# Ruby 1.8.7-p173 released **URL:** \ **Category:** Ruby\ **Created:** [June 10, 2009, 2:23am UTC](https://www.ruby-forum.com/t/ruby-1-8-7-p173-released/169893 "2009-06-10T02:23:48Z")\ **Posts on this page:** 9\ **Page:** 1
**Author:** ![Urabe\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/ecc23a/32.png) [@Urabe\_S](https://www.ruby-forum.com/u/Urabe_S)\ **Post date:** [June 10, 2009, 2:23am UTC](https://www.ruby-forum.com/t/ruby-1-8-7-p173-released/169893/1 "2009-06-10T02:23:48Z")
Hello all. This is a security fix for ruby 1.8.7. A vulnerability was found in Ruby’s BigDecimal stdlib. That enables attackers to cause ruby process segfault. This release is to fix that issue. For a detailed info on the vulnerability please refer: [http://www.ruby-lang.org/en/news/2009/06/09/dos-vulnerability-in-bigdecimal/](http://www.ruby-lang.org/en/news/2009/06/09/dos-vulnerability-in-bigdecimal/) Released tarballs are available at: ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p173.tar.gz ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p173.tar.bz2 ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p173.zip and checksums: MD5(ruby-1.8.7-p173.tar.gz)= 74fbd67496ab7cc4de896d053f1507a5 SHA256(ruby-1.8.7-p173.tar.gz)= 89ad16522f0a2f91e83e418e63cd27ec0fa6e40b17118c29f48b24468490a662 SIZE(ruby-1.8.7-p173.tar.gz)= 4823322 MD5(ruby-1.8.7-p173.tar.bz2)= bf297efaa24ec6cdb74963c0f608f6f1 SHA256(ruby-1.8.7-p173.tar.bz2)= 7cec49bc4afb82188ca4bdb5a0400ec7ede6bf0937af9dd6acaca4e54b8aa760 SIZE(ruby-1.8.7-p173.tar.bz2)= 4144667 MD5(ruby-1.8.7-p173.zip)= ef2f79470286bf885aeadb10c32ff379 SHA256(ruby-1.8.7-p173.zip)= 92e55401af85363955bac9c08366a9e1b144d4e4f756cc3c552b4fd242bf540a SIZE(ruby-1.8.7-p173.zip)= 5881664 Thank you. ---
**Author:** ![Urabe\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/ecc23a/32.png) [@Urabe\_S](https://www.ruby-forum.com/u/Urabe_S)\ **Post date:** [June 10, 2009, 9:38pm UTC](https://www.ruby-forum.com/t/ruby-1-8-7-p173-released/169893/2 "2009-06-10T21:38:00Z")
FYI, there is a bug in BigDecimal#to\_f with this release. BigDecimal(“10.03”).to\_f =\> 10.3 My colleague put together a temporary fix (the post is for Rails devs): > **[Ruby Denial of Service patch breaks BigDecimal to\_f method - Harvest](https://www.getharvest.com/blog/2009/06/ruby-denial-of-service-patch-breaks-bigdecimal-to_f-method)** > > Harvest is built on the Ruby on Rails web framework, as such we constantly monitor for security issues with the framework and the language itself. A Ruby Denial of Service (DoS) vulnerability was announced almost 24 hours ago. The security of Harvest... Hope this helps some folks out. – Barry Hess > **[Time Tracking Software With Invoicing | Harvest](https://www.getharvest.com/)** > > Time tracking and management software with powerful easy reporting and streamlined online invoicing. Loved by 73,000 businesses. Get started for free. > **[Barry Hess :: bjhess.com](https://bjhess.com/)** > > Barry Hess writes about software, writing, creativity, media, and family. ---
**Author:** ![Urabe\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/ecc23a/32.png) [@Urabe\_S](https://www.ruby-forum.com/u/Urabe_S)\ **Post date:** [June 11, 2009, 12:17am UTC](https://www.ruby-forum.com/t/ruby-1-8-7-p173-released/169893/3 "2009-06-11T00:17:47Z")
On Wed, Jun 10, 2009 at 2:38 PM, Barry Hess[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > FYI, there is a bug in BigDecimal#to\_f with this release. > > BigDecimal(“10.03”).to\_f > =\> 10.3 > > My colleague put together a temporary fix (the post is for Rails devs): > > [Ruby Denial of Service patch breaks BigDecimal to\_f method - Harvest](http://bit.ly/65vKm) Why was this not caught in the original fix? I thought the ruby-core folks were running RubySpecs now… - Charlie ---
**Author:** ![Urabe\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/ecc23a/32.png) [@Urabe\_S](https://www.ruby-forum.com/u/Urabe_S)\ **Post date:** [June 11, 2009, 2:44am UTC](https://www.ruby-forum.com/t/ruby-1-8-7-p173-released/169893/4 "2009-06-11T02:44:41Z")
On Wed, Jun 10, 2009 at 5:27 PM, Ezra Z.[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > Â Â Â Â This was caught by the rubyspecs and is not broken in the release of > ruby-1.8.6\_p369. Yes, I know that much from talking to Kirk… but I’m confused why there would be a breakage in any of the other versions if everyone’s running RubySpecs. - Charlie ---
**Author:** ![Urabe\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/ecc23a/32.png) [@Urabe\_S](https://www.ruby-forum.com/u/Urabe_S)\ **Post date:** [June 11, 2009, 12:28am UTC](https://www.ruby-forum.com/t/ruby-1-8-7-p173-released/169893/5 "2009-06-11T00:28:54Z")
On Jun 10, 2009, at 3:17 PM, Charles Oliver N. wrote: > Why was this not caught in the original fix? I thought the ruby-core > folks were running RubySpecs now… > > - Charlie This was caught by the rubyspecs and is not broken in the release of ruby-1.8.6\_p369. Cheers- Ezra Z. removed\_email\_address@domain.invalid ---
**Author:** ![Urabe\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/ecc23a/32.png) [@Urabe\_S](https://www.ruby-forum.com/u/Urabe_S)\ **Post date:** [June 12, 2009, 1:17am UTC](https://www.ruby-forum.com/t/ruby-1-8-7-p173-released/169893/6 "2009-06-12T01:17:00Z")
On Thu, Jun 11, 2009 at 1:11 AM, Yukihiro M.[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote: > It was me introduced a bug. Â I neglect to run the test this time. > Unfortunately, 1.9 maintainers seemed to trust me, who they shouldn’t > trust. Â I hope we could learn something from this experience. > > I have just committed all the fixes (from 1.9) to 1.8 HEAD. I know how that is, and I sympathize. Good thing Ruby has a great community to catch us when we stumble 🙂 Let me know if there’s any way I can help ruby-core devs include rubyspecs in day-to-day development. They only take about a minute to run. - Charlie ---
**Author:** ![Urabe\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/ecc23a/32.png) [@Urabe\_S](https://www.ruby-forum.com/u/Urabe_S)\ **Post date:** [June 11, 2009, 8:12am UTC](https://www.ruby-forum.com/t/ruby-1-8-7-p173-released/169893/7 "2009-06-11T08:12:18Z")
Hi, In message “Re: Ruby 1.8.7-p173 released” on Thu, 11 Jun 2009 07:17:02 +0900, Charles Oliver N. [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) writes: |Why was this not caught in the original fix? I thought the ruby-core |folks were running RubySpecs now… It was me introduced a bug. I neglect to run the test this time. Unfortunately, 1.9 maintainers seemed to trust me, who they shouldn’t trust. I hope we could learn something from this experience. I have just committed all the fixes (from 1.9) to 1.8 HEAD. ``` matz. ``` ---
**Author:** ![Urabe\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/ecc23a/32.png) [@Urabe\_S](https://www.ruby-forum.com/u/Urabe_S)\ **Post date:** [June 12, 2009, 10:07am UTC](https://www.ruby-forum.com/t/ruby-1-8-7-p173-released/169893/8 "2009-06-12T10:07:37Z")
Yukihiro M. wrote: > I have just committed all the fixes (from 1.9) to 1.8 HEAD. And I’ve backported that to 1.8.7. Can I release that right now? Or should I wait for next week? It’s Friday after 17:00 in Japan. I’m personally OK to release, though. ---
**Author:** ![Urabe\_S](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/u/ecc23a/32.png) [@Urabe\_S](https://www.ruby-forum.com/u/Urabe_S)\ **Post date:** [June 16, 2009, 2:25am UTC](https://www.ruby-forum.com/t/ruby-1-8-7-p173-released/169893/9 "2009-06-16T02:25:07Z")
> Yukihiro M. wrote: > > > I have just committed all the fixes (from 1.9) to 1.8 HEAD. > > And I’ve backported that to 1.8.7. Sorry for the breakage. I’ve put the release tarball on our ftp site (URL below). ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p174.tar.gz ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p174.tar.bz2 ftp://ftp.ruby-lang.org/pub/ruby/1.8/ruby-1.8.7-p174.zip Checksums: MD5(ruby-1.8.7-p174.tar.gz)= 18dcdfef761a745ac7da45b61776afa5 SHA256(ruby-1.8.7-p174.tar.gz)= da65d7d7c09ffc018fe5788338dc91ced08e0fb009a90c4bdeececfbd8c0fcc1 SIZE(ruby-1.8.7-p174.tar.gz)= 4823453 MD5(ruby-1.8.7-p174.tar.bz2)= 88c45aaf627b4404e5e4273cb03ba2ee SHA256(ruby-1.8.7-p174.tar.bz2)= 203978b6db1cc77a79ff03d141d162f6f17d86c3574f76de9eae9d0c8cb920bc SIZE(ruby-1.8.7-p174.tar.bz2)= 4144807 MD5(ruby-1.8.7-p174.zip)= 238b4744fc96d8cdba639ac2070333c4 SHA256(ruby-1.8.7-p174.zip)= 0b21024be3d77f13df938cbde5664d5aef3cf4cc168e331130e74980a4f9087d SIZE(ruby-1.8.7-p174.zip)= 5881715 Thank you.