[SEC][ANN] Rails 3.0.20, and 2.3.16 have been released! Please upgrade IMMEDIATELY!!

[SEC][ANN] Rails 3.0.20, and 2.3.16 have been released!

[SEC][ANN] Rails 3.0.20, and 2.3.16 have been released! Please upgrade IMMEDIATELY!!

I'd like to announce that 3.0.20, and 2.3.16 have been released. These releases contain one extremely critical security fix so please update IMMEDIATELY . You can read about the security fix by following this link: CVE-2013-0333 In order to ease upgrading, the only major changes in each gem is the security fix. To see the detailed changes for each version, follow the links below: Changes in 3.0.20 Changes in 2.3.16 Thanks to the people who responsibly reported these security issues. Please note that per our maintenance policy this will be the last release for the 3.0.x series. Here are the SHA-1 checksums for each gem: 3.0.20 [aaron@higgins dist]$ shasum *3.0.20* c5b1a446d921dbd512a2d418c50f144b4540a657 actionmailer-3.0.20.gem 79ec243f6ec301b0a73ad45f89d4ea2335f90346 actionpack-3.0.20.gem 80c7d881ed64ed7a66f4d82b12c2b98b43f6fbde activemodel-3.0.20.gem d8fc6e02bf46f9b5f86c3...

Full article: http://weblog.rubyonrails.org/2013/1/28/Rails-3-0-20-and-...

Tweets

@mathiasx » 08 Feb '13, 6pm
@steveklabnik @tenderlove [link] [link]
@zedlopez » 04 Feb '13, 8am
I just upgraded my rails apps. You should, too. If you, you know, have any. [link]
@benwbrum » 04 Feb '13, 4am
@mjgiarlo Yep. Found out about [link] tonight thanks to a question from PSU's FtP installation.
@thenthj » 04 Feb '13, 3am
@benwbrum I would verify the sha hash: [link]
@decoding » 02 Feb '13, 7am
If your Rails project is on 3.0.x or 2.3.x you should upgrade asap: [link]
@mungler » 31 Jan '13, 10pm
@semanticist yes of course, and I wasn't saying otherwise. Might've been nice to mention JSON here though: [link]
@emaiax » 30 Jan '13, 5pm
[link] gonna switch do ColdFusion. LOL
@bederacosta » 30 Jan '13, 4pm
#Rails 3.0.20, and 2.3.16 have been released! They contain one extremely critical security fix so update IMMEDIATELY. [link]
@rails_rt_ja » 30 Jan '13, 3pm
RT @matsuu: また脆弱性がみつかったのね。アップデートしましょうね / “Riding Rails: [SEC][ANN] Rails 3.0.20, and 2.3.16 have been released!” [link]
@matsuu » 30 Jan '13, 2pm
また脆弱性がみつかったのね。アップデートしましょうね / “Riding Rails: [SEC][ANN] Rails 3.0.20, and 2.3.16 have been released!” [link]
@rails_rt_ja » 30 Jan '13, 4am
RT @tomof: Railsにまたセキュリティパッチが。3.0系じゃなかったのでセーフ。[link]
@rails_rt_ja » 30 Jan '13, 4am
RT @kinyuka: @cakephper railsのやつこれっすね(;´Д`) [link]
@cakephper » 30 Jan '13, 3am
Ruby on Rails 2.3.x, 3.0.x の新たな脆弱性。認証回避、任意のSQL注入、任意のコード注入、DoSアタックなど [link]
@kinyuka » 30 Jan '13, 3am
@cakephper railsのやつこれっすね(;´Д`) [link]
@tomof » 30 Jan '13, 3am
Railsにまたセキュリティパッチが。3.0系じゃなかったのでセーフ。[link]
@ktoume » 30 Jan '13, 12am
[SEC][ANN] Rails 3.0.20, and 2.3.16 have been released! [link] #ktoume_todo
@folkenlaeneck » 29 Jan '13, 8pm
Coup double : Mises à jour de sécurité pour Rails [link] et Devise [link]
@benatkin » 29 Jan '13, 8pm
RT @steveklabnik: @benatkin yes, it was: [link] " one extremely critical security fix so please update IMMEDIATELY."
@steveklabnik » 29 Jan '13, 8pm
@benatkin yes, it was: [link] " one extremely critical security fix so please update IMMEDIATELY."
@lisoflores » 29 Jan '13, 8pm
RT @rubyskills: Rails 3.0.20 and 2.3.16 have been released [link] [link]
@zhwang_ » 29 Jan '13, 12pm
Those Rails sec issues just don't stop coming do they [link]
@rails_rt_ja » 29 Jan '13, 10am
RT @akasata: あらら / “Riding Rails: [SEC][ANN] Rails 3.0.20, and 2.3.16 have been released!” [link]
@astrails » 29 Jan '13, 9am
please be aware: [link]
@akasata » 29 Jan '13, 9am
あらら / “Riding Rails: [SEC][ANN] Rails 3.0.20, and 2.3.16 have been released!” [link]
@allenjcochran » 29 Jan '13, 8am
Rails 3.0.20 and 2.3.16 have been released #design #code #webdesign [link]
@chrismurray0 » 29 Jan '13, 7am
Yet another critical rails patch. At least this doesn't affect every version. [link]
@agehret » 29 Jan '13, 7am
I meant: [link]
@nysalor » 29 Jan '13, 5am
Rails3.0系と2.3系がアップデートしてた [link] JSONのパーサに問題があってSQLインジェクション等の脆弱性があるぽい
@rails_rt_ja » 29 Jan '13, 5am
RT @techmedia_think: 今度はJSONのパーサ関連の脆弱性みたい。[link]
@techmedia_think » 29 Jan '13, 4am
今度はJSONのパーサ関連の脆弱性みたい。[link]
@manoleet » 29 Jan '13, 4am
RT @celingest: [SEC][ANN] Rails 3.0.20, and 2.3.16 have been released! Please upgrade IMMEDIATELY!! [link] (via @rails)
@Spring_MT » 29 Jan '13, 3am
one extremely critical security fix so please update IMMEDIATELY. だって "Rails 3.0.20, and 2.3.16 have been released! [link]
@ijin » 29 Jan '13, 3am
またRailsのセキュリティフィックスが出たの。 [link]
@rubynews_j » 29 Jan '13, 3am
Riding Rails: [SEC][ANN] Rails 3.0.20, and 2.3.16 have been released! [link] #ruby #rubyjp
@PlanningAlerts » 29 Jan '13, 3am
Rails security update done. Nothing affected here. All running good. [link]
@rails_rt_ja » 29 Jan '13, 3am
RT @YaSuYuKi: 最近多いな / “Riding Rails: [SEC][ANN] Rails 3.0.20, and 2.3.16 have been released!” [link]
@rails_rt_ja » 29 Jan '13, 3am
RT @IanMLewis: Rails 本当勘弁してほしい - Riding Rails: [SEC][ANN] Rails 3.0.20, and 2.3.16 have been released! [link]
@rails_rt_ja » 29 Jan '13, 3am
RT @tk0miya: 最近多いな / Riding Rails: [SEC][ANN] Rails 3.0.20, and 2.3.16 have been released! [link]
@IanMLewis » 29 Jan '13, 2am
Rails 本当勘弁してほしい - Riding Rails: [SEC][ANN] Rails 3.0.20, and 2.3.16 have been released! [link]
@YaSuYuKi » 29 Jan '13, 2am
最近多いな / “Riding Rails: [SEC][ANN] Rails 3.0.20, and 2.3.16 have been released!” [link]
@yegrb » 29 Jan '13, 2am
RT @JasPanesar: Riding Rails: [SEC][ANN] Rails 3.0.20, and 2.3.16 have been released! [link] /cc:@yegrb
@lainzero » 29 Jan '13, 2am
RT @TrinityT: またcriticalかー / “Riding Rails: [SEC][ANN] Rails 3.0.20, and 2.3.16 have been released!” [link]
@tk0451 » 29 Jan '13, 2am
Riding Rails: [SEC][ANN] Rails 3.0.20, and 2.3.16 have been released!: 6 users [link]
@celingest » 29 Jan '13, 2am
[SEC][ANN] Rails 3.0.20, and 2.3.16 have been released! Please upgrade IMMEDIATELY!! [link] (via @rails)
@TrinityT » 29 Jan '13, 2am
またcriticalかー / “Riding Rails: [SEC][ANN] Rails 3.0.20, and 2.3.16 have been released!” [link]
@rails_rt_ja » 29 Jan '13, 2am
RT @nulltask: 3.0 系使ってなかったんでセーフ... / “Riding Rails: [SEC][ANN] Rails 3.0.20, and 2.3.16 have been released!” [link]
@nulltask » 29 Jan '13, 1am
3.0 系使ってなかったんでセーフ... / “Riding Rails: [SEC][ANN] Rails 3.0.20, and 2.3.16 have been released!” [link]
@jan » 29 Jan '13, 1am
What a night. All good now. [link]
@fukayatsu » 29 Jan '13, 1am
RT @tatsuoSakurai: "Riding Rails: [SEC][ANN] Rails 3.0.20, and 2.3.16 have been released!" [link]
@rails_rt_ja » 29 Jan '13, 1am
RT @kawachi: Rails 3.0.20 緊急を要する security fix。またか。。 [link]