Posted By: Mikel Lindsaar
Date: 2008-04-11 01:17
Summary: [ANN] TMail 1.2.3 - Security Update - 11 Apr 2008
Project: TMail

IMPORTANT NOTE:
-------------------
This is a recommended upgrade for all TMail users of TMail version
1.0.0 or above (which includes all Rails 2.x users - see below)


Information:
-------------------
TMail is an e-mail handling library for Ruby!

TMail is the Ruby Mail handler used in the Ruby on Rails and Nitro web
frame works as well as many others (including,
the Ruby Talk mail gateway).

TMail is a gem. You can install it on any platform via:

# gem install tmail

Alternatively you can download the source code or view extra
documentation at the website:

http://tmail.rubyforge.org/


Release Summary:
------------------
This update handles a potential DOS vulnerability on any host using
TMail to handle incomming email; a crafted email with
carefully positioned whitespace can cause the TMail library to go into
an endless loop causing denial of service attack on
email services.

Ruby on Rails and Nitro users need to just do a "gem update tmail" to
get this security patch applied to their web framework.

All other users of course, just need to "gem update tmail" as well.

New release handles five tickets in the TMail tracker as well as more
documentation and more work on the moving target of Ruby 1.9's
character set Encoding/Decoding functionality.

Additionally added 7 more test cases to the library to handle the above tickets.

This should be a drop in replacement for existing TMail installations
- unless you are using TMail on Ruby 1.9, in which
case, you _might_ run into encoding problems if you are on Ruby 1.9.1,
Ruby 1.9 still works (pre January 2008 release), YMMV, any feedback on
TMail on Ruby 1.9.1 with patches is really welcome!


Release Update Details:
-------------------------

* Closed #18881 - TMail goes into an endless loop if sent an crafted
email which puts a whitespace character at position 78 of the line
to be wrapped.

* Closed #19203 - TMail errors in Ruby 1.9.1 on invalid multibyte chars.

* Closed #18814 - Fixed attchment.rb failing on mail part that had a
nil content-type - now assumes text/plain as the missing content type
and preserves the mail structure.

* Closed #18516 - Fixed TMail::Mail#preamble, and added #preamble=,
this allows you now to set and read the preamble text of an email
(the plain text that appears before any MIME encoded attachments that
you can read in any email client) (Charles Lowe)

* Closed #18515 - Removed ftools from test case to clean it up (Charles Lowe)

Bug Reports / Fixes:
----------------------

As always, we really welcome any bug reports or code for patches you
have created. Please submit anything you find through
our RubyForge tracker project which you can get to from our website:

http://tmail.rubyforge.org/


We hope you enjoy this release!


The TMail Team.

Latest News
icalendar 1.4.0 Released
    Ryan Ahearn - 2013-05-21 23:17
BinData 1.5.0 - source moved to github
    Dion Mendel - 2013-05-21 11:10
v13.5.0 Released !!
    id 774 - 2013-05-18 12:28
Runt v0.9.0 Released
    Matthew Lipper - 2013-05-17 00:11
kramdown 1.0.2 released
    Thomas Leitner - 2013-05-09 06:58

 

Forums | Admin

Discussion Forums: -ann--tmail-1.2.3---security-update---11-apr-2008

Start New Thread Start New Thread

 

Topic Topic Starter Replies Last Post