Stay Secure with the Latest Linux Advisories

security advisorymoderateupdate

Fedora 11: 2009-10484 Moderate: ActiveResource XSS Mitigation

- Fixes CVE-2009-3009 - Downgrade to Rails 2.3.2 to avoid update issues for existing applications. -------------------------------------------------------------------------------- Fedora Update Notification FEDORA-2009-10484 2009-10-14 00:49:00 -------------------------------------------------------------------------------- Name : rubygem-activeresource Product : Fedora 11 Version : 2.3.2 Release : 2.fc11 URL : https://rubyonrails.org/ Summary : Active Record for web resources Description : Wraps web resources in model classes that can be manipulated through XML over REST. -------------------------------------------------------------------------------- Update Information: - Fixes CVE-2009-3009 - Downgrade to Rails 2.3.2 to avoid update issues for existing applications -------------------------------------------------------------------------------- ChangeLog: * Wed Oct 7 2009 David Lutterkort - 1:2.3.2-2 - Bump epoch; rails is not updatable across versions (bz 520843) * Sun Sep 27 2009 Mamoru Tasaka - 2.3.3-2 - Force rebuild * Sun Jul 26 2009 Jeroen van Meeuwen - 2.3.3-1 - New upstream version -------------------------------------------------------------------------------- References: [ 1 ] Bug #520843 - CVE-2009-3009 ruby-activesupport: XSS vulnerability https://bugzilla.redhat.com/show_bug.cgi?id=520843 -------------------------------------------------------------------------------- This update can be installed with the "yum" update program. Use su -c 'yum update rubygem-activeresource' at the command line. For more information, refer to "Managing Software with yum", available at . All packages are signed with the Fedora Project GPG key. More details on the GPG keys used by the Fedora Project can be found at https://fedoraproject.org/security/ -------------------------------------------------------------------------------- _______________________________________________ Fedora-package-announce mailinglist This email address is being protected from spambots. You need JavaScript enabled to view it. https://lists.fedoraproject.org/archives/list/This email address is being protected from spambots. You need JavaScript enabled to view it./ . Fedora has released an update alert regarding problems associated with rubygem-activeresource, specifically tackling CVE-2009-3009 vulnerability impacting Rails apps.. Fedora Update, Ruby Gem Security, XSS Mitigation. . Severity: Important. LinuxSecurity.com Team

Oct 13, 2009 •Important Fedora