Register | Log in

ruby-zip

Ruby module for reading and writing zip files

Choose email to subscribe with

general

source: ruby-zip (main)
version: 2.0.0-1
maintainer: Debian Ruby Extras Maintainers (archive) (DMD)
uploaders: David Suárez [DMD] – Pirate Praveen [DMD]
arch: all
std-ver: 4.4.1
VCS: Git (Browse, QA)

versions [more versions can be listed by madison] [old versions available from snapshot.debian.org]

[pool directory]

o-o-stable: 1.1.6-1+deb8u1
o-o-sec: 1.1.6-1+deb8u2
oldstable: 1.2.0-1.1
old-bpo: 1.2.2-1~bpo9+1
stable: 1.2.2-1
stable-bpo: 2.0.0-1~bpo10+1
testing: 2.0.0-1
unstable: 2.0.0-1

versioned links

1.1.6-1+deb8u1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.1.6-1+deb8u2: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.2.0-1.1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.2.2-1~bpo9+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
1.2.2-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.0.0-1~bpo10+1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]
2.0.0-1: [.dsc, use dget on this link to retrieve source package] [changelog] [copyright] [rules] [control]

binaries

ruby-zip

action needed

A new upstream version is available: 2.2.0 high

A new upstream version 2.2.0 is available, you should consider packaging it.

Created: 2020-01-28 Last update: 2020-02-17 06:20

2 security issues in stretch high

There are 2 open security issues in stretch.

1 important issue:

CVE-2018-1000544: rubyzip gem rubyzip version 1.2.1 and earlier contains a Directory Traversal vulnerability in Zip::File component that can result in write arbitrary files to the filesystem. This attack appear to be exploitable via If a site allows uploading of .zip files , an attacker can upload a malicious file that contains symlinks or files with absolute pathnames "../" to write arbitrary files to the filesystem..

1 issue skipped by the security teams:

CVE-2019-16892: In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).

Please fix them.

Created: 2018-06-28 Last update: 2019-11-23 20:15

Multiarch hinter reports 1 issue(s) normal

There are issues with the multiarch metadata for this package.

ruby-zip could have its dependency on ruby annotated with :any

Created: 2018-12-31 Last update: 2020-02-17 06:23

1 ignored security issue in buster low

There is 1 open security issue in buster.

1 issue skipped by the security teams:

CVE-2019-16892: In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).

Please fix it.

Created: 2019-09-26 Last update: 2019-11-23 20:15

1 ignored security issue in jessie low

There is 1 open security issue in jessie.

1 issue skipped by the security teams:

CVE-2019-16892: In Rubyzip before 1.3.0, a crafted ZIP file can bypass application checks on ZIP entry sizes because data about the uncompressed size can be spoofed. This allows attackers to cause a denial of service (disk consumption).

Please fix it.

Created: 2019-09-26 Last update: 2019-11-23 20:15

Standards version of the package is outdated. wishlist

The package should be updated to follow the last version of Debian Policy (Standards-Version 4.5.0 instead of 4.4.1).

Created: 2020-01-21 Last update: 2020-01-21 05:06

news

[2019-12-02] Accepted ruby-zip 2.0.0-1~bpo10+1 (source all) into buster-backports, buster-backports (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2019-11-24] ruby-zip 2.0.0-1 MIGRATED to testing (Debian testing watch)
[2019-11-09] Accepted ruby-zip 2.0.0-1 (source) into unstable (David Suárez) (signed by: Cédric Boutillier)
[2019-02-11] Accepted ruby-zip 1.2.2-1~bpo9+1 (source amd64) into stretch-backports, stretch-backports (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2018-12-31] ruby-zip 1.2.2-1 MIGRATED to testing (Debian testing watch)
[2018-12-29] Accepted ruby-zip 1.2.2-1 (source) into unstable (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2018-08-17] ruby-zip 1.2.1-1.1 MIGRATED to testing (Debian testing watch)
[2018-08-15] Accepted ruby-zip 1.1.6-1+deb8u2 (source amd64) into oldstable (Markus Koschany)
[2018-08-15] Accepted ruby-zip 1.2.1-1.1 (source) into unstable (Markus Koschany)
[2018-08-14] ruby-zip REMOVED from testing (Debian testing watch)
[2017-07-03] ruby-zip 1.2.1-1 MIGRATED to testing (Debian testing watch)
[2017-06-28] Accepted ruby-zip 1.2.1-1 (source) into unstable (Sruthi Chandran) (signed by: Praveen Arimbrathodiyil)
[2017-03-09] Accepted ruby-zip 1.1.6-1+deb8u1 (source) into proposed-updates->stable-new, proposed-updates (Salvatore Bonaccorso)
[2017-03-03] ruby-zip 1.2.0-1.1 MIGRATED to testing (Debian testing watch)
[2017-02-28] Accepted ruby-zip 1.2.0-1.1 (source) into unstable (Salvatore Bonaccorso)
[2016-09-15] ruby-zip 1.2.0-1 MIGRATED to testing (Debian testing watch)
[2016-09-10] Accepted ruby-zip 1.2.0-1 (source) into unstable (Sruthi Chandran) (signed by: Praveen Arimbrathodiyil)
[2015-09-03] ruby-zip 1.1.7-1 MIGRATED to testing (Britney)
[2015-08-29] Accepted ruby-zip 1.1.7-1 (source amd64) into unstable (Pirate Praveen) (signed by: Praveen Arimbrathodiyil)
[2014-10-03] ruby-zip 1.1.6-1 MIGRATED to testing (Britney)
[2014-09-28] Accepted ruby-zip 1.1.6-1 (source) into unstable (David Suárez) (signed by: Antonio Terceiro)
[2014-09-05] Accepted ruby-zip 1.1.2-2 (source all) into unstable (Antonio Terceiro)
[2014-05-26] ruby-zip 1.1.2-1 MIGRATED to testing (Debian testing watch)
[2014-05-20] Accepted ruby-zip 1.1.2-1 (source amd64 all) (David Suárez) (signed by: Antonio Terceiro)

bugs [bug history graph]

all: 0

links

homepage
buildd: logs, clang, reproducibility
popcon
browse source code
edit tags
security tracker
screenshots
debci

ubuntu

[Information about Ubuntu for Debian Developers]

version: 1.2.2-1

Debian Package Tracker — Copyright 2013-2018 The Distro Tracker Developers

Report problems to the tracker.debian.org pseudo-package in the Debian BTS.

Documentation — Bugs — Git Repository — Contributing