Hi everyone,
Rails 3.0.10 has been released. This release contains critical security fixes.
You can find an exhaustive list of changes on github. Here are some notable excerpts:
Please follow the links to see specific information about each vulnerability, along with individual patches for fixing them.
Please note that these security fixes do not have CVE identifiers. We requested identifiers on August 5th, and have yet to received a response. When we get identifiers, we’ll update the notices with those values.
Also remember to subscribe to the Ruby on Rails Security mailing list.
controller_name
for nil
[jeroenj]ActionView::FormOptionsHelper#select
with :multiple => false
Cache#read
in case of a fragment cache hitrake db:schema:dump
ActiveRecord::Batches#find_each
to not return self
.table_exists?
in PG to to always use current search_path
or schema if explictly set.You may have noticed this release was originally slated to be released on August 8th. We decided to delay the release in order to obtain CVE identifiers. Unfortunately, identifiers still have not been issued. We felt that getting the security fixes to our users was more important than obtaining CVE values.
That is why our release is late, and contains no CVE identifiers.
Thanks! <3