Secure testing team - Jan 2010 - Bug#564646: ruby1.9.1: WEBrick control characters vulnerability

Package: ruby1.9.1
Version: 1.9.1.376-1
Severity: grave
Tags: security
Justification: user security hole

The upstream has released a vulnerability fix in WEBrick, a part of
Ruby''s
standard library.  WEBrick lets attackers to inject malicious escap e sequences
to its logs, making it possible for dangerous control characters to be executed
on a victim''s terminal emulator.

-- System Information:
Debian Release: squeeze/sid
  APT prefers testing
  APT policy: (990, ''testing''), (500,
''stable''), (90, ''unstable''), (1,
''experimental'')
Architecture: amd64 (x86_64)

Kernel: Linux 2.6.30-2-amd64 (SMP w/2 CPU cores)
Locale: LANG=ja_JP.eucJP, LC_CTYPE=ja_JP.eucJP (charmap=EUC-JP)
Shell: /bin/sh linked to /bin/dash

Versions of packages ruby1.9.1 depends on:
ii  libc6                        2.10.2-2    GNU C Library: Shared libraries
ii  libruby1.9.1                 1.9.1.376-1 Libraries necessary to run Ruby 1.

ruby1.9.1 recommends no packages.

Versions of packages ruby1.9.1 suggests:
ii  rdoc1.9.1                    1.9.1.376-1 Generate documentation from Ruby s
ii  ri1.9.1                      1.9.1.376-1 Ruby Interactive reference (for Ru
ii  ruby1.9.1-examples           1.9.1.376-1 Examples for Ruby 1.9
ii  rubygems1.9.1                1.3.5-2     package management framework for R

-- no debconf information