Project

General

Profile

Actions

Backport #9193

closed

ruby 1.9.3-p484 still vulnerable to CVE-2013-4287 and CVE-2013-4363 in included rubygems 1.8.23

Added by jeremyevans0 (Jeremy Evans) over 8 years ago. Updated over 8 years ago.

Status:
Closed
Priority:
Normal
[ruby-core:58757]

Description

It appears that ruby 2.0.0-p353 included an update to rubygems 2.0.10 which fixes CVE-2013-4287 and CVE-2013-4363. ruby 1.9.3-p484 did not contain an update to the included rubygems, so it is still vulnerable. ruby 1.9.3 should either be updated to use rubygems 1.8.27 or 1.8.28, or the attached patch should be applied to fix the two CVEs.


Files

rubygems.diff (494 Bytes) rubygems.diff jeremyevans0 (Jeremy Evans), 12/02/2013 09:02 AM
ruby_1_9_3.rubygems.1.8.23.2.patch (2.54 KB) ruby_1_9_3.rubygems.1.8.23.2.patch Complete patch with tests drbrain (Eric Hodel), 12/16/2013 05:12 AM
Actions

Also available in: Atom PDF