Bug#451374: CVE-2007-5770 unauthorized disclosure of information

2007-11-16 Thread Nico Golde
Hi, * akira yamada <[EMAIL PROTECTED]> [2007-11-15 16:19]: [...] > > The code you quoted is in the ruby1.9 package but _not_ in the ruby1.8 > > package. > > ruby1.8 source package uses cdbs and dpatch. > please apply patches. Thank you, I somehow missed the patch. I thought I looked at it. Tha

Bug#451374: CVE-2007-5770 unauthorized disclosure of information

2007-11-15 Thread Nico Golde
Hi akira, * akira yamada <[EMAIL PROTECTED]> [2007-11-15 15:40]: > > At least the telnets code in ruby1.8 (unstable) is not > > fixed. Do I miss anything? > > The fix is in net/telnets.rb. > >137 if @options['VerifyMode'] != OpenSSL::SSL::VERIFY_NONE >138@sock.p

Bug#451374: CVE-2007-5770 unauthorized disclosure of information

2007-11-15 Thread akira yamada
> It's not: > [EMAIL PROTECTED]:tmp$] LC_ALL=C apt-get source ruby1.8 > Reading package lists... Done > Building dependency tree > Reading state information... Done > Need to get 4593kB of source archives. > Get:1 http://debian.netcologne.de unstable/main ruby1.8 1.8.6.111-2 (dsc) > [1061B] > Get:

Bug#451374: CVE-2007-5770 unauthorized disclosure of information

2007-11-15 Thread Nico Golde
Hi akira, * akira yamada <[EMAIL PROTECTED]> [2007-11-15 15:15]: > > Package: ruby1.8 > > Version: 1.8.5-4 > > Severity: important > > Tags: security [...] > > CVE-2007-5770[0]: > > | The (1) Net::ftptls, (2) Net::telnets, (3) Net::imap, (4) Net::pop, > > | and (5) Net::smtp libraries in Ruby 1.8.

Bug#451374: CVE-2007-5770 unauthorized disclosure of information

2007-11-15 Thread akira yamada
Hi, > At least the telnets code in ruby1.8 (unstable) is not > fixed. Do I miss anything? The fix is in net/telnets.rb. 137 if @options['VerifyMode'] != OpenSSL::SSL::VERIFY_NONE 138@sock.post_connection_check(@options['Host']) 139 end Thank y

Bug#451374: CVE-2007-5770 unauthorized disclosure of information

2007-11-15 Thread akira yamada
Hi, > Package: ruby1.8 > Version: 1.8.5-4 > Severity: important > Tags: security > > Hi, > the following CVE (Common Vulnerabilities & Exposures) id was > published for ruby1.8. > > CVE-2007-5770[0]: > | The (1) Net::ftptls, (2) Net::telnets, (3) Net::imap, (4) Net::pop, > | and (5) Net::smtp li

Bug#451374: CVE-2007-5770 unauthorized disclosure of information

2007-11-15 Thread Nico Golde
Package: ruby1.8 Version: 1.8.5-4 Severity: important Tags: security Hi, the following CVE (Common Vulnerabilities & Exposures) id was published for ruby1.8. CVE-2007-5770[0]: | The (1) Net::ftptls, (2) Net::telnets, (3) Net::imap, (4) Net::pop, | and (5) Net::smtp libraries in Ruby 1.8.5 and 1.8