[Date Prev][Date Next] [Thread Prev][Thread Next] [Date Index] [Thread Index]

Accepted ruby2.3 2.3.3-1+deb9u3 (source) into proposed-updates->stable-new, proposed-updates



-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512

Format: 1.8
Date: Thu, 19 Jul 2018 13:28:10 +0200
Source: ruby2.3
Binary: ruby2.3 libruby2.3 ruby2.3-dev ruby2.3-doc ruby2.3-tcltk
Architecture: source
Version: 2.3.3-1+deb9u3
Distribution: stretch-security
Urgency: medium
Maintainer: Antonio Terceiro <terceiro@debian.org>
Changed-By: Santiago R.R. <santiagorr@riseup.net>
Description:
 libruby2.3 - Libraries necessary to run Ruby 2.3
 ruby2.3    - Interpreter of object-oriented scripting language Ruby
 ruby2.3-dev - Header files for compiling extension modules for the Ruby 2.3
 ruby2.3-doc - Documentation for Ruby 2.3
 ruby2.3-tcltk - Ruby/Tk for Ruby 2.3
Closes: 889117 898694
Changes:
 ruby2.3 (2.3.3-1+deb9u3) stretch-security; urgency=medium
 .
   [ Santiago R.R. ]
   * Fix Command injection vulnerability in Net::FTP.
     [CVE-2017-17405]
   * webrick: use IO.copy_stream for multipart response. Required changes in
     WEBrick to fix CVE-2017-17742 and CVE-2018-8777
   * Fix HTTP response splitting in WEBrick.
     [CVE-2017-17742]
   * Fix Command Injection in Hosts::new() by use of Kernel#open.
     [CVE-2017-17790]
   * Fix Unintentional directory traversal by poisoned NUL byte in Dir
     [CVE-2018-8780]
   * Fix multiple vulnerabilities in RubyGems.
     CVE-2018-1000073: Prevent Path Traversal issue during gem installation.
     CVE-2018-1000074: Fix possible Unsafe Object Deserialization
     Vulnerability in gem owner.
     CVE-2018-1000075: Strictly interpret octal fields in tar headers.
     CVE-2018-1000076: Raise a security error when there are duplicate files
     in a package.
     CVE-2018-1000077: Enforce URL validation on spec homepage attribute.
     CVE-2018-1000078: Mitigate XSS vulnerability in homepage attribute when
     displayed via gem server.
     CVE-2018-1000079: Prevent path traversal when writing to a symlinked
     basedir outside of the root.
   * Fix directory traversal vulnerability in the Dir.mktmpdir method in the
     tmpdir library
     [CVE-2018-6914]
   * Fix Unintentional socket creation by poisoned NUL byte in UNIXServer and
     UNIXSocket
     [CVE-2018-8779]
   * Fix Buffer under-read in String#unpack
     [CVE-2018-8778]
   * Fix tests to cope with updates in tzdata (Closes: #889117)
   * Exclude Rinda TestRingFinger and TestRingServer test units requiring
     network access (Closes: #898694)
 .
   [ Antonio Terceiro ]
   * debian/tests/excludes/any/TestTimeTZ.rb: ignore tests failing due to
     assumptions that don't hold on newer tzdata update. Upstream bug:
     https://bugs.ruby-lang.org/issues/14655
Checksums-Sha1:
 5afa01b2458ca3ae446afafc81199d74e4d7bede 2503 ruby2.3_2.3.3-1+deb9u3.dsc
 b178b5349ce51fdc6d64f8f09a2e5c8666afbf69 115108 ruby2.3_2.3.3-1+deb9u3.debian.tar.xz
 07c8c87633399d1206a19f7ab886f7daffe7f216 10673 ruby2.3_2.3.3-1+deb9u3_amd64.buildinfo
Checksums-Sha256:
 bb63c143540a31a71a1982219266580434c35e4f09ff5db3bb1cced5cf611e0d 2503 ruby2.3_2.3.3-1+deb9u3.dsc
 076c1973276eb48d0adb655e595dfcce62d0273ebc3beaa2ef6815c862fd2aab 115108 ruby2.3_2.3.3-1+deb9u3.debian.tar.xz
 37a7b6f3e106d6d54fe5649a72b23066a3edd4e6f9a5cabae4467a477b5c9f7a 10673 ruby2.3_2.3.3-1+deb9u3_amd64.buildinfo
Files:
 1d4de9b04ccbcb46357fcdbff8b2b620 2503 ruby optional ruby2.3_2.3.3-1+deb9u3.dsc
 21fc61cef0ddad1b284d011f177b2326 115108 ruby optional ruby2.3_2.3.3-1+deb9u3.debian.tar.xz
 3a4b287deb5600e5ce35827925d87170 10673 ruby optional ruby2.3_2.3.3-1+deb9u3_amd64.buildinfo

-----BEGIN PGP SIGNATURE-----

iQIzBAEBCgAdFiEEwUqnBPVvaa0NAVzHFX/a4RXx4q0FAltYTTAACgkQFX/a4RXx
4q2owRAAhuXWZ4QoepiexTPQ/I/qNNQRrhS2aL6PexpaHnHJHzAsx8b/Fox8QTYN
5W+tIKnW7oYqWEUikoWy7p8wLto78ltCB1iaQWiXyrS79YWj6xiwl+A0qnadEU3S
4OoYwXwgXxgyTnYGNsLIv/QWF0Hbm3tMmyiv9UzKzbm403foXNheBVbiYT3EgKby
ckxWo8fF3oYsphDg6qUXyGfFC0CToPuHI2LmyZe17L0pp/BIk+nYvAPez11uC1Qq
zfOtCE8unMEx1H7S1t9kol84Em+M935XdqZ9aEO4/YVEsnPY1NbCHo8joyG9w7LL
ScsN7Ts+2MxDDl/9lqT65/E9WfUvt9bWggczl36Edo+oS+zJTxqSUNhgtQRHADG8
VaFpkSbBuoCKqcCUrwGpyNcWT5pbWYNN6q8D01YO1puM8gXm7SIBMGuV/al2TsXv
0r82PXNiSBrqcOzTC8jD0yw8d6w1CW224hrlKyfQubKgZ5NqTwY4Rb9maHnfU+RU
8N78nu+U8ETgPIM74+Hyji7W6PBQYCjTBtCWWA9648PfYTlgGcrQh3gEVlHIASfA
B7PTKe2AFMLWfTIQ4D7WjvfVoNCSnfn2wQfbRILGy36z8B8OoGmwBpWeM0gpxOZU
nMe1DrjBb7UUdFTAdF6wkcqGXYZa2+Y9Gnm4Vd5jiZm6GPojeME=
=OTgZ
-----END PGP SIGNATURE-----


Reply to: