Re: [vendor-sec] Re: patch sets for recent ruby vulnerabilities

[Jamie Strandboge <jamie () canonical com>]

On Sun, 29 Jun 2008, Robert Buchholz wrote:

> On Thursday 26 June 2008, Jamie Strandboge wrote:
> > ----- Forwarded message from Shugo Maeda <security () ruby-lang org>
> > -----
> >
> > Date: Thu, 26 Jun 2008 12:16:52 +0900
> > From: Shugo Maeda <security () ruby-lang org>
> > To: Jamie Strandboge <jamie () canonical com>
> > Cc: security () ubuntu com
> > Subject: Re: patch sets for recent ruby vulnerabilities
> >
> > Hello,
> >
> > 2008/6/25 Jamie Strandboge <jamie () canonical com>:
> > > > ------------------------------------------------------------------
> > > > ------ r17530 | nobu | 2008-06-22 07:16:45 +0900 (Sun, 22 Jun 2008)
> > > > | 2 lines Changed paths:
> > > >    M /branches/ruby_1_8/ChangeLog
> > > >    M /branches/ruby_1_8/string.c
> > > >
> > > > * string.c (str_buf_cat): check for self concatenation.
> > >
> > > Without having dived into the code yet, is this the fix for the
> > > regressions with rails and others?
> >
> > No, it's not.
> > The following commit may be the cause of the problems with Rails.
> >
> > ---------------------------------------------------------------------
> > --- r15856 | matz | 2008-03-30 00:47:54 +0900 (Sun, 30 Mar 2008) | 2
> > lines Changed paths:
> >    M /branches/ruby_1_8/ChangeLog
> >    M /branches/ruby_1_8/class.c
> >
> > * class.c (clone_method): should copy cref as well.
> >   [ruby-core:15833]
>
>
> Thanks for the info, one of our Ruby maintainers confirmed that 
> reverting this patch lets the test suite run through without errors.
> Did your email contact with Ruby folks yield an information whether they 
> plan to fix it for the 1.8 branch, or do they rely on distributions to 
> ship reverts of the commit if they care about older Rails?
They did not say, however, this patch is not part of the security
patchsets as detailed by Drew Yao or upstream Ruby, so we ommitted it.

> Also, there was a similar thread on oss-security, you posting the 
> information there would probably be appreciated.
Ah yes, meant to do that. Done.

Jamie

-- 
Ubuntu Security Engineer     | http://www.ubuntu.com/
Canonical Ltd.               | http://www.canonical.com/

Attachment: signature.asc
Description: Digital signature