# Ruby patch level

**URL:** <https://www.ruby-forum.com/t/ruby-patch-level/141813>\
**Category:** Ruby\
**Created:** [June 30, 2008, 7:42pm UTC](https://www.ruby-forum.com/t/ruby-patch-level/141813 "2008-06-30T19:42:08Z")\
**Posts on this page:** 5\
**Page:** 1

<div class="post-metadata">

**Author:** ![caliwildman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/a6a055/32.png) [@caliwildman](https://www.ruby-forum.com/u/caliwildman)\
**Post date:** [June 30, 2008, 7:42pm UTC](https://www.ruby-forum.com/t/ruby-patch-level/141813/1 "2008-06-30T19:42:08Z")

</div>

I have Ruby 1.8.5 on Windows XP and unable to identify the patch level  
for that release. I have tried the following commands without success

- ruby -e ‘puts(RUBY\_PATCHLEVEL)’ gives uninitialized constant
- ruby -v does not show patch level
- from irb: puts RUBY\_PATCHLEVEL gives uninitialized constant

The reason I am doing this is because of this…  
The official Ruby blog is reporting “multiple vulnerabilities” in the  
official Ruby interpreter (MRI). A significant number of versions are  
affected:

```
* All versions prior to 1.8.5
* All 1.8.5 versions prior to patch 231
* All 1.8.6 versions prior to patch 230
* All 1.8.7 versions prior to patch 22
* All 1.9.0 versions prior to 1.9.0-2

```

I am thinking that my version of Ruby predates PATCHLEVEL var? If so, is  
there a way to perhaps correlate the date of the Ruby package with a  
patch level? Thanks in advance for your help.

---

<div class="post-metadata">

**Author:** ![caliwildman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/a6a055/32.png) [@caliwildman](https://www.ruby-forum.com/u/caliwildman)\
**Post date:** [June 30, 2008, 11:59pm UTC](https://www.ruby-forum.com/t/ruby-patch-level/141813/2 "2008-06-30T23:59:05Z")

</div>

For my WinXP installation (1.8.6 one-click installer):

C:\>ruby --version  
ruby 1.8.6 (2007-09-24 patchlevel 111) [i386-mswin32]

YMMV

Dave

---

<div class="post-metadata">

**Author:** ![caliwildman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/a6a055/32.png) [@caliwildman](https://www.ruby-forum.com/u/caliwildman)\
**Post date:** [July 1, 2008, 12:42am UTC](https://www.ruby-forum.com/t/ruby-patch-level/141813/3 "2008-07-01T00:42:36Z")

</div>

On Mon, Jun 30, 2008 at 19:39, Cali W.  
[removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:

> - All versions prior to 1.8.5
> - All 1.8.5 versions prior to patch 231
> - All 1.8.6 versions prior to patch 230
> - All 1.8.7 versions prior to patch 22
> - All 1.9.0 versions prior to 1.9.0-2
> 
> I am thinking that my version of Ruby predates PATCHLEVEL var? If so, is  
> there a way to perhaps correlate the date of the Ruby package with a  
> patch level? Thanks in advance for your help.

If you installed your ruby from one-click installer, it’s vulnerable  
(There’s no OCI for p231 yet, and most probably never will be)  
If you installed your ruby more than two weeks ago, it’s vulnerable  
(I.e. your ruby must be newer than the annoucement).  
Note that some of the versions you listed are broken, so please read  
through recent posts to determine which version do you really want.

J.

---

<div class="post-metadata">

**Author:** ![caliwildman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/a6a055/32.png) [@caliwildman](https://www.ruby-forum.com/u/caliwildman)\
**Post date:** [July 1, 2008, 12:49am UTC](https://www.ruby-forum.com/t/ruby-patch-level/141813/4 "2008-07-01T00:49:23Z")

</div>

Jano S. wrote:

> On Mon, Jun 30, 2008 at 19:39, Cali W.  
> [removed\_email\_address@domain.invalid](mailto:removed_email_address@domain.invalid) wrote:
> 
> > - All versions prior to 1.8.5
> > - All 1.8.5 versions prior to patch 231
> > - All 1.8.6 versions prior to patch 230
> > - All 1.8.7 versions prior to patch 22
> > - All 1.9.0 versions prior to 1.9.0-2
> > 
> > I am thinking that my version of Ruby predates PATCHLEVEL var? If so, is  
> > there a way to perhaps correlate the date of the Ruby package with a  
> > patch level? Thanks in advance for your help.
> 
> If you installed your ruby from one-click installer, it’s vulnerable  
> (There’s no OCI for p231 yet, and most probably never will be)  
> If you installed your ruby more than two weeks ago, it’s vulnerable  
> (I.e. your ruby must be newer than the annoucement).  
> Note that some of the versions you listed are broken, so please read  
> through recent posts to determine which version do you really want.
> 
> J.

Thanks Jano, that’s helpful, my Ruby installation was from Jan 2007 so  
it’s vulnerable. I will read through the recent posts to determine the  
appropriate version.

---

<div class="post-metadata">

**Author:** ![caliwildman](https://www.ruby-forum.com/letter_avatar_proxy/v4/letter/c/a6a055/32.png) [@caliwildman](https://www.ruby-forum.com/u/caliwildman)\
**Post date:** [July 1, 2008, 12:47am UTC](https://www.ruby-forum.com/t/ruby-patch-level/141813/5 "2008-07-01T00:47:17Z")

</div>

Dave B. wrote:

> For my WinXP installation (1.8.6 one-click installer):
> 
> C:\>ruby --version  
> ruby 1.8.6 (2007-09-24 patchlevel 111) [i386-mswin32]
> 
> YMMV
> 
> Dave

ruby --version is the same as ruby -v, it doesn’t give me a patch level.