# Importante: Aggiornate Rails!

**URL:** <https://www.ruby-forum.com/t/importante-aggiornate-rails/64623>\
**Category:** IT\
**Created:** [August 15, 2006, 2:10pm UTC](https://www.ruby-forum.com/t/importante-aggiornate-rails/64623 "2006-08-15T14:10:37Z")\
**Posts on this page:** 3\
**Page:** 1

<div class="post-metadata">

**Author:** ![visitor1981](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/74df32/32.png) [@visitor1981](https://www.ruby-forum.com/u/visitor1981)\
**Post date:** [August 15, 2006, 2:10pm UTC](https://www.ruby-forum.com/t/importante-aggiornate-rails/64623/1 "2006-08-15T14:10:37Z")

</div>

Ragazzi,

hanno scoperto un buco in Rails che ne compromette la sicurezza.  
Se avete siti che girano su Rails, aggiornateli all’ultima versione  
(1.1.5),  
è importante.  
Maggiori dettagli qui:  
[http://weblog.rubyonrails.com/2006/8/9/rails-1-1-5-mandatory-security-patch-and-other-tidbits](http://weblog.rubyonrails.com/2006/8/9/rails-1-1-5-mandatory-security-patch-and-other-tidbits)

Ciao,  
Antonio

---

<div class="post-metadata">

**Author:** ![visitor1981](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/74df32/32.png) [@visitor1981](https://www.ruby-forum.com/u/visitor1981)\
**Post date:** [August 15, 2006, 2:15pm UTC](https://www.ruby-forum.com/t/importante-aggiornate-rails/64623/2 "2006-08-15T14:15:52Z")

</div>

On 8/9/06, Antonio C. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> Ragazzi,
> 
> hanno scoperto un buco in Rails che ne compromette la sicurezza.

Mi rispondo da solo 🙂  
La patch rilasciata ieri non risolveva completamente il problema. Per  
cui  
c’è un altro update: Rails 1.1.6.  
Ora però hanno rilasciato delle patch per le varie versioni affette dalla  
vulnerabilità (quindi v1.1.0 in poi) e hanno fornito maggiori dettagli sul  
problema:

> **[Rails 1.1.6, backports, and full disclosure](https://rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure)**
>
> The cat is out of the bag, so here’s the full disclosure edition of the current security vulnerability. With Rails 1.1.0 through 1.1.5 (minus the short-lived 1.1.3), you can trigger the evaluation of Ruby code through the URL because of a bug in the...

Ciao,  
Antonio

---

<div class="post-metadata">

**Author:** ![visitor1981](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/v/74df32/32.png) [@visitor1981](https://www.ruby-forum.com/u/visitor1981)\
**Post date:** [August 15, 2006, 2:17pm UTC](https://www.ruby-forum.com/t/importante-aggiornate-rails/64623/3 "2006-08-15T14:17:24Z")

</div>

Il 11-08-2006 Antonio C. ha scritto:

> [Ruby on Rails — Rails 1.1.6, backports, and full disclosure](http://weblog.rubyonrails.org/2006/8/10/rails-1-1-6-backports-and-full-disclosure)

Sembra una cappella bella grossa…

–  
blog: [http://www.akropolix.net/rik0/blogs](http://www.akropolix.net/rik0/blogs) | Enrico F.  
site: [http://www.akropolix.net/rik0/](http://www.akropolix.net/rik0/) | RiK0  
forum: [http://www.akropolix.net/forum/](http://www.akropolix.net/forum/) | Linux Counter: #299198