mac):

 -bash: syntax error near unexpected token `('

How can I run the command line above correctly ? Thanks.

1 Answer 1

6
$ heroku run “ruby -rpsych -e \”p Psych.libyaml_version.join(‘.’)\”” -a <app name>

has right and left hand quotes: and

Change these to straight quotes for starters: " and '

3
  • 1
    perfect. here is the command successfully executed: heroku run "ruby -rpsych -e \"p Psych.libyaml_version.join('.')\"" -a <app name>
    – Axil
    Apr 7, 2014 at 2:30
  • probably thankfully, i dont have the version less than 0.1.6: Running ruby -rpsych -e "p Psych.libyaml_version.join('.')" attached to terminal... up, run.2603 "0.1.6"
    – Axil
    Apr 7, 2014 at 2:32
  • Yes, oddly enough, all of Heroku's instructions in that email are in right/left-hand quotes (not just the initial check). Make sure to change any that may pertain to you into straight quotes.
    – CodeBiker
    Apr 7, 2014 at 16:09

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.