Bug #7128 “libruby1.8: CGI::Session creates files insecurely” : Bugs : ruby1.8 package : Ubuntu

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2004-07-22:

#1

Automatically imported from Debian bug report #260779 http://bugs.debian.org/260779

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2004-07-22:

#2

Message-Id: <email address hidden>
Date: Thu, 22 Jul 2004 03:14:19 -0400
From: Andres Salomon <email address hidden>
To: Debian Bug Tracking System <email address hidden>
Subject: libruby1.8: CGI::Session creates files insecurely

Package: libruby1.8
Version: 1.8.1+1.8.2pre1-3
Severity: grave
Tags: security upstream
Justification: user security hole

Hi,

I just noticed that CGI::Session's FileStore (and presumably PStore)
implementations store session information insecurely. They simply
create files, ignoring permission issues. I assume the only thing
affecting permissions is the value of umask. For both my user, as
well as www-data, session files end up in /tmp with permission
0644. This is quite bad; an unsuspecting user might be storing
sensitive information in session variables, assuming that the class
stores data securely.

The following script illustrates the problem:

#!/usr/bin/ruby -w

require 'cgi'
require 'cgi/session'

cgi = CGI.new('html4')
session = CGI::Session.new(cgi, 'prefix' => 'blah_')
Kernel.system("ls -l " + Dir.glob("/tmp/blah_*").join(" "))

-- System Information:
Debian Release: testing/unstable
APT prefers unstable
APT policy: (500, 'unstable'), (500, 'testing')
Architecture: i386 (i686)
Kernel: Linux 2.6.7-1-k7
Locale: LANG=en_US, LC_CTYPE=en_US

Versions of packages libruby1.8 depends on:
ii libc6 2.3.2.ds1-13 GNU C Library: Shared libraries an

-- no debconf information

Revision history for this message

In Debian Bug tracker #260779, Matt Zimmerman (mdz) wrote on 2004-07-22: Re: Bug#260779: libruby1.8: CGI::Session creates files insecurely

#3

On Thu, Jul 22, 2004 at 03:14:19AM -0400, Andres Salomon wrote:

> Package: libruby1.8
> Version: 1.8.1+1.8.2pre1-3
> Severity: grave
> Tags: security upstream
> Justification: user security hole
>
> Hi,
>
> I just noticed that CGI::Session's FileStore (and presumably PStore)
> implementations store session information insecurely. They simply
> create files, ignoring permission issues. I assume the only thing
> affecting permissions is the value of umask. For both my user, as
> well as www-data, session files end up in /tmp with permission
> 0644. This is quite bad; an unsuspecting user might be storing
> sensitive information in session variables, assuming that the class
> stores data securely.

I assume 1.8.1-9 in stable has the same problem?

--
- mdz

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2004-07-22:

#4

Message-ID: <email address hidden>
Date: Thu, 22 Jul 2004 08:57:20 -0700
From: Matt Zimmerman <email address hidden>
To: Andres Salomon <email address hidden>, <email address hidden>
Subject: Re: Bug#260779: libruby1.8: CGI::Session creates files insecurely

On Thu, Jul 22, 2004 at 03:14:19AM -0400, Andres Salomon wrote:

> Package: libruby1.8
> Version: 1.8.1+1.8.2pre1-3
> Severity: grave
> Tags: security upstream
> Justification: user security hole
>
> Hi,
>
> I just noticed that CGI::Session's FileStore (and presumably PStore)
> implementations store session information insecurely. They simply
> create files, ignoring permission issues. I assume the only thing
> affecting permissions is the value of umask. For both my user, as
> well as www-data, session files end up in /tmp with permission
> 0644. This is quite bad; an unsuspecting user might be storing
> sensitive information in session variables, assuming that the class
> stores data securely.

I assume 1.8.1-9 in stable has the same problem?

--
- mdz

Revision history for this message

In Debian Bug tracker #260779, Andres Salomon (dilinger-deactivatedaccount) wrote on 2004-07-22:

#5

On Thu, 2004-07-22 at 08:57 -0700, Matt Zimmerman wrote:
> On Thu, Jul 22, 2004 at 03:14:19AM -0400, Andres Salomon wrote:
>
[...]
> > 0644. This is quite bad; an unsuspecting user might be storing
> > sensitive information in session variables, assuming that the class
> > stores data securely.
>
> I assume 1.8.1-9 in stable has the same problem?
>

You mean the ruby packages in stable (1.6.7-3)? The behavior in Woody
is the same.

--
Andres Salomon <email address hidden>

Revision history for this message

In Debian Bug tracker #260779, Matt Zimmerman (mdz) wrote on 2004-07-22:

#6

On Thu, Jul 22, 2004 at 05:37:55PM -0400, Andres Salomon wrote:

> On Thu, 2004-07-22 at 08:57 -0700, Matt Zimmerman wrote:
> > On Thu, Jul 22, 2004 at 03:14:19AM -0400, Andres Salomon wrote:
> >
> [...]
> > > 0644. This is quite bad; an unsuspecting user might be storing
> > > sensitive information in session variables, assuming that the class
> > > stores data securely.
> >
> > I assume 1.8.1-9 in stable has the same problem?
> >
>
> You mean the ruby packages in stable (1.6.7-3)? The behavior in Woody
> is the same.

Right, I read the display crooked. :-)

Please keep the security team in the loop.

--
- mdz

Revision history for this message

In Debian Bug tracker #260779, akira yamada (akira) wrote on 2004-07-22: (件名なし)

#7

forwarded 260779 <email address hidden>

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2004-07-22:

#8

Message-Id: <email address hidden>
Date: Thu, 22 Jul 2004 17:37:55 -0400
From: Andres Salomon <email address hidden>
To: Matt Zimmerman <email address hidden>
Cc: <email address hidden>
Subject: Re: Bug#260779: libruby1.8: CGI::Session creates files insecurely

--=-q9qcgbeVGrSAhqlSZEjX
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

On Thu, 2004-07-22 at 08:57 -0700, Matt Zimmerman wrote:
> On Thu, Jul 22, 2004 at 03:14:19AM -0400, Andres Salomon wrote:
>=20
[...]
> > 0644. This is quite bad; an unsuspecting user might be storing
> > sensitive information in session variables, assuming that the class
> > stores data securely.
>=20
> I assume 1.8.1-9 in stable has the same problem?
>=20

You mean the ruby packages in stable (1.6.7-3)? The behavior in Woody
is the same.

--=20
Andres Salomon <email address hidden>

--=-q9qcgbeVGrSAhqlSZEjX
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQBBADOy78o9R9NraMQRAusgAJsHREZ3/t3xUXXWSZJti/spFrwLcQCeKFsG
5XLdVQB9M80vhulQhca6hIQ=
=KJBb
-----END PGP SIGNATURE-----

--=-q9qcgbeVGrSAhqlSZEjX--

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2004-07-22:

#9

Message-ID: <email address hidden>
Date: Thu, 22 Jul 2004 14:54:31 -0700
From: Matt Zimmerman <email address hidden>
To: Andres Salomon <email address hidden>
Cc: <email address hidden>
Subject: Re: Bug#260779: libruby1.8: CGI::Session creates files insecurely

On Thu, Jul 22, 2004 at 05:37:55PM -0400, Andres Salomon wrote:

> On Thu, 2004-07-22 at 08:57 -0700, Matt Zimmerman wrote:
> > On Thu, Jul 22, 2004 at 03:14:19AM -0400, Andres Salomon wrote:
> >
> [...]
> > > 0644. This is quite bad; an unsuspecting user might be storing
> > > sensitive information in session variables, assuming that the class
> > > stores data securely.
> >
> > I assume 1.8.1-9 in stable has the same problem?
> >
>
> You mean the ruby packages in stable (1.6.7-3)? The behavior in Woody
> is the same.

Right, I read the display crooked. :-)

Please keep the security team in the loop.

--
- mdz

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2004-07-22:

#10

Message-ID: <email address hidden>
Date: Fri, 23 Jul 2004 07:11:11 +0900
From: akira yamada <email address hidden>
To: <email address hidden>
Subject: =?ISO-2022-JP?B?KBskQjdvTD4kSiQ3GyhCKQ==?=

forwarded 260779 <email address hidden>

Revision history for this message

In Debian Bug tracker #260779, akira yamada (akira) wrote on 2004-07-23: Bug#260779: fixed in ruby1.8 1.8.1+1.8.2pre1-4

#11

Download full text (11.2 KiB)

Source: ruby1.8
Source-Version: 1.8.1+1.8.2pre1-4

We believe that the bug you reported is fixed in the latest version of
ruby1.8, which is due to be installed in the Debian FTP archive:

irb1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/irb1.8_1.8.1+1.8.2pre1-4_all.deb
libbigdecimal-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libbigdecimal-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libcurses-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libcurses-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libdl-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libdl-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libdrb-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/libdrb-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
liberb-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/liberb-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libgdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libgdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libiconv-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libiconv-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libopenssl-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libopenssl-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libpty-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libpty-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libracc-runtime-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libracc-runtime-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libreadline-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libreadline-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
librexml-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/librexml-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libruby1.8-dbg_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libruby1.8-dbg_1.8.1+1.8.2pre1-4_i386.deb
libruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libsdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libsdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libsoap-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/libsoap-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libstrscan-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libstrscan-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libsyslog-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libsyslog-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libtcltk-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libtcltk-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libtest-unit-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/libtest-unit-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libtk-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libtk-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libwebrick-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/libwebrick-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libxmlrpc-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/libxmlrpc-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libyaml-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libyaml-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libzlib-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libzlib-ruby1.8_1.8.1+1.8.2pre1-4_i386...

Source: ruby1.8
Source-Version: 1.8.1+1.8.2pre1-4

We believe that the bug you reported is fixed in the latest version of
ruby1.8, which is due to be installed in the Debian FTP archive:

irb1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/irb1.8_1.8.1+1.8.2pre1-4_all.deb
libbigdecimal-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libbigdecimal-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libcurses-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libcurses-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libdl-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libdl-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libdrb-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/libdrb-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
liberb-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/liberb-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libgdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libgdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libiconv-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libiconv-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libopenssl-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libopenssl-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libpty-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libpty-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libracc-runtime-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libracc-runtime-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libreadline-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libreadline-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
librexml-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/librexml-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libruby1.8-dbg_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libruby1.8-dbg_1.8.1+1.8.2pre1-4_i386.deb
libruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libsdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libsdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libsoap-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/libsoap-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libstrscan-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libstrscan-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libsyslog-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libsyslog-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libtcltk-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libtcltk-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libtest-unit-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/libtest-unit-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libtk-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libtk-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libwebrick-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/libwebrick-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libxmlrpc-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/libxmlrpc-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libyaml-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libyaml-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libzlib-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libzlib-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
rdoc1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/rdoc1.8_1.8.1+1.8.2pre1-4_all.deb
ri1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/ri1.8_1.8.1+1.8.2pre1-4_all.deb
ruby1.8-dev_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/ruby1.8-dev_1.8.1+1.8.2pre1-4_i386.deb
ruby1.8-elisp_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/ruby1.8-elisp_1.8.1+1.8.2pre1-4_all.deb
ruby1.8-examples_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/ruby1.8-examples_1.8.1+1.8.2pre1-4_all.deb
ruby1.8_1.8.1+1.8.2pre1-4.diff.gz
  to pool/main/r/ruby1.8/ruby1.8_1.8.1+1.8.2pre1-4.diff.gz
ruby1.8_1.8.1+1.8.2pre1-4.dsc
  to pool/main/r/ruby1.8/ruby1.8_1.8.1+1.8.2pre1-4.dsc
ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/ruby1.8_1.8.1+1.8.2pre1-4_i386.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 260779@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
akira yamada <akira@debian.org> (supplier of updated ruby1.8 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Fri, 23 Jul 2004 07:03:16 +0900
Source: ruby1.8
Binary: libsoap-ruby1.8 libyaml-ruby1.8 rdoc1.8 libdbm-ruby1.8 ri1.8 librexml-ruby1.8 ruby1.8-dev ruby1.8-elisp libdrb-ruby1.8 libreadline-ruby1.8 ruby1.8 libsyslog-ruby1.8 libruby1.8-dbg libtcltk-ruby1.8 libtk-ruby1.8 ruby1.8-examples libxmlrpc-ruby1.8 libracc-runtime-ruby1.8 libzlib-ruby1.8 libsdbm-ruby1.8 libiconv-ruby1.8 libstrscan-ruby1.8 libpty-ruby1.8 libcurses-ruby1.8 libgdbm-ruby1.8 libwebrick-ruby1.8 libtest-unit-ruby1.8 irb1.8 libdl-ruby1.8 liberb-ruby1.8 libopenssl-ruby1.8 libruby1.8 libbigdecimal-ruby1.8
Architecture: source i386 all
Version: 1.8.1+1.8.2pre1-4
Distribution: unstable
Urgency: high
Maintainer: akira yamada <akira@debian.org>
Changed-By: akira yamada <akira@debian.org>
Description: 
 irb1.8     - Interactive Ruby (for Ruby 1.8)
 libbigdecimal-ruby1.8 - Variable precision floating library for Ruby 1.8
 libcurses-ruby1.8 - Curses interface for Ruby 1.8
 libdbm-ruby1.8 - DBM interface for Ruby 1.8
 libdl-ruby1.8 - Extension library to use dynamic linker from Ruby 1.8
 libdrb-ruby1.8 - Distributed Ruby (for Ruby 1.8)
 liberb-ruby1.8 - Tiny eRuby (for Ruby 1.8)
 libgdbm-ruby1.8 - GDBM interface for Ruby 1.8
 libiconv-ruby1.8 - A Wrapper class of iconv for the Ruby 1.8
 libopenssl-ruby1.8 - OpenSSL interface for Ruby 1.8
 libpty-ruby1.8 - pseudo tty interface for Ruby 1.8
 libracc-runtime-ruby1.8 - Runtime library for parser which is generated by Racc (Ruby 1.8)
 libreadline-ruby1.8 - Readline interface for Ruby 1.8
 librexml-ruby1.8 - pure Ruby non-validating XML parser supporting Namespaces, XPath
 libruby1.8 - Libraries necessary to run the Ruby 1.8
 libruby1.8-dbg - Debugging libraries for Ruby 1.8
 libsdbm-ruby1.8 - SDBM interface for Ruby 1.8
 libsoap-ruby1.8 - Ruby's SOAP implementation for Ruby 1.8
 libstrscan-ruby1.8 - Fast string scanning library for Ruby 1.8
 libsyslog-ruby1.8 - UNIX syslog(3) interface for Ruby 1.8
 libtcltk-ruby1.8 - Tcl/Tk interface for Ruby 1.8
 libtest-unit-ruby1.8 - unit-testing framework for Ruby 1.8
 libtk-ruby1.8 - Tk interface for Ruby 1.8
 libwebrick-ruby1.8 - Simple HTTP Server Toolkit for Ruby 1.8
 libxmlrpc-ruby1.8 - XML-RPC support for Ruby 1.8
 libyaml-ruby1.8 - YAML for Ruby 1.8
 libzlib-ruby1.8 - Extension library to use zlib from Ruby 1.8
 rdoc1.8    - Generate documentation from Ruby source files (for Ruby 1.8)
 ri1.8      - Ruby Interactive reference (for Ruby 1.8)
 ruby1.8    - Interpreter of object-oriented scripting language Ruby 1.8
 ruby1.8-dev - Header files for compiling extension modules for the Ruby 1.8
 ruby1.8-elisp - ruby-mode for Emacsen
 ruby1.8-examples - Examples for Ruby 1.8
Closes: 260779
Changes: 
 ruby1.8 (1.8.1+1.8.2pre1-4) unstable; urgency=high
 .
   * akira yamada <akira@debian.org>
   - (urgency high) updated debian/patches/800_sleep.patch:
       - previous patch is incomplete, sleep() is still broken.
   - (urgency high) added debian/patches/811_cgi_session.patch:
       - sets the permission of the session data file to 0600.  [ruby-dev:23952]
         (closes: #260779)
Files: 
 b6e760384a701d11468343e6554da8e4 1390 interpreters optional ruby1.8_1.8.1+1.8.2pre1-4.dsc
 2f6c49aa568f8e7488e3df82337ea0b8 35951 interpreters optional ruby1.8_1.8.1+1.8.2pre1-4.diff.gz
 243ce5b609450e674e95b7dd8459ace7 105038 interpreters optional ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 38889480ae702639dfa2618446a41cd1 776080 libs optional libruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 200908bf734cb5ba2d0ee3b49ab09b4a 705276 libdevel extra libruby1.8-dbg_1.8.1+1.8.2pre1-4_i386.deb
 3fb81ba91811475c3f8db9cba57be854 569048 devel optional ruby1.8-dev_1.8.1+1.8.2pre1-4_i386.deb
 d14b33ad8951593479b243a64ad88ab3 97512 interpreters optional libcurses-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 55da74ae9c2cb2d93435a956b8c04377 91292 interpreters optional libdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 c791e996c638e8c60bdf8d6075be6771 92490 interpreters optional libgdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 5a512c3065e4da507925dba475513c44 90150 interpreters optional libpty-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 f8e89384bef6c43cee1b7f1b68344003 88174 interpreters optional libreadline-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 d273a2d0eea7e78f7c6e1e9fc71fad2c 94314 interpreters optional libsdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 0c2d9ef30efa03c85d1537f3e4618ef8 138580 interpreters optional libtcltk-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 fca91e77a9dbd2768464f143daa5a530 1078426 interpreters optional libtk-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 096065b9dc74be38d918350b42d1c51c 87656 interpreters optional libsyslog-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 4b09e15cc08b60a209bc1cfa855d2f79 86918 interpreters optional libiconv-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 604ddd007ccc35e40e6ea15840fedb4a 89674 interpreters optional libracc-runtime-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 669850baa128b8de10fc4e70f34a687f 87250 interpreters optional libstrscan-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 0205f28e2700bcda04fc7e6da441ca5c 122172 interpreters optional libdl-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 b2d6a20fe0fbe7ce7dde76b2db25f06b 102496 interpreters optional libzlib-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 fbd00087b2219763c1aadff631e0e8b5 125396 interpreters optional libbigdecimal-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 9b81e8d90654779014e804c2daa6913b 132594 interpreters optional libyaml-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 939dea2142f418fd0265f0a6af9ab296 178406 interpreters optional libopenssl-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 654af2a0a5991080812ad102f94c1880 108130 interpreters optional libtest-unit-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
 81d3428c8dacbb20c2bd36249699f056 85436 interpreters optional liberb-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
 65d95950d84467233366e7bab89d180b 142250 interpreters optional librexml-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
 51830c691c0d5161ec660dd5ded24a49 105090 interpreters optional libdrb-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
 abcdf40cde48ccad369e16e3778f12de 103250 interpreters optional libxmlrpc-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
 7e56913a963d4191545fd9c3c62002c5 112268 interpreters optional libwebrick-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
 51627badf5343c6e31284c424e280ddc 185214 web optional libsoap-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
 56c9ff2108f795338d0f90473c23d956 109292 interpreters optional ruby1.8-examples_1.8.1+1.8.2pre1-4_all.deb
 55ce5a27acf654a76d6b309b06cb9f97 99032 interpreters optional ruby1.8-elisp_1.8.1+1.8.2pre1-4_all.deb
 0fb5dd8120789684abad2ac5aca9264f 383664 interpreters optional ri1.8_1.8.1+1.8.2pre1-4_all.deb
 88f42d1937a403edf0a0bbec069d16f6 186302 doc optional rdoc1.8_1.8.1+1.8.2pre1-4_all.deb
 9b8a363005e24a64dc31e1a4e644fda0 122726 interpreters optional irb1.8_1.8.1+1.8.2pre1-4_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBAFsVXzkxpuIT8aARAjmvAJ9TqLSEjw0z3prFgw8/Tn9lSlrbAwCff/HR
kcRL3+wDNcBiTgURi2UjRCM=
=WimA
-----END PGP SIGNATURE-----

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2004-07-23:

#12

Download full text (11.4 KiB)

Message-Id: <email address hidden>
Date: Thu, 22 Jul 2004 20:47:07 -0400
From: akira yamada <email address hidden>
To: <email address hidden>
Subject: Bug#260779: fixed in ruby1.8 1.8.1+1.8.2pre1-4

Source: ruby1.8
Source-Version: 1.8.1+1.8.2pre1-4

We believe that the bug you reported is fixed in the latest version of
ruby1.8, which is due to be installed in the Debian FTP archive:

irb1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/irb1.8_1.8.1+1.8.2pre1-4_all.deb
libbigdecimal-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libbigdecimal-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libcurses-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libcurses-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libdl-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libdl-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libdrb-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/libdrb-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
liberb-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/liberb-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libgdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libgdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libiconv-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libiconv-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libopenssl-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libopenssl-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libpty-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libpty-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libracc-runtime-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libracc-runtime-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libreadline-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libreadline-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
librexml-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/librexml-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libruby1.8-dbg_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libruby1.8-dbg_1.8.1+1.8.2pre1-4_i386.deb
libruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libsdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libsdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libsoap-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/libsoap-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libstrscan-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libstrscan-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libsyslog-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libsyslog-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libtcltk-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libtcltk-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libtest-unit-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/libtest-unit-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libtk-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libtk-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libwebrick-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/libwebrick-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libxmlrpc-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/libxmlrpc-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
...

Message-Id: <E1BnoDL-0005K6-00@newraff.debian.org>
Date: Thu, 22 Jul 2004 20:47:07 -0400
From: akira yamada <akira@debian.org>
To: 260779-close@bugs.debian.org
Subject: Bug#260779: fixed in ruby1.8 1.8.1+1.8.2pre1-4

Source: ruby1.8
Source-Version: 1.8.1+1.8.2pre1-4

We believe that the bug you reported is fixed in the latest version of
ruby1.8, which is due to be installed in the Debian FTP archive:

irb1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/irb1.8_1.8.1+1.8.2pre1-4_all.deb
libbigdecimal-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libbigdecimal-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libcurses-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libcurses-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libdl-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libdl-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libdrb-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/libdrb-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
liberb-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/liberb-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libgdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libgdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libiconv-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libiconv-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libopenssl-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libopenssl-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libpty-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libpty-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libracc-runtime-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libracc-runtime-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libreadline-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libreadline-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
librexml-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/librexml-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libruby1.8-dbg_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libruby1.8-dbg_1.8.1+1.8.2pre1-4_i386.deb
libruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libsdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libsdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libsoap-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/libsoap-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libstrscan-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libstrscan-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libsyslog-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libsyslog-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libtcltk-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libtcltk-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libtest-unit-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/libtest-unit-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libtk-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libtk-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libwebrick-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/libwebrick-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libxmlrpc-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/libxmlrpc-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
libyaml-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libyaml-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
libzlib-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/libzlib-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
rdoc1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/rdoc1.8_1.8.1+1.8.2pre1-4_all.deb
ri1.8_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/ri1.8_1.8.1+1.8.2pre1-4_all.deb
ruby1.8-dev_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/ruby1.8-dev_1.8.1+1.8.2pre1-4_i386.deb
ruby1.8-elisp_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/ruby1.8-elisp_1.8.1+1.8.2pre1-4_all.deb
ruby1.8-examples_1.8.1+1.8.2pre1-4_all.deb
  to pool/main/r/ruby1.8/ruby1.8-examples_1.8.1+1.8.2pre1-4_all.deb
ruby1.8_1.8.1+1.8.2pre1-4.diff.gz
  to pool/main/r/ruby1.8/ruby1.8_1.8.1+1.8.2pre1-4.diff.gz
ruby1.8_1.8.1+1.8.2pre1-4.dsc
  to pool/main/r/ruby1.8/ruby1.8_1.8.1+1.8.2pre1-4.dsc
ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
  to pool/main/r/ruby1.8/ruby1.8_1.8.1+1.8.2pre1-4_i386.deb

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 260779@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
akira yamada <akira@debian.org> (supplier of updated ruby1.8 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@debian.org)

-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA1

Format: 1.7
Date: Fri, 23 Jul 2004 07:03:16 +0900
Source: ruby1.8
Binary: libsoap-ruby1.8 libyaml-ruby1.8 rdoc1.8 libdbm-ruby1.8 ri1.8 librexml-ruby1.8 ruby1.8-dev ruby1.8-elisp libdrb-ruby1.8 libreadline-ruby1.8 ruby1.8 libsyslog-ruby1.8 libruby1.8-dbg libtcltk-ruby1.8 libtk-ruby1.8 ruby1.8-examples libxmlrpc-ruby1.8 libracc-runtime-ruby1.8 libzlib-ruby1.8 libsdbm-ruby1.8 libiconv-ruby1.8 libstrscan-ruby1.8 libpty-ruby1.8 libcurses-ruby1.8 libgdbm-ruby1.8 libwebrick-ruby1.8 libtest-unit-ruby1.8 irb1.8 libdl-ruby1.8 liberb-ruby1.8 libopenssl-ruby1.8 libruby1.8 libbigdecimal-ruby1.8
Architecture: source i386 all
Version: 1.8.1+1.8.2pre1-4
Distribution: unstable
Urgency: high
Maintainer: akira yamada <akira@debian.org>
Changed-By: akira yamada <akira@debian.org>
Description: 
 irb1.8     - Interactive Ruby (for Ruby 1.8)
 libbigdecimal-ruby1.8 - Variable precision floating library for Ruby 1.8
 libcurses-ruby1.8 - Curses interface for Ruby 1.8
 libdbm-ruby1.8 - DBM interface for Ruby 1.8
 libdl-ruby1.8 - Extension library to use dynamic linker from Ruby 1.8
 libdrb-ruby1.8 - Distributed Ruby (for Ruby 1.8)
 liberb-ruby1.8 - Tiny eRuby (for Ruby 1.8)
 libgdbm-ruby1.8 - GDBM interface for Ruby 1.8
 libiconv-ruby1.8 - A Wrapper class of iconv for the Ruby 1.8
 libopenssl-ruby1.8 - OpenSSL interface for Ruby 1.8
 libpty-ruby1.8 - pseudo tty interface for Ruby 1.8
 libracc-runtime-ruby1.8 - Runtime library for parser which is generated by Racc (Ruby 1.8)
 libreadline-ruby1.8 - Readline interface for Ruby 1.8
 librexml-ruby1.8 - pure Ruby non-validating XML parser supporting Namespaces, XPath
 libruby1.8 - Libraries necessary to run the Ruby 1.8
 libruby1.8-dbg - Debugging libraries for Ruby 1.8
 libsdbm-ruby1.8 - SDBM interface for Ruby 1.8
 libsoap-ruby1.8 - Ruby's SOAP implementation for Ruby 1.8
 libstrscan-ruby1.8 - Fast string scanning library for Ruby 1.8
 libsyslog-ruby1.8 - UNIX syslog(3) interface for Ruby 1.8
 libtcltk-ruby1.8 - Tcl/Tk interface for Ruby 1.8
 libtest-unit-ruby1.8 - unit-testing framework for Ruby 1.8
 libtk-ruby1.8 - Tk interface for Ruby 1.8
 libwebrick-ruby1.8 - Simple HTTP Server Toolkit for Ruby 1.8
 libxmlrpc-ruby1.8 - XML-RPC support for Ruby 1.8
 libyaml-ruby1.8 - YAML for Ruby 1.8
 libzlib-ruby1.8 - Extension library to use zlib from Ruby 1.8
 rdoc1.8    - Generate documentation from Ruby source files (for Ruby 1.8)
 ri1.8      - Ruby Interactive reference (for Ruby 1.8)
 ruby1.8    - Interpreter of object-oriented scripting language Ruby 1.8
 ruby1.8-dev - Header files for compiling extension modules for the Ruby 1.8
 ruby1.8-elisp - ruby-mode for Emacsen
 ruby1.8-examples - Examples for Ruby 1.8
Closes: 260779
Changes: 
 ruby1.8 (1.8.1+1.8.2pre1-4) unstable; urgency=high
 .
   * akira yamada <akira@debian.org>
   - (urgency high) updated debian/patches/800_sleep.patch:
       - previous patch is incomplete, sleep() is still broken.
   - (urgency high) added debian/patches/811_cgi_session.patch:
       - sets the permission of the session data file to 0600.  [ruby-dev:23952]
         (closes: #260779)
Files: 
 b6e760384a701d11468343e6554da8e4 1390 interpreters optional ruby1.8_1.8.1+1.8.2pre1-4.dsc
 2f6c49aa568f8e7488e3df82337ea0b8 35951 interpreters optional ruby1.8_1.8.1+1.8.2pre1-4.diff.gz
 243ce5b609450e674e95b7dd8459ace7 105038 interpreters optional ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 38889480ae702639dfa2618446a41cd1 776080 libs optional libruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 200908bf734cb5ba2d0ee3b49ab09b4a 705276 libdevel extra libruby1.8-dbg_1.8.1+1.8.2pre1-4_i386.deb
 3fb81ba91811475c3f8db9cba57be854 569048 devel optional ruby1.8-dev_1.8.1+1.8.2pre1-4_i386.deb
 d14b33ad8951593479b243a64ad88ab3 97512 interpreters optional libcurses-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 55da74ae9c2cb2d93435a956b8c04377 91292 interpreters optional libdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 c791e996c638e8c60bdf8d6075be6771 92490 interpreters optional libgdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 5a512c3065e4da507925dba475513c44 90150 interpreters optional libpty-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 f8e89384bef6c43cee1b7f1b68344003 88174 interpreters optional libreadline-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 d273a2d0eea7e78f7c6e1e9fc71fad2c 94314 interpreters optional libsdbm-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 0c2d9ef30efa03c85d1537f3e4618ef8 138580 interpreters optional libtcltk-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 fca91e77a9dbd2768464f143daa5a530 1078426 interpreters optional libtk-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 096065b9dc74be38d918350b42d1c51c 87656 interpreters optional libsyslog-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 4b09e15cc08b60a209bc1cfa855d2f79 86918 interpreters optional libiconv-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 604ddd007ccc35e40e6ea15840fedb4a 89674 interpreters optional libracc-runtime-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 669850baa128b8de10fc4e70f34a687f 87250 interpreters optional libstrscan-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 0205f28e2700bcda04fc7e6da441ca5c 122172 interpreters optional libdl-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 b2d6a20fe0fbe7ce7dde76b2db25f06b 102496 interpreters optional libzlib-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 fbd00087b2219763c1aadff631e0e8b5 125396 interpreters optional libbigdecimal-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 9b81e8d90654779014e804c2daa6913b 132594 interpreters optional libyaml-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 939dea2142f418fd0265f0a6af9ab296 178406 interpreters optional libopenssl-ruby1.8_1.8.1+1.8.2pre1-4_i386.deb
 654af2a0a5991080812ad102f94c1880 108130 interpreters optional libtest-unit-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
 81d3428c8dacbb20c2bd36249699f056 85436 interpreters optional liberb-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
 65d95950d84467233366e7bab89d180b 142250 interpreters optional librexml-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
 51830c691c0d5161ec660dd5ded24a49 105090 interpreters optional libdrb-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
 abcdf40cde48ccad369e16e3778f12de 103250 interpreters optional libxmlrpc-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
 7e56913a963d4191545fd9c3c62002c5 112268 interpreters optional libwebrick-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
 51627badf5343c6e31284c424e280ddc 185214 web optional libsoap-ruby1.8_1.8.1+1.8.2pre1-4_all.deb
 56c9ff2108f795338d0f90473c23d956 109292 interpreters optional ruby1.8-examples_1.8.1+1.8.2pre1-4_all.deb
 55ce5a27acf654a76d6b309b06cb9f97 99032 interpreters optional ruby1.8-elisp_1.8.1+1.8.2pre1-4_all.deb
 0fb5dd8120789684abad2ac5aca9264f 383664 interpreters optional ri1.8_1.8.1+1.8.2pre1-4_all.deb
 88f42d1937a403edf0a0bbec069d16f6 186302 doc optional rdoc1.8_1.8.1+1.8.2pre1-4_all.deb
 9b8a363005e24a64dc31e1a4e644fda0 122726 interpreters optional irb1.8_1.8.1+1.8.2pre1-4_all.deb

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQFBAFsVXzkxpuIT8aARAjmvAJ9TqLSEjw0z3prFgw8/Tn9lSlrbAwCff/HR
kcRL3+wDNcBiTgURi2UjRCM=
=WimA
-----END PGP SIGNATURE-----

Revision history for this message

Fabio Massimo Di Nitto (fabbione) wrote on 2004-07-23:

#13

Request sync.

Revision history for this message

In Debian Bug tracker #260779, Andres Salomon (dilinger-deactivatedaccount) wrote on 2004-07-23: open in sarge/woody

#14

reopen 260779
tags 260779 + woody sarge
thanks

Thanks for the fast fix for sid. Unfortunately, this bug is also in
woody and sarge. For woody, a proper security update should be done.
For sarge.. well, hopefully ruby1.8 will make it in there quickly. This
bug should be kept around until it does, so that sarge isn't releasing
w/ this problem.

--
Andres Salomon <email address hidden>

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2004-07-23:

#15

Message-Id: <email address hidden>
Date: Fri, 23 Jul 2004 16:59:49 -0400
From: Andres Salomon <email address hidden>
To: <email address hidden>
Subject: open in sarge/woody

--=-E37MQzT9P5UXgDqWsacq
Content-Type: text/plain
Content-Transfer-Encoding: quoted-printable

reopen 260779
tags 260779 + woody sarge
thanks

Thanks for the fast fix for sid. Unfortunately, this bug is also in
woody and sarge. For woody, a proper security update should be done.
For sarge.. well, hopefully ruby1.8 will make it in there quickly. This
bug should be kept around until it does, so that sarge isn't releasing
w/ this problem.

--=20
Andres Salomon <email address hidden>

--=-E37MQzT9P5UXgDqWsacq
Content-Type: application/pgp-signature; name=signature.asc
Content-Description: This is a digitally signed message part

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.4 (GNU/Linux)

iD8DBQBBAXxE78o9R9NraMQRAsrSAKCnWUk1eKi1SEv0ewvIg4MJFU2kUgCePkSY
9ueJHyH/6DnGWUH9SHNsp40=
=T9Ve
-----END PGP SIGNATURE-----

--=-E37MQzT9P5UXgDqWsacq--

Revision history for this message

In Debian Bug tracker #260779, Frank Lichtenheld (djpig) wrote on 2004-08-05: tagging 260779

#16

# fixed version has propagated to testing
tag 260779 - sarge

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2004-08-05:

#17

Message-Id: <email address hidden>
Date: Thu, 5 Aug 2004 20:08:34 +0200
From: Frank Lichtenheld <email address hidden>
To: <email address hidden>
Subject: tagging 260779

# fixed version has propagated to testing
tag 260779 - sarge

Revision history for this message

In Debian Bug tracker #260779, akira yamada (akira) wrote on 2004-08-19: Re: Bug#260779: open in sarge/woody

#18

> Thanks for the fast fix for sid. Unfortunately, this bug is also in
> woody and sarge. For woody, a proper security update should be done.
> For sarge.. well, hopefully ruby1.8 will make it in there quickly. This
> bug should be kept around until it does, so that sarge isn't releasing
> w/ this problem.

DSA-537-1 was published.
--
akira yamada <URL:http://arika.org>

Revision history for this message

Debian Bug Importer (debzilla) wrote on 2004-08-19:

#19

Message-Id: <email address hidden>
Date: Thu, 19 Aug 2004 12:27:25 +0900
From: akira yamada <email address hidden>
To: Andres Salomon <email address hidden>, <email address hidden>
Cc: <email address hidden>
Subject: Re: Bug#260779: open in sarge/woody

> Thanks for the fast fix for sid. Unfortunately, this bug is also in
> woody and sarge. For woody, a proper security update should be done.
> For sarge.. well, hopefully ruby1.8 will make it in there quickly. This
> bug should be kept around until it does, so that sarge isn't releasing
> w/ this problem.

DSA-537-1 was published.
--
akira yamada <URL:http://arika.org>

Revision history for this message

Fabio Massimo Di Nitto (fabbione) wrote on 2004-08-24:

#20

*** Bug 7578 has been marked as a duplicate of this bug. ***

Revision history for this message

Matt Zimmerman (mdz) wrote on 2004-08-30:

#21

See also Bug#7578 for another ruby vulnerability that needs to be fixed.

Since there are many changes since Warty, I've asked LaMont to regression-test
the builds before we sync

Revision history for this message

Matt Zimmerman (mdz) wrote on 2004-09-02:

#22

sync complete

Bug Watch Updater (bug-watch-updater) on 2006-09-27

Changed in ruby1.8:
status:	Unknown → Fix Released

Affects		Status	Importance	Assigned to	Milestone
	ruby1.8 (Debian)	Fix Released	Unknown	debbugs #260779
	ruby1.8 (Ubuntu)	Fix Released	High	LaMont Jones

Ubuntu
ruby1.8 package

libruby1.8: CGI::Session creates files insecurely

Bug Description

Other bug subscribers

Remote bug watches

Ubunturuby1.8 package

libruby1.8: CGI::Session creates files insecurely

Bug Description

Other bug subscribers

Remote bug watches

Ubuntu
ruby1.8 package