bugtraq - Security Vulnerability in Ruby on Rails 1.1.x

lists.openwall.net		lists / announce owl-users owl-dev john-users john-dev passwdqc-users yescrypt popa3d-users / oss-security kernel-hardening musl sabotage tlsify passwords / crypt-dev xvendor / Bugtraq Full-Disclosure linux-kernel linux-netdev linux-ext4 linux-hardening linux-cve-announce PHC
Open Source and information security mailing list archives

Hash Suite: Windows password security audit tool. GUI, reports in PDF.

[<prev] [next>] [day] [month] [year] [list]

Date: 11 Aug 2006 02:50:48 -0000
From: michael@...iarski.com
To: bugtraq@...urityfocus.com
Subject: Security Vulnerability in Ruby on Rails 1.1.x

Product:   Ruby on Rails
Affected: 1.1.0, 1.1.1, 1.1.2, 1.1.4, 1.1.5

Problem Description
-------------------

Scott Barron and Tobias Luetke, of the Ruby on Rails Core Team, discovered a fault with the dependency resolution mechanism which can, when exploited by a remote attacker, leave a system vulnerable to denial of service attacks, or even data loss.

All users of affected releases are advised to upgrade, or apply the relevant patches immediately.

URL: http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure

Patches
-------
1.1.0: http://www.rubyonrails.org/files/aug_10_security/rel_1-1-0.diff
1.1.1: http://www.rubyonrails.org/files/aug_10_security/rel_1-1-1.diff
1.1.2: http://www.rubyonrails.org/files/aug_10_security/rel_1-1-2.diff
1.1.4: http://www.rubyonrails.org/files/aug_10_security/rel_1-1-4.diff

1.1.5 users should upgrade to 1.1.6.