Your message dated Sat, 04 Aug 2012 14:20:04 +0100
with message-id <[email protected]>
and subject line Re: Bug#683820: unblock: ruby-actionpack-3.2/3.2.6-3
has caused the Debian Bug report #683820,
regarding unblock: ruby-actionpack-3.2/3.2.6-3
to be marked as done.
This means that you claim that the problem has been dealt with.
If this is not the case it is now your responsibility to reopen the
Bug report if necessary, and/or fix the problem forthwith.
(NB: If you are a system administrator and have no idea what this
message is talking about, this may indicate a serious mail system
misconfiguration somewhere. Please contact [email protected]
immediately.)
--
683820: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683820
Debian Bug Tracking System
Contact [email protected] with problems
--- Begin Message ---
Package: release.debian.org
Severity: normal
User: [email protected]
Usertags: unblock
Please unblock package ruby-actionpack-3.2
This version add a single patch that fixes a secutiry problem
(CVE-2012-3424, #683370), and just uploaded to unstable. You will find a
debdiff against the version currently in testing attached.
unblock ruby-actionpack-3.2/3.2.6-3
-- System Information:
Debian Release: wheezy/sid
APT prefers unstable
APT policy: (500, 'unstable'), (1, 'experimental')
Architecture: amd64 (x86_64)
Kernel: Linux 3.2.0-3-amd64 (SMP w/4 CPU cores)
Locale: LANG=pt_BR.utf8, LC_CTYPE=pt_BR.utf8 (charmap=UTF-8)
Shell: /bin/sh linked to /bin/dash
--
Antonio Terceiro <[email protected]>
diff -Nru ruby-actionpack-3.2-3.2.6/debian/changelog ruby-actionpack-3.2-3.2.6/debian/changelog
--- ruby-actionpack-3.2-3.2.6/debian/changelog 2012-06-24 19:07:35.000000000 -0300
+++ ruby-actionpack-3.2-3.2.6/debian/changelog 2012-08-04 09:29:24.000000000 -0300
@@ -1,3 +1,9 @@
+ruby-actionpack-3.2 (3.2.6-3) unstable; urgency=high
+
+ * Add patch by Aaron Patterson for CVE-2012-3424 (Closes: #683370)
+
+ -- Antonio Terceiro <[email protected]> Sat, 04 Aug 2012 09:28:12 -0300
+
ruby-actionpack-3.2 (3.2.6-2) unstable; urgency=low
* Bump build dependency to gem2deb >= 0.3.0~
diff -Nru ruby-actionpack-3.2-3.2.6/debian/patches/CVE-2012-3424.patch ruby-actionpack-3.2-3.2.6/debian/patches/CVE-2012-3424.patch
--- ruby-actionpack-3.2-3.2.6/debian/patches/CVE-2012-3424.patch 1969-12-31 21:00:00.000000000 -0300
+++ ruby-actionpack-3.2-3.2.6/debian/patches/CVE-2012-3424.patch 2012-08-04 09:27:46.000000000 -0300
@@ -0,0 +1,22 @@
+Description: Do not convert digest auth strings to symbols.
+Author: Aaron Patterson <[email protected]>
+
+---
+
+Origin: upstream, https://github.com/rails/rails/commit/27311fef5efa598f281649074255834546d2b4ec
+Forwarded: not-needed
+
+--- ruby-actionpack-3.2-3.2.6.orig/lib/action_controller/metal/http_authentication.rb
++++ ruby-actionpack-3.2-3.2.6/lib/action_controller/metal/http_authentication.rb
+@@ -227,9 +227,9 @@ module ActionController
+ end
+
+ def decode_credentials(header)
+- Hash[header.to_s.gsub(/^Digest\s+/,'').split(',').map do |pair|
++ HashWithIndifferentAccess[header.to_s.gsub(/^Digest\s+/,'').split(',').map do |pair|
+ key, value = pair.split('=', 2)
+- [key.strip.to_sym, value.to_s.gsub(/^"|"$/,'').gsub(/'/, '')]
++ [key.strip, value.to_s.gsub(/^"|"$/,'').delete('\'')]
+ end]
+ end
+
diff -Nru ruby-actionpack-3.2-3.2.6/debian/patches/series ruby-actionpack-3.2-3.2.6/debian/patches/series
--- ruby-actionpack-3.2-3.2.6/debian/patches/series 1969-12-31 21:00:00.000000000 -0300
+++ ruby-actionpack-3.2-3.2.6/debian/patches/series 2012-08-04 09:26:26.000000000 -0300
@@ -0,0 +1 @@
+CVE-2012-3424.patch
signature.asc
Description: Digital signature
--- End Message ---
--- Begin Message ---
On Sat, 2012-08-04 at 09:55 -0300, Antonio Terceiro wrote:
> Please unblock package ruby-actionpack-3.2
>
> This version add a single patch that fixes a secutiry problem
> (CVE-2012-3424, #683370), and just uploaded to unstable. You will find a
> debdiff against the version currently in testing attached.
Unblocked; thanks.
Regards,
Adam
--- End Message ---
