all versions of rails are vunerable to CVE-2009-3009

[Łukasz Stelmach]

Binary package hint: rails

A very serious rails vulnerability CVE-2009-3009 has been disclosed four days ago. Unpatched rails does not prevent XSS crafted with invalid UTF-8 chars. See details at [1] and [2].

[1]http://groups.google.com/group/rubyonrails-security/msg/7f57cd7794e1d1b4
[2]http://weblog.rubyonrails.org/2009/9/4/xss-vulnerability-in-ruby-on-rails

[Scott Kitterman (kitterman)]

Fixed in Karmic:

 rails (2.2.3-1) unstable; urgency=high
 .
   * New upstream release (closes: #545063)
     + Fixes XSS security hole [CVE-2009-3009]
     + Fixes timing issue with cookie store [CVE-2009-3086]
   * Remove dependency on ruby-dbi, as it is not required by any of the
     sources.
   * Correct dependency on fixed libxml-simple-ruby to 1.0.11-2 or later
     (closes: #538982)
   * debian/control
     + Change section from web to ruby
     + Updated to debhelper 7.0+
     + Standards updated to 3.8.3 - no changes

[Łukasz Stelmach (steelman)]

Is there going to be a fix for Jaunty? The patch for 2.1.x is available upstream.

[Alex Valavanis (valavanisalex)]

Intrepid Ibex reached end-of-life on 30 April 2010 so I am closing the report. The bug has been fixed in newer releases of Ubuntu.

[Alex Valavanis (valavanisalex)]

Jaunty reached end-of-life on 23 October 2010. The bug is marked as fixed in later versions of Ubuntu