Date: Fri, 20 Apr 2012 17:01:06 +0200 From: Jan Lieskovsky <jlieskov@...hat.com> To: "Steven M. Christey" <coley@...us.mitre.org> CC: oss-security@...ts.openwall.com, Eric Hodel <drbrain@...ment7.net>, Evan Phoenix <evan@....io>, Vít Ondruch <vondruch@...hat.com> Subject: CVE Request -- rubygems: Two security fixes in upstream v1.8.23 version Hello Kurt, Steve, Eric, Evan, vendors, two security fixes has been recently corrected in upstream rubygems-v1.8.23 version: #1 RubyGems now disallows redirection from HTTPS to HTTP. #2 RubyGems now verifies SSL connections. References:  https://github.com/rubygems/rubygems/blob/1.8/History.txt (rubygems History.txt)  https://github.com/rubygems/rubygems/commit/d4c7eafb8efe1e13a7abf5be5a5b4548870b15b7 (relevant rubygems git commit)  http://www.ruby-lang.org/en/news/2012/04/20/ruby-1-9-3-p194-is-released/ (Ruby v1.9.3-p194 version announcement)  http://svn.ruby-lang.org/cgi-bin/viewvc.cgi?view=revision&sortby=date&revision=35404 (Ruby language SVN repository commit)  https://bugzilla.redhat.com/show_bug.cgi?id=814718 (Red Hat bugzilla entry) Both of  and  patches include fixes for both issues. For the case #2 the security implications are clear. Kurt, could you allocate two CVE ids for these issues? Thank you && Regards, Jan. -- Jan iankko Lieskovsky / Red Hat Security Response Team
Powered by blists - more mailing lists
Please check out the Open Source Software Security Wiki, which is counterpart to this mailing list.
Confused about mailing lists and their use? Read about mailing lists on Wikipedia and check out these guidelines on proper formatting of your messages.