oss-security - ruby CVE-2008-4310 (Red Hat specific)

Openwall Project		/home Owl JtR Pro crypt pam_passwdqc tcb phpass scanlogd popa3d msulogin / Linux BIND / advisories presentations / services donations / wordlists passwords / news community lists wiki CVSweb mirrors signatures
bringing security into open environments

Password Recovery Resources on the Net

[<prev] [next>] [month] [year] [list]

Date: Thu, 04 Dec 2008 16:39:10 +0100
From: Jan Lieskovsky <jlieskov@...hat.com>
To: oss-security@...ts.openwall.com, security@...y-lang.org
Subject: ruby CVE-2008-4310 (Red Hat specific)

Hello guys,

This is just a heads-up to avoid confusion, as we are releasing Ruby
updates that address one Red Hat-specific problem that was assigned
CVE id CVE-2008-4310.

In our security update to address CVE-2008-3656 [1] we have managed to
use incorrect patch, that did not address the flaw as was stated in the
advisory. Therefore, we are using CVE-2008-4310 as an identifier for
this incomplete / incorrect fix.

This issue is specific to the previously released Ruby updates for Red
Hat Enteprise Linux 4 and 5.  This is unlikely to affect anyone else
that does not ship this packages based on these.  No new flaw was
discovered, if you've applied correct patch, you can safely ignore this
CVE.

[1] https://rhn.redhat.com/errata/RHSA-2008-0897.html

Thanks, Jan.
--
Jan iankko Lieskovsky / Red Hat Security Response Team

Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.