[#15707] Schedule for the 1.8.7 release — "Akinori MUSHA" <knu@...>

Hi, developers,

21 messages 2008/03/01

[#15740] Copy-on-write friendly garbage collector — Hongli Lai <hongli@...99.net>

Hi.

31 messages 2008/03/03
[#15742] Re: Copy-on-write friendly garbage collector — Yukihiro Matsumoto <matz@...> 2008/03/03

Hi,

[#15829] Re: Copy-on-write friendly garbage collector — Daniel DeLorme <dan-ml@...42.com> 2008/03/08

Yukihiro Matsumoto wrote:

[#15756] embedding Ruby 1.9.0 inside pthread — "Suraj Kurapati" <sunaku@...>

Hello,

18 messages 2008/03/03
[#15759] Re: embedding Ruby 1.9.0 inside pthread — Nobuyoshi Nakada <nobu@...> 2008/03/04

Hi,

[#15760] Re: embedding Ruby 1.9.0 inside pthread — Yukihiro Matsumoto <matz@...> 2008/03/04

Hi,

[#15762] Re: embedding Ruby 1.9.0 inside pthread — "Suraj N. Kurapati" <sunaku@...> 2008/03/04

Yukihiro Matsumoto wrote:

[#15783] Adding startup and shutdown to Test::Unit — Daniel Berger <Daniel.Berger@...>

Hi all,

15 messages 2008/03/04

[#15835] TimeoutError in core, timeouts for ConditionVariable#wait — MenTaLguY <mental@...>

I've been reworking JRuby's stdlib to improve performance and fix

10 messages 2008/03/09

[#15990] Recent changes in Range#step behavior — "Vladimir Sizikov" <vsizikov@...>

Hi,

35 messages 2008/03/23
[#15991] Re: Recent changes in Range#step behavior — Dave Thomas <dave@...> 2008/03/23

[#15993] Re: Recent changes in Range#step behavior — "Vladimir Sizikov" <vsizikov@...> 2008/03/23

Hi Dave,

[#15997] Re: Recent changes in Range#step behavior — Dave Thomas <dave@...> 2008/03/23

[#16024] Re: Recent changes in Range#step behavior — "Vladimir Sizikov" <vsizikov@...> 2008/03/26

Hi Dave,

[#16025] Re: Recent changes in Range#step behavior — Yukihiro Matsumoto <matz@...> 2008/03/26

Hi,

[#16026] Re: Recent changes in Range#step behavior — Dave Thomas <dave@...> 2008/03/26

[#16027] Re: Recent changes in Range#step behavior — Yukihiro Matsumoto <matz@...> 2008/03/26

Hi,

[#16029] Re: Recent changes in Range#step behavior — Dave Thomas <dave@...> 2008/03/26

[#16030] Re: Recent changes in Range#step behavior — Yukihiro Matsumoto <matz@...> 2008/03/26

Hi,

[#16031] Re: Recent changes in Range#step behavior — Dave Thomas <dave@...> 2008/03/26

[#16032] Re: Recent changes in Range#step behavior — "Vladimir Sizikov" <vsizikov@...> 2008/03/26

On Wed, Mar 26, 2008 at 7:01 PM, Dave Thomas <dave@pragprog.com> wrote:

[#16033] Re: Recent changes in Range#step behavior — Dave Thomas <dave@...> 2008/03/26

[#16041] Re: Recent changes in Range#step behavior — David Flanagan <david@...> 2008/03/26

Dave Thomas wrote:

Re: Webrick directory traversal exploit on UNIX

From: Jos Backus <jos@...>
Date: 2008-03-12 03:24:20 UTC
List: ruby-core #15866
On Wed, Mar 12, 2008 at 07:36:54AM +0900, Urabe Shyouhei wrote:
> Hi,
> 
> Jos Backus wrote:
>> /etc/passwd is shown (=bad). This means that e.g. ruby-1.8.5-p115 is still
>> vulnerable on UNIX.
>>   
> 
> 
> First of all, thank you very much for reporting this.  We will fix this 
> issue as soon as possible.
> 
> But your posting this sensitive info on a public mailing list cased a bit 
> worrying situation where all existing WEBrick servers
> are now facing a threat of attacks.  Next time would you please send us 
> security considerations for security@ruby-lang.org?
> 
> To people running WEBrick servers:  we are now analyzing this issue.  This 
> is my personal opinion but it is safer for you to stop your processes (if 
> possible) until we fix this.  Please stay tuned for upcoming announces.

I'm so sorry. It's a false alarm. The reason we were confused was because a
colleague brought the directory traversal bug in our web application to our
attention. Doing some googling I found the recently fixed bug in Webrick,
thinking there had to be another issue at hand, hence the email. Further
inspection of our setup revealed that we are running a vulnerable version of
Mongrel, not Webrick. We used to run Webrick for this app which explains why I
was thinking the problem was with Webrick.

In short, it's a (since fixed) Mongrel issue, Webrick is _not_ vulnerable. My
sincere apologies for the false alarm. Thank you for your quick response and
caring.

-- 
Jos Backus
jos at catnook.com

In This Thread