303 Backported patches for legacy Ruby versions

The Rails LTS service only covers security updates for the Rails framework, not for Ruby.

As a courtesy to our customers, we sometimes backport security patches to legacy Ruby versions, which you can find below. However, we cannot guarantee future patches for legacy Ruby versions.

Patches for Ruby 1.8.7

Download ruby_1_8_7-p374-fixes-2015-04-14.patch and rename it to download.patch.

This patch applies to Ruby version 1.8.7-p374 and fixes the following issues:

• CVE-2015-1855: Ruby OpenSSL Hostname Verification Show archive.org snapshot
• CVE-2013-4164: Heap Overflow in Floating Point Parsing Show archive.org snapshot

Installation using RVM

First, make sure you have a RVM Show archive.org snapshot version. If in doubt, use

Copyrvm get stable

Then run the following command, replacing download.patch with the patch file you retrieved above:

Copyrvm install ruby-1.8.7-p374 --patch download.patch

Installation using ruby-install

If you're using ruby-install Show archive.org snapshot , run the following command, replacing download.patch with the patch file you retrieved above:

Copyruby-install -p download.patch ruby 1.8.7-p374

Installation using rbenv / ruby-build

If you're using rbenv Show archive.org snapshot 's ruby-build plugin Show archive.org snapshot , use the following command, replacing download.patch with the patch file you retrieved above:

Copyrbenv install --patch 1.8.7-p374 < download.patch

Manual installation

• Download Ruby 1.8.7 from source

• Unzip the package: bunzip2 ruby-1.8.7-p374.tar.bz2 && tar xf ruby-1.8.7-p374.tar && cd ruby-1.8.7-p374

• Then run the following command, replacing download.patch with the patch file you retrieved above:

  Copypatch -p1 < download.patch
  

• Install normally following the instructions from the accompanying README.

Patches for Ruby Enterprise Edition

Patches for Ruby 1.8.7 should apply to Ruby Enterprise Edition, but we can't test for yet another Ruby. Sorry!

Patches for Ruby 1.9.3

Download ruby_1_9_3-p551-fixes-2015-04-14.patch and rename it to download.patch.

This patch applies to Ruby version 1.9.3-p551 and fixes the following issues:

• CVE-2015-1855: Ruby OpenSSL Hostname Verification Show archive.org snapshot

Installation using RVM

First, make sure you have a RVM Show archive.org snapshot version. If in doubt, use

Copyrvm get stable

Then run the following command, replacing download.patch with the patch file you retrieved above:

Copyrvm install ruby-1.9.3-p551 --patch download.patch

Installation using ruby-install

If you're using ruby-install Show archive.org snapshot , run the following command, replacing download.patch with the patch file you retrieved above:

Copyruby-install -p download.patch ruby 1.9.3-p551

Installation using rbenv / ruby-build

If you're using rbenv Show archive.org snapshot 's ruby-build plugin Show archive.org snapshot , use the following command, replacing download.patch with the patch file you retrieved above:

Copyrbenv install --patch 1.9.3-p551 < download.patch

Manual installation

• Download Ruby 1.9.3 from source

• Unzip the package: bunzip2 ruby-1.9.3-p551.tar.bz2 && tar xf ruby-1.9.3-p551.tar && cd ruby-1.9.3-p551

• Then run the following command, replacing download.patch with the patch file you retrieved above:

  Copypatch -p1 < download.patch
  

• Install normally following the instructions from the accompanying README.