Skip to content

Commit acbc2a0

Browse files
committed
Reviewed points by sorah-san
1 parent 5e6c4f8 commit acbc2a0

File tree

1 file changed

+9
-7
lines changed

1 file changed

+9
-7
lines changed

en/news/_posts/2017-08-29-multiple-vulnerabilities-in-rubygems.md

Lines changed: 9 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -17,28 +17,30 @@ The following vulnerabilites have been reported.
1717

1818
* a DNS request hijacking vulnerability
1919
* an ANSI escape sequence vulnerability
20-
* a DOS vulernerability in the query command
20+
* a DoS vulernerability in the query command
2121
* a vulnerability in the gem installer that allowed a malicious gem to overwrite arbitrary files
2222

2323
It is strongly recommended for Ruby users to take one of the following workarounds as soon as possible.
2424

2525
## Affected Versions
2626

27-
* Ruby 2.2.7 and all versions of Ruby 2.2 prior to it
28-
* Ruby 2.3.4 and all versions of Ruby 2.3 prior to it
29-
* Ruby 2.4.1 and all versions of Ruby 2.4 prior to it
27+
* Ruby 2.2 series: 2.2.7 and earlier
28+
* Ruby 2.3 series: 2.3.4 and earlier
29+
* Ruby 2.4 series: 2.4.1 and earlier
3030
* prior to trunk revision 59672
3131

3232
## Workarounds
3333

34-
At this time, the fixed versions of Ruby have not been released yet.
35-
But you can upgrade RubyGems to latest version (2.6.13 or later), then the vulnerabilites will be fixed.
34+
At this moment, there are no Ruby releases including the fix for RubyGems.
35+
But you can upgrade RubyGems to the latest version.
36+
RubyGems 2.6.13 or later includes the fix for the vulnerabilities.
37+
3638

3739
```
3840
gem update --system
3941
```
4042

41-
If you can not upgrade RubyGems, the following patches can be applied as workarounds.
43+
If you can't upgrade RubyGems, you can apply the following patches as a workaround.
4244
For Ruby 2.4.1, apply the two patches one by one.
4345

4446
* [for Ruby 2.2.7](https://bugs.ruby-lang.org/attachments/download/6690/rubygems-2613-ruby22.patch)

0 commit comments

Comments
 (0)