diff options
author | Chee Yang Lee <chee.yang.lee@intel.com> | 2020-11-02 08:44:31 +0800 |
---|---|---|
committer | Richard Purdie <richard.purdie@linuxfoundation.org> | 2020-11-03 08:29:09 +0000 |
commit | 456e2b42404e46b352c6ac0d73fe9fcd594e5001 (patch) | |
tree | 58559ffcfcfce6d376ab7e2dbfb18e341ee31658 | |
parent | 27a6fcbd314e7c2fc6be4266ae8a256b5714ef36 (diff) | |
download | poky-456e2b42404e46b352c6ac0d73fe9fcd594e5001.tar.gz |
ruby: fix CVE-2020-25613gatesgarth-next
(From OE-Core rev: 4e02862b4fcfbf3a9cace8a35e355f156d26ed37)
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r-- | meta/recipes-devtools/ruby/ruby/CVE-2020-25613.patch | 40 | ||||
-rw-r--r-- | meta/recipes-devtools/ruby/ruby_2.7.1.bb | 1 |
2 files changed, 41 insertions, 0 deletions
diff --git a/meta/recipes-devtools/ruby/ruby/CVE-2020-25613.patch b/meta/recipes-devtools/ruby/ruby/CVE-2020-25613.patch new file mode 100644 index 0000000000..1abcb7547e --- /dev/null +++ b/meta/recipes-devtools/ruby/ruby/CVE-2020-25613.patch | |||
@@ -0,0 +1,40 @@ | |||
1 | From 8946bb38b4d87549f0d99ed73c62c41933f97cc7 Mon Sep 17 00:00:00 2001 | ||
2 | From: Yusuke Endoh <mame@ruby-lang.org> | ||
3 | Date: Tue, 29 Sep 2020 13:15:58 +0900 | ||
4 | Subject: [PATCH] Make it more strict to interpret some headers | ||
5 | |||
6 | Some regexps were too tolerant. | ||
7 | |||
8 | Upstream-Status: Backport | ||
9 | [https://github.com/ruby/webrick/commit/8946bb38b4d87549f0d99ed73c62c41933f97cc7] | ||
10 | CVE: CVE-2020-25613 | ||
11 | Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> | ||
12 | --- | ||
13 | lib/webrick/httprequest.rb | 6 +++--- | ||
14 | 1 file changed, 3 insertions(+), 3 deletions(-) | ||
15 | |||
16 | diff --git a/lib/webrick/httprequest.rb b/lib/webrick/httprequest.rb | ||
17 | index 294bd91..d34eac7 100644 | ||
18 | --- a/lib/webrick/httprequest.rb | ||
19 | +++ b/lib/webrick/httprequest.rb | ||
20 | @@ -227,9 +227,9 @@ def parse(socket=nil) | ||
21 | raise HTTPStatus::BadRequest, "bad URI `#{@unparsed_uri}'." | ||
22 | end | ||
23 | |||
24 | - if /close/io =~ self["connection"] | ||
25 | + if /\Aclose\z/io =~ self["connection"] | ||
26 | @keep_alive = false | ||
27 | - elsif /keep-alive/io =~ self["connection"] | ||
28 | + elsif /\Akeep-alive\z/io =~ self["connection"] | ||
29 | @keep_alive = true | ||
30 | elsif @http_version < "1.1" | ||
31 | @keep_alive = false | ||
32 | @@ -508,7 +508,7 @@ def read_body(socket, block) | ||
33 | return unless socket | ||
34 | if tc = self['transfer-encoding'] | ||
35 | case tc | ||
36 | - when /chunked/io then read_chunked(socket, block) | ||
37 | + when /\Achunked\z/io then read_chunked(socket, block) | ||
38 | else raise HTTPStatus::NotImplemented, "Transfer-Encoding: #{tc}." | ||
39 | end | ||
40 | elsif self['content-length'] || @remaining_size | ||
diff --git a/meta/recipes-devtools/ruby/ruby_2.7.1.bb b/meta/recipes-devtools/ruby/ruby_2.7.1.bb index 3dd9fb0a62..f87686f6f7 100644 --- a/meta/recipes-devtools/ruby/ruby_2.7.1.bb +++ b/meta/recipes-devtools/ruby/ruby_2.7.1.bb | |||
@@ -6,6 +6,7 @@ SRC_URI += " \ | |||
6 | file://remove_has_include_macros.patch \ | 6 | file://remove_has_include_macros.patch \ |
7 | file://run-ptest \ | 7 | file://run-ptest \ |
8 | file://0001-Modify-shebang-of-libexec-y2racc-and-libexec-racc2y.patch \ | 8 | file://0001-Modify-shebang-of-libexec-y2racc-and-libexec-racc2y.patch \ |
9 | file://CVE-2020-25613.patch \ | ||
9 | " | 10 | " |
10 | 11 | ||
11 | SRC_URI[md5sum] = "debb9c325bf65021214451660f46e909" | 12 | SRC_URI[md5sum] = "debb9c325bf65021214451660f46e909" |