From: Urabe Shyouhei <shyouhei@...>
Date: 2007-12-10T03:20:34+09:00
Subject: Re: CVE-2007-5770

Hi,

Yes, it does affect 1.8 series.  Revision 13567 is the fix for 1.8
branch I think.   I'm preparing to backport it to 1.8.6.

Richard Brown wrote:
> Hi, CVE-2007-5770 [1] was created a while back, and it has been
> suggested that r13656 [2] is a patch to fix it.
>
> This patch does not appear to have been backported the 1.8 branch, but
> the CVE claims that 1.8.6 and 1.8.5 are vulnerable, which is correct?
> [2] does not appear to apply cleanly to 1.8.6-p110.
>
> [1] http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2007-5770
> [2] http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13656
>
> Regards,
>
>