Rails

[SEC][ANN] Rails 3.2.11, 3.1.10, 3.0.19, and 2.3.15 have been released!

Rails

I'd like to announce that 3.2.11, 3.1.10, 3.0.19, and 2.3.15 have been released. These releases contain two extremely critical security fixes so please update IMMEDIATELY . You can read about the security fixes by following these links: CVE-2013-0155 CVE-2013-0156 In order to ease upgrading, the only major changes in each gem are the security fixes. To see the detailed changes for each version, follow the links below: Changes in 3.2.11 Changes in 3.1.10 Changes in 3.0.19 Changes in 2.3.15 Thanks to the people who responsibly reported these security issues. Here are the SHA-1 checksums for each gem: 3.2.11 [aaron@higgins dist]$ shasum *3.2.11* 933cd2821b30cdff4a2e0b5cc63f4d2c6b29affe actionmailer-3.2.11.gem 54731c51b55bf0215392971b982139775c0bfa2b actionpack-3.2.11.gem 5ccde66568d8051405c01063f1afaed13bd01082 activemodel-3.2.11.gem f360c17968486479b0a4207e7eccbe379186a9d2 a...

Full article: http://weblog.rubyonrails.org/2013/1/8/Rails-3-2-11-3-1-1...

Tweets

@ziromr » 04 Feb '13, 5pm
@skeptomai I'm just looking into a fresh chef11 setup… gem "rails", "3.2.2" => [link]
@genvansickle » 18 Jan '13, 12pm
Tired update servers and apps on rails after [link] Want web apps have automatic updates
@IHU_SciTech » 16 Jan '13, 7pm
RT @qboss_cy: There is a serious security issue in Rails, don't forget to update your apps today! [link] #rails
@kaatje36 » 15 Jan '13, 1pm
@TruuzZie [link]
@rails_rt_ja » 15 Jan '13, 11am
RT @NaitoJPN: Ruby on Railsに脆弱性。 [link]
@alexs1010 » 15 Jan '13, 10am
Recuerden actualizar sue versions de #RoR, un fall de seguridad se corrigió [link]
@NaitoJPN » 15 Jan '13, 10am
Ruby on Railsに脆弱性。 [link]
@alexs1010 » 15 Jan '13, 10am
Upgrading my #railsApp there are some "extremely critical security fixes" [link]
@bw_qa » 15 Jan '13, 4am
Has your Ruby on Rails install been patched? Better double check w/ your host. [link]
@micahcraig » 14 Jan '13, 7pm
RT @dylanfareed: A 2nd IP of ours was just probed for the YAML/Rails exploit. Update your Rails apps, humans. [link]
@dylanfareed » 14 Jan '13, 7pm
A 2nd IP of ours was just probed for the YAML/Rails exploit. Update your Rails apps, humans. [link]
@eperoumal » 14 Jan '13, 8am
RT @sukria: The Epic Rails Disaster is best shown in their blog's comments! [link] via @damiendesmarets
@sukria » 14 Jan '13, 8am
The Epic Rails Disaster is best shown in their blog's comments! [link] via @damiendesmarets
@rails_rt_ja » 14 Jan '13, 5am
RT @ryokan: これらのバージョン以外は脆弱性がある。アップデートしよう。 / “Riding Rails: [SEC][ANN] Rails 3.2.11, 3.1.10, 3.0.19, and 2.3.15 have been released!” [link]
@ryokan » 14 Jan '13, 4am
これらのバージョン以外は脆弱性がある。アップデートしよう。 / “Riding Rails: [SEC][ANN] Rails 3.2.11, 3.1.10, 3.0.19, and 2.3.15 have been released!” [link]
@wilderko » 13 Jan '13, 8pm
RT @nethemba: Two extremely critical vulnerabilities in Rails:... [link]
@ayampolskiy » 13 Jan '13, 7pm
A serious Ruby on Rails vulnerability discovered. Make sure to upgrade: [link]
@f03lipe » 13 Jan '13, 5am
Trololo [link]
@shavit_tzuriel » 12 Jan '13, 3pm
Security risks in the Ruby on Rails framework: Read the following and update your Rails version. The team found... [link]
@elhtmlnoexiste » 12 Jan '13, 9am
@chemaalonso es tan gordo como parece? [link]
@hyzhak_en » 11 Jan '13, 10pm
[link] #Rails has extremely critical security hole, apply fixes or die / #ruby #security
@bkaney » 11 Jan '13, 9pm
I remember @pfeffunit complaining about these sort of problems (using params directly) - [link] o back in 0.9.6...
@Crowe_Risk » 11 Jan '13, 9pm
Ruby and Java vulns this week- what's your strategy to protect against? #Ruby [link] #Java [link]
@mmahgoub » 11 Jan '13, 4pm
A serious security vulnerability has been found in the Ruby on Rails. This exploit affects nearly all applications [link]
@lantoli » 11 Jan '13, 4pm
@amuino no dices nada del último problema de seguridad de Rails ? ;-) [link]
@mtjhax » 11 Jan '13, 3pm
Holy security hole Batman! Upgrading all my Rails apps immediately (shut it Java people, you've had similar) [link]
@mikeymo » 11 Jan '13, 2pm
Rails vulnerability updates complete…[link] … only one small regression for me
@jmooserific » 11 Jan '13, 2pm
Yay! All of my rails apps have been updated. [link]
@phobeo » 11 Jan '13, 1pm
security vulnerability in Rails [link] - luckily, for most apps it's just a 2 minutes change in @heroku
@neuralhacker » 11 Jan '13, 12pm
@TitoXamps Joder, vaya racha de vulnerabilidades [link] Me he tirado media mañana actualizando mis instancias
@igrep » 11 Jan '13, 12pm
"two extremely critical security fixes so please update IMMEDIATELY." / “Riding Rails: [SEC][ANN] Rails 3.2.11, 3.1.1…” [link]
@renatomoya » 11 Jan '13, 11am
RT @murdix: Los que tengan webapps en rails: Actualicen de inmediato. Extremely critical security fixes. [link]
@murdix » 11 Jan '13, 11am
Los que tengan webapps en rails: Actualicen de inmediato. Extremely critical security fixes. [link]
@alex_mikhalchuk » 11 Jan '13, 11am
RT @andy128k: [link] [link]
@PodmedicsEd » 11 Jan '13, 10am
@Stevancw @iHiD by the way be sure to bump all your rails apps to 3.2.11 today. [link]
@matrushka » 11 Jan '13, 9am
RT @darita: Rails kodlarında ciddi bir güvenlik açığı bulundu. Uygulamalarınızı hemen update edin. [link]
@meneer » 11 Jan '13, 9am
@bbwillemsen geen idee, maar kijk hier op de RoR alert. Let op CVE én comments (bv json bug)! [link]
@miguelregedor » 11 Jan '13, 8am
Looks like I have to upgrade a few apps indeed #rails #exploit [link]
@h8_self » 11 Jan '13, 8am
RT @andy128k: [link] [link]
@JuniorJoanis » 11 Jan '13, 8am
BTW rails has a security vulnerability... [link]
@jmporchet » 11 Jan '13, 8am
Une vulnérabilité critique dans #rails de #ruby, upgradez de suite ! [link]
@mikaellundin » 11 Jan '13, 8am
Updating my rails application to address the latest security issues. [link]
@domguinard » 11 Jan '13, 8am
Duh! #Rails!! These two are pretty nasty #security #breaches: [link]
@ardnenar » 11 Jan '13, 8am
RT @seyhunak: Riding Rails: [SEC][ANN] Rails 3.2.11, 3.1.10, 3.0.19, and 2.3.15 have been released! [link]
@darita » 11 Jan '13, 8am
Rails kodlarında ciddi bir güvenlik açığı bulundu. Uygulamalarınızı hemen update edin. [link]
@Redscan_Ltd » 11 Jan '13, 8am
Two more Ruby on Rails bugs but update available, not a great 2013 so far: [link]
@TheSocialMitch » 11 Jan '13, 5am
Apparently there's a fatal security problem with #Rails: [link]
@kyohsuke » 11 Jan '13, 5am
@bukkun あ、いたいた。悲しいお知らせです。 [link]
@JamesSHLee » 11 Jan '13, 4am
주요 레일스 버젼에서 취약점이 발견되었다고 합니다. 아래 버젼으로 즉시 업그레이드 하도록 권장하고 있습니다. 3.2.11, 3.1.10, 3.0.19, 2.3.15 [link]
@donnfelker » 11 Jan '13, 4am
Rails Apps updated for [link] onto the next thing