From: Tom Jordan <tdjordan@...>
Date: 2006-08-10T03:06:06+09:00
Subject: Re: [ANN] Rails 1.1.5: Mandatory security patch (and other tidbits)

I'm getting a Zlib::BufError when it gets to actionpack

On 8/9/06, David Heinemeier Hansson <david.heinemeier@gmail.com> wrote:
> We're still hard at work on Rails 1.2, which features all the new
> dandy REST stuff and more, but a serious security concern has come to
> our attention that needed to be addressed sooner than the release of
> 1.2 would allow. So here's Rails 1.1.5!
>
> This is a MANDATORY upgrade for anyone not running on a very recent
> edge (which isn't affected by this). If you have a public Rails site,
> you MUST upgrade to Rails 1.1.5. The security issue is severe and you
> do not want to be caught unpatched.
>
> The issue is in fact of such a criticality that we're not going to dig
> into the specifics. No need to arm would-be assailants.
>
> So upgrade today, not tomorrow. We've made sure that Rails 1.1.5 is
> fully drop-in compatible with 1.1.4. It only includes a handful of bug
> fixes and no new features.
>
> For the third time: This is not like "sure, I should be flooshing my
> teeth". This is "yes, I will wear my helmet as I try to go 100mph on a
> motorcycle through downtown in rush hour". It's not a suggestion, it's
> a prescription. So get to it!
>
> As always, the trick is to do "gem install rails" and then either
> changing config/environment.rb, if you're bound to gems, or do "rake
> rails:freeze:gems" if you're freezing gems in vendor.
>
> P.S.: If you run a major Rails site and for some reason are completely
> unable to upgrade to 1.1.5, get in touch with the core team and we'll
> try to work with you on a solution.
> --
> David Heinemeier Hansson
> http://www.loudthinking.com -- Broadcasting Brain
> http://www.basecamphq.com   -- Online project management
> http://www.backpackit.com   -- Personal information manager
> http://www.rubyonrails.com  -- Web-application framework
>
>


-- 
"Nothing will ever be attempted, if all
 possible objections must first be
 overcome." - Samuel Johnson

"Luck is what happens when
 preparation meets opportunity." - Seneca