Bug 866567
Summary: | CVE-2012-4522 ruby: unintentional file creation caused by inserting an illegal NUL character [fedora-all] | ||
---|---|---|---|
Product: | [Fedora] Fedora | Reporter: | Vincent Danen <vdanen> |
Component: | ruby | Assignee: | Jeroen van Meeuwen <vanmeeuwen+fedora> |
Status: | CLOSED ERRATA | QA Contact: | Fedora Extras Quality Assurance <extras-qa> |
Severity: | medium | Docs Contact: | |
Priority: | medium | ||
Version: | 17 | CC: | bkabrda, jeremy, mmorsi, mtasaka, tagoh, vanmeeuwen+fedora, vondruch |
Target Milestone: | --- | Keywords: | Security, SecurityTracking |
Target Release: | --- | ||
Hardware: | All | ||
OS: | Linux | ||
Whiteboard: | |||
Fixed In Version: | Doc Type: | Release Note | |
Doc Text: | Story Points: | --- | |
Clone Of: | Environment: | ||
Last Closed: | 2012-10-24 15:27:24 UTC | Type: | --- |
Regression: | --- | Mount Type: | --- |
Documentation: | --- | CRM: | |
Verified Versions: | Category: | --- | |
oVirt Team: | --- | RHEL 7.3 requirements from Atomic Host: | |
Cloudforms Team: | --- | Target Upstream Version: | |
Embargoed: | |||
Bug Depends On: | |||
Bug Blocks: | 865940 |
Description
Vincent Danen
2012-10-15 15:57:47 UTC
Please use the following update submission link to create the Bodhi request for this issue as it contains the top-level parent bug(s) as well as this tracking bug. This will ensure that all associated bugs get updated when new packages are pushed to stable. Please also ensure that the "Close bugs when update is stable" option remains checked. Bodhi update submission link: https://admin.fedoraproject.org/updates/new/?type_=security&bugs=865940,866567 F-18 F-17: already in queue F-16 seems unaffected (I cannot reproduce this). Can someone confirm this? I cannot reproduce with F16, so F16 should be OK. @Mamoru: Could you please reference this bug in Bodhi updates? Thank you. (In reply to comment #4) > @Mamoru: Could you please reference this bug in Bodhi updates? Thank you. I don't want to edit bodhi requests which were already pushed into testing, because bodhi shows warnings like "Adding or removing builds from this update will move it back to a pending state" (this does not say about only editing comments, however I am not sure if editing comments only is really safe). (In reply to comment #5) OK, np ... so may be this should move into MODIFIED state at least. This issue did not affect the version of ruby as shipped with Fedora-16. This issue was fixed in Fedora-17, via the following security advisory: https://admin.fedoraproject.org/updates/FEDORA-2012-16086/ruby-1.9.3.286-18.fc17 Fixed on F-18, 17 (not affected on F-16), closing. |