Bugzilla Bug 200159

[lifted from Rails core mailing list]


1.2.6 is out : http://dev.rubyonrails.org/changeset/8197

There's a fix for a regression in AR :

http://dev.rubyonrails.org/ticket/8713

and a security fix, see :

http://dev.rubyonrails.org/ticket/10048
http://nvd.nist.gov/nvd.cfm?cvename=CVE-2007-6077

Official announce : [no link for the moment, put it here]

I have ebuilds pending for rails 1.2.6 but am currently waiting for them to
show up on the ruby gem mirrors. They should be available later today.

Thanks for the report. Please ping us when the ebuilds are ready or add the
arches if you think it's ready for stabling.

The new ebuilds have been added to the tree. My suggestion would be to wait
until tomorrow before asking them to be stabled, so that we may be able to pick
up any regressions in this release.

@arches, please stabilize dev-ruby/rails-1.2.6 and its dependencies. It only
contains the security fix and a fix for a regression in rails 1.2.5, and my
initial testing has shown no regressions.

The packages need to be stabilized in the following order to account for
dependencies:

dev-ruby/activerecord-1.15.6
dev-ruby/actionpack-1.13.6
dev-ruby/actionmailer-1.3.6
dev-ruby/actionwebservice-1.2.6
dev-ruby/rails-1.2.6

@ppc64: you don't have rails itself keyworded, but most of its dependencies are
keyworded, and the actual fixes are in the dependencies, so stabilize those
packages you have keyworded.

x86 stable

ppc stable

OK, I keyworded the deps for ppc64.  I need a decent way to test rails before I
can mark it ~ppc64.  When I runu rake it pukes with errors.  If someone can
describe a decent rake test that is known to be reliable, even outside portage,
I can test and keyword.

ia64/sparc stable

(In reply to comment #7)
> OK, I keyworded the deps for ppc64.  I need a decent way to test rails before I
> can mark it ~ppc64.  When I runu rake it pukes with errors.  If someone can
> describe a decent rake test that is known to be reliable, even outside portage,
> I can test and keyword.
> 

marked it ~ppc64. (they have good tutorials!)

Adding back ppc64: it looks like you forgot to mark
dev-ruby/activesupport-1.4.4 stable. This dependency is not listed on the bug
because no new version was introduced and other arches already had it marked
stable. I'm currently removing the vulnerable versions of rails which means
that I'll have to drop your currently stable version 1.4.2. Doing so because
the current version of rails won't install for anyone without package.keywords
magic anyway.

dev-ruby/activesupport-1.4.4 stable on ppc64

amd64 stable

Setting B3, ready for GLSA decision.

CVE-2007-6077:
  The session fixation protection mechanism in cgi_process.rb in Rails
  1.2.4, as used in Ruby on Rails, removes the :cookie_only attribute
  from the DEFAULT_SESSION_OPTIONS constant, which effectively causes
  cookie_only to be applied only to the first instantiation of
  CgiRequest, which allows remote attackers to conduct session
  fixation attacks. NOTE: this is due to an incomplete fix for
  CVE-2007-5380.

We handled CVE-2007-5380 in bug 195315, which resulted in a GLSA. This bug
should therefore result in an errata. Voting YES.

TODO: draft errata.

This bug does not affect 2008.0 release snapshot, removing release@ from CC.