Your message dated Sat, 04 Aug 2012 14:20:04 +0100 with message-id <[email protected]> and subject line Re: Bug#683820: unblock: ruby-actionpack-3.2/3.2.6-3 has caused the Debian Bug report #683820, regarding unblock: ruby-actionpack-3.2/3.2.6-3 to be marked as done. This means that you claim that the problem has been dealt with. If this is not the case it is now your responsibility to reopen the Bug report if necessary, and/or fix the problem forthwith. (NB: If you are a system administrator and have no idea what this message is talking about, this may indicate a serious mail system misconfiguration somewhere. Please contact [email protected] immediately.) -- 683820: http://bugs.debian.org/cgi-bin/bugreport.cgi?bug=683820 Debian Bug Tracking System Contact [email protected] with problems
--- Begin Message ---
- To: Debian Bug Tracking System <[email protected]>
- Subject: unblock: ruby-actionpack-3.2/3.2.6-3
- From: Antonio Terceiro <[email protected]>
- Date: Sat, 4 Aug 2012 09:55:42 -0300
- Message-id: <[🔎] [email protected]>
Package: release.debian.org Severity: normal User: [email protected] Usertags: unblock Please unblock package ruby-actionpack-3.2 This version add a single patch that fixes a secutiry problem (CVE-2012-3424, #683370), and just uploaded to unstable. You will find a debdiff against the version currently in testing attached. unblock ruby-actionpack-3.2/3.2.6-3 -- System Information: Debian Release: wheezy/sid APT prefers unstable APT policy: (500, 'unstable'), (1, 'experimental') Architecture: amd64 (x86_64) Kernel: Linux 3.2.0-3-amd64 (SMP w/4 CPU cores) Locale: LANG=pt_BR.utf8, LC_CTYPE=pt_BR.utf8 (charmap=UTF-8) Shell: /bin/sh linked to /bin/dash -- Antonio Terceiro <[email protected]>diff -Nru ruby-actionpack-3.2-3.2.6/debian/changelog ruby-actionpack-3.2-3.2.6/debian/changelog --- ruby-actionpack-3.2-3.2.6/debian/changelog 2012-06-24 19:07:35.000000000 -0300 +++ ruby-actionpack-3.2-3.2.6/debian/changelog 2012-08-04 09:29:24.000000000 -0300 @@ -1,3 +1,9 @@ +ruby-actionpack-3.2 (3.2.6-3) unstable; urgency=high + + * Add patch by Aaron Patterson for CVE-2012-3424 (Closes: #683370) + + -- Antonio Terceiro <[email protected]> Sat, 04 Aug 2012 09:28:12 -0300 + ruby-actionpack-3.2 (3.2.6-2) unstable; urgency=low * Bump build dependency to gem2deb >= 0.3.0~ diff -Nru ruby-actionpack-3.2-3.2.6/debian/patches/CVE-2012-3424.patch ruby-actionpack-3.2-3.2.6/debian/patches/CVE-2012-3424.patch --- ruby-actionpack-3.2-3.2.6/debian/patches/CVE-2012-3424.patch 1969-12-31 21:00:00.000000000 -0300 +++ ruby-actionpack-3.2-3.2.6/debian/patches/CVE-2012-3424.patch 2012-08-04 09:27:46.000000000 -0300 @@ -0,0 +1,22 @@ +Description: Do not convert digest auth strings to symbols. +Author: Aaron Patterson <[email protected]> + +--- + +Origin: upstream, https://github.com/rails/rails/commit/27311fef5efa598f281649074255834546d2b4ec +Forwarded: not-needed + +--- ruby-actionpack-3.2-3.2.6.orig/lib/action_controller/metal/http_authentication.rb ++++ ruby-actionpack-3.2-3.2.6/lib/action_controller/metal/http_authentication.rb +@@ -227,9 +227,9 @@ module ActionController + end + + def decode_credentials(header) +- Hash[header.to_s.gsub(/^Digest\s+/,'').split(',').map do |pair| ++ HashWithIndifferentAccess[header.to_s.gsub(/^Digest\s+/,'').split(',').map do |pair| + key, value = pair.split('=', 2) +- [key.strip.to_sym, value.to_s.gsub(/^"|"$/,'').gsub(/'/, '')] ++ [key.strip, value.to_s.gsub(/^"|"$/,'').delete('\'')] + end] + end + diff -Nru ruby-actionpack-3.2-3.2.6/debian/patches/series ruby-actionpack-3.2-3.2.6/debian/patches/series --- ruby-actionpack-3.2-3.2.6/debian/patches/series 1969-12-31 21:00:00.000000000 -0300 +++ ruby-actionpack-3.2-3.2.6/debian/patches/series 2012-08-04 09:26:26.000000000 -0300 @@ -0,0 +1 @@ +CVE-2012-3424.patchAttachment: signature.asc
Description: Digital signature
--- End Message ---
--- Begin Message ---
- To: Antonio Terceiro <[email protected]>, [email protected]
- Subject: Re: Bug#683820: unblock: ruby-actionpack-3.2/3.2.6-3
- From: "Adam D. Barratt" <[email protected]>
- Date: Sat, 04 Aug 2012 14:20:04 +0100
- Message-id: <[email protected]>
- In-reply-to: <[🔎] [email protected]>
- References: <[🔎] [email protected]>
On Sat, 2012-08-04 at 09:55 -0300, Antonio Terceiro wrote: > Please unblock package ruby-actionpack-3.2 > > This version add a single patch that fixes a secutiry problem > (CVE-2012-3424, #683370), and just uploaded to unstable. You will find a > debdiff against the version currently in testing attached. Unblocked; thanks. Regards, Adam
--- End Message ---