From: Dominique Brezinski <dominique.brezinski@...>
Date: 2005-09-23T01:09:37+09:00
Subject: Re: Vulnerability fixed in 1.8.3

See below for a few grammar edits. As a separate issue, I would like
to discuss the level of detail associated with vulnerability reports.
Disclosing specific details about a vulnerability provides a resource
for other people implementing similar software to learn from and is
generally viewed as a very good thing by the security community. I
cannot read the associated page that is in Japanese, so it is
difficult for me to tell whether or not there is a detailed
description of what caused this vulnerability.

Matz, it appears that you might favor releasing minimal details about
vulnerabilities--is it true? If so, can I persuade you to disclose
more detailed descriptions of vulnerabilities in the future?

On 9/22/05, Yukihiro Matsumoto <matz@ruby-lang.org> wrote:
[snip]
> Description:
>
>   The Object Oriented Scripting Language Ruby supports safely executing an
>   untrusted code with two mechanisms: safe level and taint flag on objects.
>
>   A vulnerability is found that allows bypassing these mechanisms.

s/is/was/ in previous sentence.

>   By using the vulnerability, an arbitrary code can be executed beyond the

s/an// in previous sentence.

>   restrictions specified in each safe level. Therefore, Ruby has to be
>   updated on all systems that use safe level to execute untrusted codes.

s/codes/code/ in previous sentence.

Cheers,
Dom