Showing posts with label rails. Show all posts
Showing posts with label rails. Show all posts

Thursday, March 14, 2019

Rails security issue (CVE 2019-5418, 2019-5419, and 2019-5420)

New versions of Rails have been released recently to address several security issues:

It is highly recommended that you upgrade Rails to the new patched versions: 4.2.11.1, 5.0.7.2, 5.1.6.2, 5.2.2.1, and 6.0.0.beta3

Bitnami is publishing updates which will be available in all formats soon.

For more details about these security issues, please check the information provided in the official Ruby On Rails blog. If you have further questions about Ruby or this security issue, please post to our community forums and we will be happy to help you.

Sunday, June 19, 2016

Introducing Bitnami Development Containers

Folks who have known me for a while, know that I love to make things easy for developers. From my days as a usability engineer on the Visual Studio team, to my pet projects, to my tutorials and samples, making programming easy and fun has been a theme of my work since 1998.

Now at Bitnami, I am happy to be working with a team who is as excited about this as I am. We have started a project that takes advantage of Docker to make developing with whatever framework you choose easy and fun. We call this project “Bitnami Development Containers.” This project is an extension of the development process that we have created for our own internal development. It only made sense to share our experience with developers everywhere.

We are in the beginning phase of the public part this project, and we are practicing the “release early and often” strategy, so let’s see what people think.

The basic idea behind the project is that if you have Docker enabled on your development machine, trying a framework should be as simple as what I affectionately call, “curling up”. That means that all you need to do is curl (download) a docker-compose file, and then run it with the docker-compose up command. After those two steps, and only those two steps, you can see your app running and start coding. It is that easy.

To accomplish this, we had to do a couple of things:
  1. First, we created custom containers that are meant specifically for developing with the frameworks of interest. These containers have an entry point that is designed to get developers going with zero configuration. We take care of all the configuration and any code generation necessary to get started.
  2. We include any necessary infrastructure and orchestrate them together using a simple docker-compose file. That means that if your framework of choice requires a database, maybe a specific database configured in a specific way, you don’t have to worry. We took care of all the work to set it up that way. You can just start coding.
So, for any framework that we support, with a development container, for example, if I wanted to write some good old Ruby on Rails code, I would just do this:

$ mkdir myrailsapp
$ cd myrailsapp
$ curl -L "https://raw.githubusercontent.com/bitnami/bitnami-docker-rails/master/docker-compose.yml" > docker-compose.yml
$ docker-compose up

Then open my browser, go to my docker-machine’s ip address at port 3000. And there’s the Rails welcome page. 

The exact same process works for Express:

$ mkdir express
$ cd express
$ curl -L "https://raw.githubusercontent.com/bitnami/bitnami-docker-express/master/docker-compose.yml" > docker-compose.yml
$ docker-compose up

Then open my browser, go to my docker-machine’s ip address at port 3000. And there’s the Express welcome page. It’s always the same simple steps.

One important thing to note is that the containers are designed to work as immutable infrastructure. By that, I mean, none of the code that is generated or that you write is on the container. Rather, it is also mounted in a volume. That is important because it means that the containers support easy reproducibility. So, if you change some code, you can check in that code, and someone else can check it out, and docker-compose up just works with the existing code.

Ok, let’s just try it. I heard about Laravel. My team says it's pretty cool, but I never really knew what it was. So, I am going to using Bitnami’s Development Container to quickly get started with it.

First thing, I will create a directory for the application that I will write. Then I will download the docker-compose file into that dir. Again, the same simple steps, “curl up.”

$ mkdir laravel
$ cd laravel
$ curl -L "https://raw.githubusercontent.com/bitnami/bitnami-docker-laravel/master/docker-compose.yml" > docker-compose.yml



That went fast, so let’s take a look:

$ cat docker-compose.yml



Ok, that is a nice and simple file. I can see that I am going to get a copy of MariaDB along with it. That’s handy, since as far as I can tell, Laravel and MariaDB go together like peanut butter and jelly. Note also that the port is already mapped for me.

Finally, note that it mounts a volume called “./app”. This is very important and interesting. What this means is that the application code that is generated and that I will modify is NOT in the container, but rather right on my desktop. This is how we achieve the immutability I mentioned above. This way, besides being easy to manage with source control, it is also trivially easy to edit with my desktop editor.

So, I curled, now I up. Of course, make sure that Docker is running before you do this:

$ docker-compose up




The first time I run this, Docker will download the images first. Then it will start the containers.



Looks like the container is started. Let’s check out the app.

First, I’ll check the ip address of my Docker VM:

$ docker-machine ip

Now that I have that, I can navigate to port 3000. Port 3000 is a typical port for development web servers to run on. I could also tell I needed to port 3000 from the docker-compose file.




It works! Let’s pause for a moment and consider how cool this is. In a matter of minutes I went from having an empty Docker environment to having a running Laravel 5 app. And I’ve never used Laravel before.

Of course, the first thing I want to do is to change the default to prove to myself that I have some control over the content.

Because this is my first experience with Laravel and I know almost nothing about it, I will have to poke around a bit. I’ll just guess that the string displayed in the default web page will help me out, so I will start with a recursive grep.

$ grep "Laravel 5" -R ./



That “welcome.blade.php” file looks like a promising start for making my first change. Keep in mind, I have never even written PHP code, much less Lavarel code. But, I love to learn by doing, so I am just going to dive in with my editor and see if I can make a change.




And …




Yup! It’s that easy. Within minutes, I have made a change!

Let’s take another look at my Mac’s directory:



As I mentioned before, you can see that the application code is on my development machine, NOT in the container. Furthermore, the docker-compose.yml file that sets up the development environment is in the same directory. That means I can easily commit this directory and share it. Anyone could check it out from source control, and run $ docker-compose up, and end up with the exact same environment. So, a team of developers could easily use the Bitnami Development Containers to collaborate on projects, and easily stay in sync with both the development environment and the code.

Today we have 3 development frameworks ready. Rails, Express, and Laravel, with more on the way. Please try them out and give us feedback. And please let us know what other frameworks you think we should do next! You can reach us at containers@bitnami.com.

- Rick Spencer, Bitnami VP of Engineering

Saturday, December 19, 2015

New Bitnami Ruby Stacks

We have just released new versions of the Bitnami Ruby stack, which fixes the CVE-2015-7551 security issue in all of the versions below.

  • Ruby 2.0.0-p648 
  • Ruby 2.1.8 
  • Ruby 2.2.4 

In case you are not familiar with the Bitnami Ruby Stack, it includes the base Ruby runtime/libraries, and the most popular gems for building Rails applications such as Passenger, Nokogiri, Rake, RMagick, Thin and more. It also includes the latest stable versions of Rails, Apache, Nginx, MySQL, PostgreSQL, SQLite, Git, Sphinx, PHP, phpMyAdmin and phpPgAdmin.

We have released new versions of the Bitnami Ruby Stack native installers for Linux, OS X, Windows, virtual machines and cloud images for Amazon EC2, Google Compute Engine, Microsoft Azure, vCloud Air, Digital Ocean and Oracle cloud platform.

If you have any question about Bitnami RubyStack you can check our quick start guide or you can create a new post in our community forums.


Friday, April 17, 2015

Security fix for Ruby: new versions 2.2.2 and 2.0.0-p645 released

The Ruby project has just released new versions that fix the CVE-2015-1855 Ruby OpenSSL Hostname Verification security issue. You can find more information about these issues on Ruby’s blog post.

We have released Bitnami Ruby installers, virtual machines and Amazon EC2, Google Compute Engine and Windows Azure cloud images with Ruby 2.2.2 and 2.0.0-p645 versions, and we will continue working on the release of the Ruby 2.1.6 version also. 

Tuesday, January 13, 2015

New Bitnami Ruby Stack with Ruby 2.2.0 and Rails 4.2.0

We are happy to announce that we have just released the Bitnami Ruby Stack with Ruby 2.2.0 and Rails 4.2.0. It is completely self-contained and will not conflict with your current development environment. You can download it, give it a try and safely remove it when you are done.

If you are not familiar with the Bitnami Ruby Stack, it is a free package that simplifies the development and deployment of Ruby on Rails applications. This version includes ready-to-run versions of Apache 2.4.10, MySQL 5.5.40, PostgreSQL 9.3.5, Ruby 2.2.0 and Rails 4.2.0. It also includes RVM, NGINX, Passenger, Git, Redis, Node.js and all required dependencies.

Bitnami Ruby Stack can be deployed using all-in-one free native installers (for Linux and Mac OS X), virtual machines and the most popular public cloud providers: Amazon EC2, Microsoft Azure and Google Compute Engine.
The main changes in the new Ruby 2.2.0 are the following:
  • Ruby’s Garbage Collector is now able to collect Symbol type objects. This reduces memory usage of Symbols
  • Experimental support for using vfork(2) with system() and spawn() have also been added. This could potentially bring huge speed-up when a large process executes external commands many times
  • Additional option for configure.in to use jemalloc. This feature is still experimental and currently deactivated by default
This version includes new features and improvements but it has a few compatibility issues as well. You can find a list of changes in the Ruby repository.

Get started with Ruby on Rails with Bitnami Ruby Stack 2.2.0 in your local machine or in the cloud now!

Sunday, November 16, 2014

New Bitnami Ruby stacks released with Ruby 2.1.5, 2.0.0-p598 and 1.9.3-p551

We recently released new versions of Ruby stacks that fix several security issues. An additional fix for DoS vulnerability CVE-2014-8090 has been released for all Ruby versions.

We have released new versions of Bitnami Ruby Stack native installers for Linux and OS X, virtual machines and cloud images for Amazon EC2, Google Compute Engine and Microsoft Azure.

- Ruby Stack 2.1.5: with Ruby 2.1.5 and Rails 4.1.7
- Ruby Stack 2.0.0-23: with Ruby 2.0.0-p598 and Rails 4.1.7
- Ruby Stack 1.9.3-27: with Ruby 1.9.3-p551 and Rails 3.2.20

We continue working on upgrading Ruby versions for Windows that will be released soon.

In case you are not familiar with Ruby Stack, in addition to the base Ruby runtime and libraries, the stack includes the most popular gems for building Rails applications: Passenger, Nokogiri, Rake, RMagick, Thin and more. It also includes the latest stable version of RVM, Rails, Apache, Nginx, MySQL, PostgreSQL, SQLite, Git, Sphinx, PHP, phpMyAdmin and phpPgAdmin.


If you have any question about Bitnami RubyStack you can check our quick start guide or you can create a new post in our community forums.

Tuesday, November 4, 2014

New Ruby stacks with latest Ruby and Rails versions

New versions of Ruby and Rails have been released recently that address several security issues:

- Rails: CVE-2014-7818
- Rails: CVE-2014-7819
- Ruby: CVE-2014-8080
- Ruby: Changed default settings of ext/openssl

If you are using Ruby stack for deploying your application, we strongly suggest to upgrade Rails to the latest version. We have released new versions of Ruby Stack native installers (all platforms), virtual machines and cloud images for the following platforms:

- Ruby Stack 2.0.0: with Ruby 2.0.0-p594 and Rails 4.1.7
- Ruby Stack 2.1.4: with Ruby 2.1.4 and Rails 4.1.7

We continue working on the new Ruby 1.9.3-p550 version with the latest Rails 3.2.20 that will be released soon.

In addition to the base Ruby runtime and libraries, the stack includes the most popular gems for building Rails applications: Passenger, Nokogiri, Rake, RMagick, Thin and more. It also includes the latest stable release of Ruby, RVM, Rails, Apache, Nginx, MySQL, PostgreSQL, SQLite, Git, Sphinx, PHP, phpMyAdmin and phpPgAdmin.

If you have any question about Bitnami RubyStack you can check our quick start guide or you can create a new thread in our community forums.

Thursday, September 18, 2014

New RubyStack version in Bitnami Library

We are happy to announce that we have updated our Bitnami RubyStacks (2.0.0-20 and 2.1.2-3) to the latest versions of Passenger, Node.js, PHP and Nginx, among others.

If you are not familiar with it, Bitnami RubyStack provides a fully-configured and ready to run Ruby on Rails development environment. You can download or deploy it to the cloud free of charge with our ready-to-run installers, virtual machine images (VMs), Amazon Machine Images (AMIs) or Azure Images

In addition to the base Ruby runtime and libraries, the stack includes the most popular gems for building Rails applications: Passenger, Nokogiri, Rake, RMagick, Mongrel, Thin and more. It also includes the latest stable release of Ruby, RVM, Rails, Apache, NGinx, MySQL, SQLite, Git, Varnish, Sphinx, PHP and phpMyAdmin.

All updates to this development stack are listed in it's changelog, but below are the main components:
  • Updated Passenger to 4.0.50
  • Updated Node.js to 0.10.31
  • Updated PHP to 5.4.32
  • Updated Nginx to 1.6.1
If you have any question about Bitnami RubyStack you can check our quick start guide or you can create a new thread in our community forums .

Thursday, May 8, 2014

New Ruby Stack with Rails 3.2.18 and 4.1.1 released

We are happy to announce a new release of all Bitnami Ruby Stack versions:

- 1.9.3-24: With Ruby 1.9.3-p545 and Rails 3.2.18
- 2.0.0-14: With Ruby 2.0.0-p451 and Rails 4.1.1
- 2.1.1-2: With Ruby 2.1.1 and Rails 4.1.1

These Rails versions contain a fix for the security issue described in CVE-2014-0130.

Bitnami Ruby Stack provides a complete development environment for Ruby on Rails that can be deployed with one click. It includes the latest stable release of Ruby, RVM, Rails, Apache, NGinx, MySQL, SQLite, Git, Varnish, Sphinx, PHP and phpMyAdmin. In addition to the base Ruby runtime and libraries, the stack includes most popular gems for building Rails applications: Passenger, Nokogiri, Rake, RMagick, Mongrel, Thin and more.

You can download installers for Windows, OS X or Linux, virtual machines or deploy pre-made Amazon EC2 and Azure cloud images.

If you have already installed a previous version, please make sure you update the Rails gems to a fixed version.

Thursday, February 20, 2014

Security fix for Rails: 3.2.17 and 4.0.3 released

http://bitnami.com/stack/ruby
New versions of Rails has been released recently that address several security issues:

- CVE-2014-0081 XSS Vulnerability in number_to_currency, number_to_percentage and number_to_human.
- CVE-2014-0080 Data Injection Vulnerability in Active Record.
- CVE-2014-0082 Denial of Service Vulnerability in Action View when using render text.

If you are using Ruby stack for deploying your application, we strongly suggest to upgrade Rails to the latest version. We have released new versions of Ruby Stack native installers (all platforms), virtual machines and Amazon EC2 and Azure cloud images for the following platforms:
  • Ruby Stack 1.9.3, with Ruby 1.9.3-p484 and Rails 3.2.17
  • Ruby Stack 2.0.0, with Ruby 2.0.0-p353 and Rails 4.0.3
  • Ruby Stack 2.1.0, with Ruby 2.1.0 and Rails 4.0.3
Because one of the security issues affects PostgreSQL databases, we also released a new version of the Bitnami Discourse application which includes a fixed version or Rails.

Thursday, December 5, 2013

Rails security issue: Bitnami apps updated

http://bitnami.com/stack/ruby
Several important Rails security vulnerabilities were recently published. They affect the current 3.2 and 4.0 versions of the Rails framework. You can find more info about them at this Rails blog post.

If you are using Bitnami Ruby Stack, it is recommended that you upgrade Rails to the new patched versions: 3.2.16 or 4.0.2. We just released new versions of the installers, virtual machines and Amazon EC2 or Azure cloud images that ship the updated Rails versions:

- Ruby Stack 1.9.3,   with Ruby 1.9.3-p484 and Rails 3.2.16
- Ruby Stack 2.0.0,   with Ruby 2.0.0-p353 and Rails 4.0.2
- Ruby Stack 2.0.1preview2,   with Ruby 2.0.1preview2 and Rails 4.0.2

We have released updated Redmine, GitLab, Spree, Tracks, Gitorious stacks with the latest Rails version and will shortly release new versions of Discourse, Publify and Diaspora.

For more details about these security issues please check the information provided in the official Ruby On Rails blog. If you already have installed a version of these applications please make sure that you update your environment or apply the appropriate patches.

Thursday, November 21, 2013

Diaspora*, the Online Social World Where You are in Control

Diaspora* is an Open Source distributed social networking service. It was released as part of the BitNami Library a month ago.

You can now download free, ready to run native installers for OS X and Linux, virtual machines and Azure and Amazon EC2 images for Diaspora*. You can also now launch a free cloud demo server with the BitNami Cloud Launchpad by clicking the launch button below.




Jason Robinson, one of the Diaspora* project contributors, was kind enough to answer some questions for those of you who may not be familiar with the project.

1. What is the goal of the Diaspora* application?

The goal of the Diaspora* application is to allow people to control their own social network. A lot of people distrust the large centralized social networks, especially now after all the Prism revelations. With Diaspora*, users can host their own data and only share around the network parts of that data. We call these servers "pods". When a user installs a pod (for example using the BitNami packages), that pod will be able to communicate with users on other pods just like you can communicate with other users on Facebook for example. The difference is that the user hosts their own data and thus has more control.

The purpose does not end in privacy. An important thing to note is of course that Diaspora* is open source. Got coding skills and miss a feature in your favourite social network? With Diaspora* you can make that feature - just talk to the project first if you also want it merged into the main code base https://wiki.diasporafoundation.org/How_we_communicate

Of course you don't need to host a pod to join Diaspora*. Just go to http://podupti.me which is a good pod list, select a pod near you and sign up!

Diaspora* dashboard



2. What are some of the features of Diaspora*?


The most awesome feature that sets Diaspora* apart from the other social networks is the flexibility when composing posts. Posts support full markdown syntax, which means you can even use it for blogging (like Tumblr). Another distinctive feature is that there are different kind of streams that you can view - and by default all the streams are combined for easy of use. Streams can be posts from people you follow, posts with followed hashtags, posts with interactions (like mentions), and you can also group people into Aspects (like Circles in G+) and view only one or more streams at a time. Image uploads in posts are supported with a nice lightbox style picture viewer.

All in all the UI is very modern and nice to use for a user with any technical level. Unlike Facebook for example, it is more minimal, since Diaspora* doesn't make you "spy" on your friends activities in real time, we don't have a gazillion of apps posting in your feed, and of course there are no ads or promoted posts, only stuff you really want to see.

3. Which projects or organizations are using Diaspora* currently? What kind of projects do they use it for?


Since Diaspora* is decentralized, which means that there is no central pod and no central authority to govern the network, the project does not and cannot be aware of all Diaspora* installations. I've heard of and seen some company internal pods that the rest of the network never becomes aware of since the users on the pod don't (or cannot due to firewalls) share data outside their own pod. One list of pods, built from interactions by the pod maintainer, lists currently 101 Diaspora* pods https://diapod.net/active, of which over half are open for sign ups.

Some notable organizations having official Diaspora* accounts are Mozilla (fr), KDE community, Jolla, FairPhone, Loomio, LibreOffice Design, ownCloud and Kolab, to name a few.

4. What do you expect will be the main benefits of having BitNami packages available for Diaspora*?

Diaspora* is kind of tricky to install at the moment - well, before BitNami that is. We have well documented installation instructions for all major Linux platforms, but unfortunately following those still requires you are familiar with web applications and servers. With BitNami users who want to host their pod can do so easily without hassle, and that is great indeed. The best thing is that users have more choice now, and we will be striving to increase those choices.

We are glad Diaspora* is now part of BitNami. Would you like your favorite app to be part of BitNami? Be sure to suggest and vote for it in our contest!

Wednesday, September 18, 2013

Ruby Stack: Now streamlined with PostgreSQL and Node.js options


We are excited to announce a new version of BitNami Ruby Stack!

Ruby Stack is a self-contained, easy to use distribution that makes it simple to get started developing and deploying Ruby On Rails applications. To get started with BitNami Ruby Stack, you can download free, ready-to-run installers for Linux,Windows and Mac OS X, virtual machine images (VMs) and cloud images for the Amazon and Azure clouds.

This release adds PostgreSQL as a database server option. The release also optionally installs the Node.js runtime as part of your development environment.

Another great new feature in the native installers is the option to customize your environment by installing only the components that you plan to use so that you may have the minimal Ruby environment you need for web development.

BitNami Ruby Stack includes Apache, Nginx, MySQL, SQLite, PostgreSQL, ImageMagick, Passenger, Thin, Redis, Varnish Cache server, Sphinx, RVM, DevKit, Subversion, Git, etc. It also includes Node.js and PHP as additional runtimes.

With Ruby Stack, you can now select which web and database servers you want to use. If you choose, you can install phpMyAdmin and/or phpPgAdmin applications to manage your database server. You may want to install additional components like a version control and source code management tool like Subversion or Git, a cache server like Varnish, a search server like Sphinx or a data structure server like Redis.

Ruby Stack is an all-in-one package that provides everything that you need to get started with Ruby development, while letting you choose only the components you want.





Friday, May 31, 2013

Ruby 2.0 development environment for Windows

We are glad to announce a new release of BitNami Ruby 2.0 Stack, which is focused on improved Windows support.  

BitNami Ruby Stack provides a complete, self-contained development environment for Ruby on Rails for Linux, Windows and Mac OS X. We offer one-click packages for each Ruby 1.8, Ruby 1.9 and Ruby 2.0.

BitNami Ruby 2.0 for Windows
BitNami Ruby 2.0 for Windows

With the latest version of Ruby in this package you can find the latest version of Rails. In order to avoid frustration when installing gems that require compilation,  we also include pre-compiled version of the most common gems like thin, eventmachine, mysql2, sqlite3 and rmagick. This is specially interesting on Windows when you don't always have a compilation environment set up. In any case, we also include DevKit on Windows in case you want to use other gems that need to be compiled.

Together with the minimum Ruby on Rails environment we include other components that you will likely use when developing a RoR application. On our Windows version you can find:
  • Apache HTTP Server and thin and eventmachine pre-compiled gems for web deployment. 
  • Databases: Sqlite3 and MySQL databases together with sqlite3 and mysql2 pre-compiled gems. 
  • phpMyAdmin for MySQL administration.
  • A graphical manager tool for managing the servers.
  • ImageMagick and rmagick gem for image conversion.
  • Source version control systems: Subversion and Git
In Linux version you also find NGINX web server and Varnish a web application accelerator. Apache is working with Pushion Passenger by default in this flavor.

You can take a look at our documentation to learn more about how to use BitNami Ruby Stack.

Tuesday, April 30, 2013

Performance enhancements for Ruby-based stacks in BitNami

We have been steadily working on releasing new applications for our BitNami Library. We have also been investigating new configurations and optimizations to improve the performance of existing ones.

As part of this work we have just released new versions of Ruby Stack, DiscourseRedmine or GitLab with several performance improvements, detailed below:

We added the popular Falcon patches by default, which also include the Greg Price's patch for speedup. These fixes significantly reduce application startup time for Rails-based apps.

To test this improvement, we tested Discourse in an Ubuntu 64 bit small instance in Amazon EC2:

$ time -p bin/rake environment RAILS_ENV=production

Ruby 1.9.3-p392:  69.60 secs
Ruby 1.0.3-p392 + Falcon patches: 22.47 secs


We are also adding specific settings for improving per-application performance. Discourse developers have noticed slowdowns related to Garbage Collection. We configured the BitNami Discourse stack to increase the GC limit to 90 MBs.

We have released a new version of Ruby for Windows that ships similar performance patches. The Code Shop group already implemented these patches for Windows and using this new Ruby version, Redmine starts almost 30% faster for this platform.

In addition to that, we updated the Bundler gem to the latest 3.1.5 version for all the Ruby-based stacks, which is much faster than the previous versions. Now you can run "bundle update" in a few seconds.

If you have additional suggestions on how we can improve the performance of BitNami apps, please let us know!





Monday, February 25, 2013

The easiest way to test Ruby 2.0

Yesterday, the first stable version of Ruby 2.0 series was released. The date for this major release was carefully chosen by the Ruby development team to be Ruby's birthday, now turning 20 years old! We wanted to join this celebration by doing what we do best. Our present: providing you with the the easiest way to test Ruby 2.0 :)

Bitnami Rubystack provides free, all-in-one installers for Windows, OS X and Linux, virtual machines and Amazon machine images that provide a self-contained Ruby environment. It includes the Ruby runtime (of course!), Rails and a bunch of other commonly used third-party libraries and servers such as Rails, RVM, Imagemagick, MySQL, etc.  The packages will not interfere with your existing development environment and you can easily add/remove them at will. In fact, one of the preferred use cases for our stacks is to quickly test new versions of popular open source apps

Give it a try!

Wednesday, February 20, 2013

New security fix for Rails

A new Rails security issue that affects all Rails versions (3.2.x, 3.1.x and 2.3.x) was recently announced, as well as a new JSON gem version that contains an important security fix.

We have updated all Ruby-based stacks in BitNami:


             

        


For more details about these security issues please check the information provided in the official Ruby On Rails blog. If you already have installed a version of these applications please make sure that you update your environment or apply the appropriate patches.

Thursday, January 31, 2013

New security fix for Rails 2.3.x. Applications updated on BitNami

A new Rails security issue that affects older versions of Rails (2.3.x and 3.0.x) was recently announced. This is a vulnerability related to the JSON parser code for Ruby on Rails with allows attackers to bypass authentication systems, inject arbitrary SQL or inject and execute arbitrary code.

We have released RubyStack 1.8, Redmine 1.4.x, Radiant, Gitorious and Tracks with the latest Rails v2.3.16 that fixes this issue. Note that if you are using an application that ships Rails 3.2.11, it is not affected by this issue.

We are also removing older versions of BitNami Rails apps published on the Windows Azure and Amazon Cloud catalog and marketplace and that may be vulnerable to these security issues.

For more details about these security issues please check the information provided in the official Ruby On Rails blog. If you already have installed a version of these applications please make sure that you update your environment or apply the appropriate patches.


Thursday, January 24, 2013

First Release Candidate for Ruby 2.0 Available in BitNami

With the release of Ruby 2.0.0 planned for February 24th, you may want to test out Ruby 2.0.0rc1, the first release candidate for this version, and test if your projects are ready for it. In order to simplify this task for you, we have just released BitNami Ruby Stack with ruby 2.0.0rc1. It is completely self-contained and will not conflict with your current development environment. You can download it, give it a try and safely remove it when you are done.

This version includes new features and improvements but it includes a few compatibility issues as well. You can find a list of changes in the Ruby repository.

If you are not familiar with BitNami Ruby Stack, it is a free package that simplifies the development and deployment of Ruby on Rails applications. This version includes ready-to-run versions of Apache 2.2.23, MySQL 5.5.29, Ruby 2.0.0rc1 and Rails 3.2.11. It also includes RVM 1.13.6, NGinx 1.2.4, Passenger 3.0.17, SQLite 3.7.10, Git 1.7.11.3 and all required dependencies.

BitNami RubyStack can be deployed using all-in-one free native installers (for Linux and Mac OS X), virtual machines and Amazon Cloud Images as always and we are happy to add Windows Azure as an additional Cloud platform. If you are not familitar with this platform yet, check our Getting Started guide to learn how easy it is to run BitNami applications through the Windows Azure management console.



Thursday, January 10, 2013

Important Security fix: Rails applications updated on BitNami

In the last two days several patches for Rails have been released in order to address extremely critical security issues. We want to let BitNami users know that all our Rails-based application installers, virtual machines and cloud images have been already updated and released.

Redmine, Spree, Typo, Radiant, Gitorious and Tracks and other Ruby on Rails based projects are already releasing new versions to provide fixes to those security issues. We did not want to wait and we already released patched versions of these applications. We will be upgrading those to officially released versions once available.

We have also updated our Ruby Stack to include the latest version of Rails.

We are also removing older versions of BitNami Rails apps published on the Amazon Cloud catalog and marketplace and that may be vulnerable to these security issues.

For more details about these security issues please check the information provided in the official Ruby On Rails blog. If you already have installed a version of these applications please make sure that you update your environment or apply the appropriate patches.