How does this relate to WEBrick that ships with Ruby? (asking for CVE-2009-4492) about webrick HOT 6 CLOSED

@G-Rath All released versions of Ruby after the versions listed in the advisory are fixed. Here's is the commit that fixed Ruby 1.8.6: ruby/ruby@576a349. If you unpack the webrick 1.3.1 gem downloaded from rubygems.org, you can see it already has the same fixes.

from webrick.

The current versioning is different from the year of CVE-2009-4492 published. The all of versions after Ruby 1.x are already resolved.

from webrick.

@hsbt I was sort of hoping we could work to together to get this advisory improved, and unfortunately I don't quite understand how to do that with what you've just said.

Are you saying that all versions after v1 can be considered unaffected, or that just all versions of what's on RubyGems are fine as they came after the Ruby 1.x versions?

from webrick.

@hsbt have you had a chance to read over my reply? I'd really like to get the advisory corrected and would prefer to have confirmed things with a maintainer before I submit a change to the advisory.

from webrick.

What you want?

Webrick versioning is different from Ruby versioning. So, WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383 is different code with version of webrick-1.3.1. webrick-1.3.1 is the fixed version of Ruby 1.x to 2.4.x.

from webrick.

@hsbt @jeremyevans thanks for that info - for context, while I often work with Ruby/Rails I'm not super familiar with how versioning of gems in Ruby compare with what I assume is the same gem republished on RubyGems so sorry if I'm asking something really silly 😅

Primarily what I was finding confusing was the way the advisory listed "WEBrick 1.3.1 in Ruby 1.8.6 through patchlevel 383, 1.8.7 through patchlevel 248, 1.8.8dev, 1.9.1 through patchlevel 376, and 1.9.2dev " which meant I was unsure if it was referring to Ruby or WEBrick for those versions (though tbh re-reading it, I suspect I was overthinking it).

Thank you for helping me confirm this - I'll submit an improvement to the advisory marking all versions higher than 1.3.1 marked as fixed.

from webrick.