# Correlate Ruby version/build with patch number **URL:** \ **Category:** Rails\ **Created:** [June 28, 2008, 11:34pm UTC](https://www.ruby-forum.com/t/correlate-ruby-version-build-with-patch-number/141669 "2008-06-28T23:34:55Z")\ **Posts on this page:** 8\ **Page:** 1
**Author:** ![caliwildman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/a6a055/32.png) [@caliwildman](https://www.ruby-forum.com/u/caliwildman)\ **Post date:** [June 28, 2008, 11:34pm UTC](https://www.ruby-forum.com/t/correlate-ruby-version-build-with-patch-number/141669/1 "2008-06-28T23:34:55Z")
I heard from a couple of sources about Ruby security concerns, quoting from [http://www.rubyinside.com/june-2008-ruby-security-vulnerabilities-927.html](http://www.rubyinside.com/june-2008-ruby-security-vulnerabilities-927.html) The official Ruby blog is reporting “multiple vulnerabilities” in the official Ruby interpreter (MRI). A significant number of versions are affected: ``` * All versions prior to 1.8.5 * All 1.8.5 versions prior to patch 231 * All 1.8.6 versions prior to patch 230 * All 1.8.7 versions prior to patch 22 * All 1.9.0 versions prior to 1.9.0-2 ``` I believe my Ruby is version 1.8.5.32-2, and 32-2 is the build #? However, I have no idea what that means in terms of patch # as listed above for say “All 1.8.5 versions prior to patch 231”. Does anyone know how to correlate the two? ---
**Author:** ![caliwildman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/a6a055/32.png) [@caliwildman](https://www.ruby-forum.com/u/caliwildman)\ **Post date:** [June 29, 2008, 2:26pm UTC](https://www.ruby-forum.com/t/correlate-ruby-version-build-with-patch-number/141669/2 "2008-06-29T14:26:06Z")
You can run this from the command line to get the patch level: ruby -e ‘puts(RUBY\_PATCHLEVEL)’ Best. Mike ---
**Author:** ![caliwildman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/a6a055/32.png) [@caliwildman](https://www.ruby-forum.com/u/caliwildman)\ **Post date:** [June 29, 2008, 5:21pm UTC](https://www.ruby-forum.com/t/correlate-ruby-version-build-with-patch-number/141669/3 "2008-06-29T17:21:52Z")
Michael B. wrote: > You can run this from the command line to get the patch level: ruby -e > ‘puts(RUBY\_PATCHLEVEL)’ > > Best. > Mike that’s true, but my understanding was that although my ubuntu ruby 1.8.6 says it’s at patch level 111, it is in fact patched against the vulnerability > **[Bug #241657 “Multiple vulnerabilities in Ruby may lead to a deni...” : Bugs :...](https://bugs.launchpad.net/ubuntu/hardy/+source/ruby1.8/+bug/241657)** > > Binary package hint: ruby1.8 > > \*\*\* Source: http://www.ruby-lang.org/en/news/2008/06/20/arbitrary-code-execution-vulnerabilities/ \*\*\* > > Present on Ubuntu Gutsy Gibbon 7.10 (desktop and server) > > Impact > > With the following vulnerabilities, an attacker can... so, I believe I’m safe even though… matthew@ruBuntu:~$ ruby -e ‘puts(RUBY\_PATCHLEVEL)’ 111 matthew@ruBuntu:~$ ruby --version ruby 1.8.6 (2007-09-24 patchlevel 111) [i486-linux] ---
**Author:** ![caliwildman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/a6a055/32.png) [@caliwildman](https://www.ruby-forum.com/u/caliwildman)\ **Post date:** [June 29, 2008, 5:28pm UTC](https://www.ruby-forum.com/t/correlate-ruby-version-build-with-patch-number/141669/4 "2008-06-29T17:28:59Z")
Matthew R. Jacobs wrote: > Michael B. wrote: > > > You can run this from the command line to get the patch level: ruby -e > > ‘puts(RUBY\_PATCHLEVEL)’ > > > > Best. > > Mike Thanks Mike, actually I did try that already but got an error C:\Documents and Settings\Bob\>ruby -e ‘puts(RUBY\_PATCHLEVEL)’ -e:1: uninitialized constant RUBY\_PATCHLEVEL (NameError) Any other ideas? Much appreciated. > that’s true, > but my understanding was that although my ubuntu ruby 1.8.6 says it’s at > patch level 111, it is in fact patched against the vulnerability > > [Bug #241657 “Multiple vulnerabilities in Ruby may lead to a deni...” : Hardy (8.04) : Bugs : ruby1.8 package : Ubuntu](https://bugs.launchpad.net/ubuntu/hardy/+source/ruby1.8/+bug/241657) > > so, I believe I’m safe even though… > > matthew@ruBuntu:~$ ruby -e ‘puts(RUBY\_PATCHLEVEL)’ > 111 > matthew@ruBuntu:~$ ruby --version > ruby 1.8.6 (2007-09-24 patchlevel 111) [i486-linux] Matthew, On Windows, the ruby --version command doesn’t even show patch level C:\Documents and Settings\Bob\>ruby --version ruby 1.8.5 (2006-08-25) [i386-mswin32] ---
**Author:** ![caliwildman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/a6a055/32.png) [@caliwildman](https://www.ruby-forum.com/u/caliwildman)\ **Post date:** [June 29, 2008, 5:53pm UTC](https://www.ruby-forum.com/t/correlate-ruby-version-build-with-patch-number/141669/5 "2008-06-29T17:53:27Z")
Michael B. wrote: > what about from irb? (I don’t have windows so I can’t test this for you) > > > > puts RUBY\_PATCHLEVEL > > > 111 > > > =\> nil > > > > > _Sigh_ same result unfortunately uninitialized constant. Is the Ruby on Windows that different that Linux? ---
**Author:** ![caliwildman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/a6a055/32.png) [@caliwildman](https://www.ruby-forum.com/u/caliwildman)\ **Post date:** [June 29, 2008, 6:11pm UTC](https://www.ruby-forum.com/t/correlate-ruby-version-build-with-patch-number/141669/6 "2008-06-29T18:11:43Z")
On Jun 29, 2008, at 11:53 AM, Cali W. wrote: > _Sigh_ same result unfortunately uninitialized constant. Is the Ruby > on > Windows that different that Linux? I’m guessing that Ruby 1.8.5 on windows didn’t set this environment variable? This might be a great question for the new RoR on Windows google group. Sorry I couldn’t be more helpful. Best. Mike ---
**Author:** ![caliwildman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/a6a055/32.png) [@caliwildman](https://www.ruby-forum.com/u/caliwildman)\ **Post date:** [June 29, 2008, 6:56pm UTC](https://www.ruby-forum.com/t/correlate-ruby-version-build-with-patch-number/141669/7 "2008-06-29T18:56:10Z")
Michael B. wrote: > On Jun 29, 2008, at 11:53 AM, Cali W. wrote: > > > _Sigh_ same result unfortunately uninitialized constant. Is the Ruby > > on > > Windows that different that Linux? > > I’m guessing that Ruby 1.8.5 on windows didn’t set this environment > variable? > > This might be a great question for the new RoR on Windows google group. > > Sorry I couldn’t be more helpful. > > Best. > Mike Mike, thanks for your tips though, at least I know that I am not missing something obvious. Actually, I started the new RoR Windows group =) hopefully I can get some traction there. ---
**Author:** ![caliwildman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/a6a055/32.png) [@caliwildman](https://www.ruby-forum.com/u/caliwildman)\ **Post date:** [June 29, 2008, 5:40pm UTC](https://www.ruby-forum.com/t/correlate-ruby-version-build-with-patch-number/141669/8 "2008-06-29T17:40:08Z")
what about from irb? (I don’t have windows so I can’t test this for you) > > puts RUBY\_PATCHLEVEL > > 111 > > =\> nil > > >