-------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2009-9799 2009-09-24 04:13:14 --------------------------------------------------------------------------------
Name : rubygem-actionpack Product : Fedora 10 Version : 2.1.1 Release : 3.fc10 URL : http://www.rubyonrails.org Summary : Web-flow and rendering framework putting the VC in MVC Description : Eases web-request routing, handling, and response as a half-way front, half-way page controller. Implemented with specific emphasis on enabling easy unit/integration testing that doesn't require a browser. -------------------------------------------------------------------------------- Update Information: A vulnerability is found on Ruby on Rails in the escaping code for the form helpers, which also affects the rpms shipped in Fedora Project. Attackers who can inject deliberately malformed unicode strings into the form helpers can defeat the escaping checks and inject arbitrary HTML. This issue has been tagged as CVE-2009-3009. These new rpms will fix this issue. -------------------------------------------------------------------------------- ChangeLog: * Mon Sep 21 2009 Mamoru Tasaka <mtas...@ioa.s.u-tokyo.ac.jp> - 2.1.1-3 - Patch for CVE-2009-3009 (bug 520843) * Thu Feb 26 2009 Jeroen van Meeuwen <kana...@fedoraproject.org> - 2.1.1-2 - Fix CVE-2008-5189 -------------------------------------------------------------------------------- References: [ 1 ] Bug #520843 - CVE-2009-3009 ruby-activesupport: XSS vulnerability https://bugzilla.redhat.com/show_bug.cgi?id=520843 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update rubygem-actionpack' at the command line. For more information, refer to "Managing Software with yum", available at http://docs.fedoraproject.org/yum/. All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at http://fedoraproject.org/keys -------------------------------------------------------------------------------- _______________________________________________ Fedora-package-announce mailing list Fedora-package-announce@redhat.com http://www.redhat.com/mailman/listinfo/fedora-package-announce