diff -u ruby1.8-1.8.5/debian/changelog ruby1.8-1.8.5/debian/changelog
--- ruby1.8-1.8.5/debian/changelog
+++ ruby1.8-1.8.5/debian/changelog
@@ -1,3 +1,30 @@
+ruby1.8 (1.8.5-4ubuntu2.1) feisty-security; urgency=low
+
+  * SECURITY UPDATE: From CVE:
+    The connect method in lib/net/http.rb in the (1)
+    Net::HTTP and (2) Net::HTTPS libraries in Ruby 1.8.5 and 1.8.6 does not
+    verify that the commonName (CN) field in a server certificate matches the
+    domain name in an HTTPS request, which makes it easier for remote attackers to
+    intercept SSL transmissions via a man-in-the-middle attack or spoofed web
+    site.
+    The same issues are applying to other files.
+  * This upload closes (LP: #149616)
+  * debian/patches/950_CVE-2007-5162.patch: Added patch 
+    according to upstream
+    (http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13499)
+  * debian/patches/951_CVE-2007-5770.patch: Added patch according to
+    upstream
+    (http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=rev&revision=13656)
+    lib/net/smtp.rb and lib/net/pop.rb are not vulnerable, they don't have any
+    SSL/TLS functionality in our release.
+  * References: 
+    CVE-2007-5162
+    CVE-2007-5770
+    https://bugzilla.redhat.com/show_bug.cgi?id=313691
+    https://bugzilla.redhat.com/show_bug.cgi?id=362081
+
+ -- Stephan Hermann <sh@sourcecode.de>  Tue, 13 Nov 2007 21:53:06 +0100
+
 ruby1.8 (1.8.5-4ubuntu2) feisty; urgency=low
 
   * Rebuild for changes in the amd64 toolchain.
only in patch2:
unchanged:
--- ruby1.8-1.8.5.orig/debian/patches/951_CVE-2007-5770.patch
+++ ruby1.8-1.8.5/debian/patches/951_CVE-2007-5770.patch
@@ -0,0 +1,93 @@
+diff -ruN ruby-1.8.5-old/ext/openssl/lib/net/ftptls.rb ruby-1.8.5/ext/openssl/lib/net/ftptls.rb
+--- ruby-1.8.5-old/ext/openssl/lib/net/ftptls.rb	2003-07-23 18:11:30.000000000 +0200
++++ ruby-1.8.5/ext/openssl/lib/net/ftptls.rb	2007-11-13 21:51:37.000000000 +0100
+@@ -29,13 +29,23 @@
+ 
+ module Net
+   class FTPTLS < FTP
++    def connect(host, port=FTP_PORT)
++      @hostname = host
++      super
++    end
++
+     def login(user = "anonymous", passwd = nil, acct = nil)
++       store = OpenSSL::X509::Store.new
++       store.set_default_paths
+        ctx = OpenSSL::SSL::SSLContext.new('SSLv23')
++       ctx.cert_store = store
++       ctx.verify_mode = OpenSSL::SSL::VERIFY_PEER
+        ctx.key = nil
+        ctx.cert = nil
+        voidcmd("AUTH TLS")
+        @sock = OpenSSL::SSL::SSLSocket.new(@sock, ctx)
+        @sock.connect
++       @sock.post_connection_check(@hostname)
+        super(user, passwd, acct)
+        voidcmd("PBSZ 0")
+     end
+diff -ruN ruby-1.8.5-old/ext/openssl/lib/net/telnets.rb ruby-1.8.5/ext/openssl/lib/net/telnets.rb
+--- ruby-1.8.5-old/ext/openssl/lib/net/telnets.rb	2004-12-20 04:49:16.000000000 +0100
++++ ruby-1.8.5/ext/openssl/lib/net/telnets.rb	2007-11-13 21:52:18.000000000 +0100
+@@ -134,6 +134,9 @@
+             @sock.verify_callback = @options['VerifyCallback']
+             @sock.verify_depth    = @options['VerifyDepth']
+             @sock.connect
++            if @options['VerifyMode'] != OpenSSL::SSL::VERIFY_NONE
++              @sock.post_connection_check(@options['Host'])
++            end
+             @ssl = true
+           end
+           ''
+diff -ruN ruby-1.8.5-old/lib/net/imap.rb ruby-1.8.5/lib/net/imap.rb
+--- ruby-1.8.5-old/lib/net/imap.rb	2007-11-13 21:46:59.000000000 +0100
++++ ruby-1.8.5/lib/net/imap.rb	2007-11-13 21:49:24.000000000 +0100
+@@ -881,21 +881,8 @@
+       @parser = ResponseParser.new
+       @sock = TCPSocket.open(host, port)
+       if usessl
+-        unless defined?(OpenSSL)
+-          raise "SSL extension not installed"
+-        end
++        start_tls_session(certs, verify)
+         @usessl = true
+-
+-        # verify the server.
+-        context = SSLContext::new()
+-        context.ca_file = certs if certs && FileTest::file?(certs)
+-        context.ca_path = certs if certs && FileTest::directory?(certs)
+-        context.verify_mode = VERIFY_PEER if verify
+-        if defined?(VerifyCallbackProc)
+-          context.verify_callback = VerifyCallbackProc 
+-        end
+-        @sock = SSLSocket.new(@sock, context)
+-        @sock.connect   # start ssl session.
+       else
+         @usessl = false
+       end
+@@ -1336,6 +1323,26 @@
+     end
+     private_class_method :u8tou16
+ 
++    def start_tls_session(certs, verify)
++      unless defined?(OpenSSL)
++        raise "SSL extension not installed"
++      end
++      if @sock.kind_of?(OpenSSL::SSL::SSLSocket)
++        raise RuntimeError, "already using SSL"
++      end
++      context = SSLContext::new()
++      context.ca_file = certs if certs && FileTest::file?(certs)
++      context.ca_path = certs if certs && FileTest::directory?(certs)
++      context.verify_mode = VERIFY_PEER if verify
++      if defined?(VerifyCallbackProc)
++        context.verify_callback = VerifyCallbackProc 
++      end
++      @sock = SSLSocket.new(@sock, context)
++      @sock.sync_close = true
++      @sock.connect
++      @sock.post_connection_check(@host) if verify
++    end
++
+     class RawData # :nodoc:
+       def send_data(imap)
+         imap.send(:put_string, @data)
only in patch2:
unchanged:
--- ruby1.8-1.8.5.orig/debian/patches/950_CVE-2007-5162.patch
+++ ruby1.8-1.8.5/debian/patches/950_CVE-2007-5162.patch
@@ -0,0 +1,76 @@
+diff -ruN ruby-1.8.5-old/ext/openssl/lib/openssl/ssl.rb ruby-1.8.5/ext/openssl/lib/openssl/ssl.rb
+--- ruby-1.8.5-old/ext/openssl/lib/openssl/ssl.rb	2006-05-23 20:14:05.000000000 +0200
++++ ruby-1.8.5/ext/openssl/lib/openssl/ssl.rb	2007-11-13 21:45:31.000000000 +0100
+@@ -88,7 +88,7 @@
+             end
+           }
+         end
+-        raise SSLError, "hostname not match"
++        raise SSLError, "hostname was not match with the server certificate"
+       end
+     end
+ 
+diff -ruN ruby-1.8.5-old/lib/net/http.rb ruby-1.8.5/lib/net/http.rb
+--- ruby-1.8.5-old/lib/net/http.rb	2006-07-26 15:27:18.000000000 +0200
++++ ruby-1.8.5/lib/net/http.rb	2007-11-13 21:44:53.000000000 +0100
+@@ -470,6 +470,7 @@
+       @debug_output = nil
+       @use_ssl = false
+       @ssl_context = nil
++      @enable_post_connection_check = false
+     end
+ 
+     def inspect
+@@ -526,6 +527,9 @@
+       false   # redefined in net/https
+     end
+ 
++    # specify enabling SSL server certificate and hostname checking.
++    attr_accessor :enable_post_connection_check
++
+     # Opens TCP connection and HTTP session.
+     # 
+     # When this method is called with block, gives a HTTP object
+@@ -584,6 +588,14 @@
+           HTTPResponse.read_new(@socket).value
+         end
+         s.connect
++        if @ssl_context.verify_mode != OpenSSL::SSL::VERIFY_NONE
++          begin
++            s.post_connection_check(@address)
++          rescue OpenSSL::SSL::SSLError => ex
++            raise ex if @enable_post_connection_check
++            warn ex.message
++          end
++        end
+       end
+       on_connect
+     end
+diff -ruN ruby-1.8.5-old/lib/open-uri.rb ruby-1.8.5/lib/open-uri.rb
+--- ruby-1.8.5-old/lib/open-uri.rb	2006-08-05 00:00:21.000000000 +0200
++++ ruby-1.8.5/lib/open-uri.rb	2007-11-13 21:43:39.000000000 +0100
+@@ -229,6 +229,7 @@
+     if target.class == URI::HTTPS
+       require 'net/https'
+       http.use_ssl = true
++      http.enable_post_connection_check = true
+       http.verify_mode = OpenSSL::SSL::VERIFY_PEER
+       store = OpenSSL::X509::Store.new
+       store.set_default_paths
+@@ -240,16 +241,6 @@
+ 
+     resp = nil
+     http.start {
+-      if target.class == URI::HTTPS
+-        # xxx: information hiding violation
+-        sock = http.instance_variable_get(:@socket)
+-        if sock.respond_to?(:io)
+-          sock = sock.io # 1.9
+-        else
+-          sock = sock.instance_variable_get(:@socket) # 1.8
+-        end
+-        sock.post_connection_check(target_host)
+-      end
+       req = Net::HTTP::Get.new(request_uri, header)
+       if options.include? :http_basic_authentication
+         user, pass = options[:http_basic_authentication]