Ubuntu Security Notice USN-1902-1
9th July, 2013
ruby1.8, ruby1.9.1 vulnerability
A security issue affects these releases of Ubuntu and its derivatives:
- Ubuntu 13.04
- Ubuntu 12.10
- Ubuntu 12.04 LTS
An attacker could trick Ruby into trusting a rogue server.
- ruby1.8 - Object-oriented scripting language
- ruby1.9.1 - Object-oriented scripting language
William (B.J.) Snow Orvis discovered that Ruby incorrectly verified the
hostname in SSL certificates. An attacker could trick Ruby into trusting a
rogue server certificate, which was signed by a trusted certificate
authority, to perform a man-in-the-middle attack.
The problem can be corrected by updating your system to the following package version:
- Ubuntu 13.04:
- ruby1.8 126.96.36.1998-7ubuntu1.1
- ruby1.9.1 188.8.131.52-8.1ubuntu1.1
- libruby1.8 184.108.40.2068-7ubuntu1.1
- libruby1.9.1 220.127.116.11-8.1ubuntu1.1
- Ubuntu 12.10:
- ruby1.8 18.104.22.1688-4ubuntu0.3
- ruby1.9.1 22.214.171.124-1ubuntu1.5
- libruby1.8 126.96.36.1998-4ubuntu0.3
- libruby1.9.1 188.8.131.52-1ubuntu1.5
- Ubuntu 12.04 LTS:
- ruby1.8 184.108.40.2062-2ubuntu1.3
- ruby1.9.1 220.127.116.11-1ubuntu2.7
- libruby1.8 18.104.22.1682-2ubuntu1.3
- libruby1.9.1 22.214.171.124-1ubuntu2.7
To update your system, please follow these instructions: https://wiki.ubuntu.com/Security/Upgrades.
In general, a standard system update will make all the necessary changes.