Major Security Hole Found In Rails

mudimba writes "A major security hole has been found in Ruby on Rails. Upgrading to version 1.1.5 is extremely urgent, and all previous versions except those "on a very recent edge" are affected. Details on the exact nature of the flaw will be coming soon, but the rails team has decided to wait a short time before disclosure so that people can have a chance to upgrade their servers before would-be-assailants are armed." Update: 08/10 13:56 GMT by J : Now they're saying only the last six months of releases are affected: 1.1.0 through 1.1.4.

Comments

Major Security Hole Found In Rails

[kjart]

...and hundreds die in the resulting crash. When interviewed later the conductor said that he wishes he was told where the hole was so he could've stopped the train in time.

Re: Major Security Hole Found In Rails

[jkrise]

Don't you find it odd that the conductor is alive and kicking, while hundreds of passengers died? I thought this scenario exists only in the software world, where the vendor escapes scot-free after defective software crashes his cutomers' systems...

Re: Major Security Hole Found In Rails

[m0rph3us0]

They should have been made of Rearden metal and this would not have happend.

Re:How few?

[trickster721]

Penny Arcade runs on it... occasionally.

Re:RoR lacks maturity

[mpcooke3]

Yeah, I run windows it's been around for ages so it's nice and secure.

Re:How few?

[Daytona955i]

Including:
http://www.rubyonrails.org/index.php

I still get a kick out of that.

Security temporarily unavailable

[telchine]

http://wiki.rubyonrails.org/rails/pages/Security

Service Temporarily Unavailable

Seems an appropriate response!

Patch

[joebutton]

Patch available here.

Re:I'm really trying to like Rails, but...

[Anonymous Coward]

it's You

Rails

[quantum bit]

Maybe they should switch to a safe language that prevents buffer overflows and protects programmers from themselves.

Oops.