[<prev] [next>] [day] [month] [year] [list]
Message-ID: <20080630211012.GD11562@severus.strandboge.com>
Date: Mon, 30 Jun 2008 17:10:12 -0400
From: Jamie Strandboge <jamie@...onical.com>
To: Robert Buchholz <rbu@...too.org>
Cc: vendor-sec@....de, oss-security@...ts.openwall.com
Subject: Re: [vendor-sec] Re: patch sets for recent ruby vulnerabilities
On Sun, 29 Jun 2008, Robert Buchholz wrote:
> On Thursday 26 June 2008, Jamie Strandboge wrote:
> > ----- Forwarded message from Shugo Maeda <security@...y-lang.org>
> > -----
> >
> > Date: Thu, 26 Jun 2008 12:16:52 +0900
> > From: Shugo Maeda <security@...y-lang.org>
> > To: Jamie Strandboge <jamie@...onical.com>
> > Cc: security@...ntu.com
> > Subject: Re: patch sets for recent ruby vulnerabilities
> >
> > Hello,
> >
> > 2008/6/25 Jamie Strandboge <jamie@...onical.com>:
> > >> ------------------------------------------------------------------
> > >>------ r17530 | nobu | 2008-06-22 07:16:45 +0900 (Sun, 22 Jun 2008)
> > >> | 2 lines Changed paths:
> > >> M /branches/ruby_1_8/ChangeLog
> > >> M /branches/ruby_1_8/string.c
> > >>
> > >> * string.c (str_buf_cat): check for self concatenation.
> > >
> > > Without having dived into the code yet, is this the fix for the
> > > regressions with rails and others?
> >
> > No, it's not.
> > The following commit may be the cause of the problems with Rails.
> >
> > ---------------------------------------------------------------------
> >--- r15856 | matz | 2008-03-30 00:47:54 +0900 (Sun, 30 Mar 2008) | 2
> > lines Changed paths:
> > M /branches/ruby_1_8/ChangeLog
> > M /branches/ruby_1_8/class.c
> >
> > * class.c (clone_method): should copy cref as well.
> > [ruby-core:15833]
>
>
> Thanks for the info, one of our Ruby maintainers confirmed that
> reverting this patch lets the test suite run through without errors.
> Did your email contact with Ruby folks yield an information whether they
> plan to fix it for the 1.8 branch, or do they rely on distributions to
> ship reverts of the commit if they care about older Rails?
>
They did not say, however, this patch is not part of the security
patchsets as detailed by Drew Yao or upstream Ruby, so we ommitted it.
> Also, there was a similar thread on oss-security, you posting the
> information there would probably be appreciated.
>
Ah yes, meant to do that. Done.
Jamie
--
Ubuntu Security Engineer | http://www.ubuntu.com/
Canonical Ltd. | http://www.canonical.com/
Download attachment "signature.asc" of type "application/pgp-signature" (190 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
