Sicherheit: Denial of Service in Ruby
Aktuelle Meldungen Distributionen
Name: Denial of Service in Ruby
ID: FEDORA-2011-17542
Distribution: Fedora
Plattformen: Fedora 16
Datum: Mi, 11. Januar 2012, 08:12
Referenzen: http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2011-4815
Applikationen: Ruby


Name        : ruby
Product : Fedora 16
Version :
Release : 1.fc16
URL : http://www.ruby-lang.org/
Summary : An interpreter of object-oriented scripting language
Description :
Ruby is the interpreted scripting language for quick and easy
object-oriented programming. It has many features to process text
files and to do system management tasks (as in Perl). It is simple,
straight-forward, and extensible.

Update Information:

A security flaw was found on the previous ruby that with some series of strings
which was specially crafted to intentionally collide their hash values with each other, rails applications may fall into denial of services when such strings are used in HTTP requests (CVE-2011-4815). This new ruby will fix this issue.

* Thu Dec 29 2011 Mamoru Tasaka <mtasaka@fedoraproject.org> -
- Update to 1.8.7p357
- Randomize hash on process startup (CVE-2011-4815, bug 750564)
* Fri Dec 23 2011 Dennis Gilmore <dennis@ausil.us> -
- dont normalise arm cpus to arm
- there is something weird about how ruby choses where to put bits
* Wed Nov 16 2011 Mamoru Tasaka <mtasaka@fedoraproject.org> -
- F-17: kill gdbm support for now due to licensing compatibility issue
* Sat Oct 1 2011 Mamoru Tasaka <mtasaka@fedoraproject.org> -
- F-17: rebuild against new gdbm

[ 1 ] Bug #750564 - CVE-2011-4815 ruby: hash table collisions CPU usage DoS

This update can be installed with the "yum" update program. Use
su -c 'yum update ruby' at the command line.
For more information, refer to "Managing Software with yum",
available at http://docs.fedoraproject.org/yum/.

All packages are signed with the Fedora Project GPG key. More details on the
GPG keys used by the Fedora Project can be found at
package-announce mailing list
Neue Nachrichten