Major Security Hole Found in Rails

Dietrich Kappe, Thursday, August 10, 2006 @ 11:59 am

For all of you using Ruby on Rails, this announcement passed on as a public service:

We're still hard at work on Rails 1.2, which features all the new dandy REST stuff and more, but a serious security concern has come to our attention that needed to be addressed sooner than the release of 1.2 would allow. So here's Rails 1.1.5!

This is a MANDATORY upgrade for anyone not running on a very recent edge (which isn't affected by this). If you have a public Rails site, you MUST upgrade to Rails 1.1.5. The security issue is severe and you do not want to be caught unpatched.

The issue is in fact of such a criticality that we're not going to dig into the specifics. No need to arm would-be assalients.

So upgrade today, not tomorrow. We've made sure that Rails 1.1.5 is fully drop-in compatible with 1.1.4. It only includes a handful of bug fixes and no new features

Update 1: A more extensive entry on the details behind the security hole.

Technorati : rails, ruby, security

agile ajax

Comments: 1 so far

• Leave a comment
• Comment feed for this post
• TrackBack URL

1. 

   by the time you posted it. 1.1.5 had a even bigger hole..

   upgrade to 1.1.6 folks!

   Comment by nil, Wednesday, August 16, 2006 @ 10:58 am

Leave a comment