Path to this page:
Subject: CVS commit: pkgsrc/www/ruby-rest-client
From: Takahiro Kambe
Date: 2015-03-28 05:12:16
Message id: 20150328041216.EFEDF98@cvs.netbsd.org
Log Message:
Update ruby-rest-client to 1.8.0, security fix.
# 1.8.0
- Security: implement standards compliant cookie handling by adding a
dependency on http-cookie. This breaks compatibility, but was necessary to
address a session fixation / cookie disclosure vulnerability.
(#369 / CVE-2015-1820)
Previously, any Set-Cookie headers found in an HTTP 30x response would be
sent to the redirection target, regardless of domain. Responses now expose a
cookie jar and respect standards compliant domain / path flags in Set-Cookie
headers.
Files: