summaryrefslogtreecommitdiffstats
diff options
context:
space:
mode:
authorChee Yang Lee <chee.yang.lee@intel.com>2020-11-02 08:44:31 +0800
committerRichard Purdie <richard.purdie@linuxfoundation.org>2020-11-03 08:29:09 +0000
commit456e2b42404e46b352c6ac0d73fe9fcd594e5001 (patch)
tree58559ffcfcfce6d376ab7e2dbfb18e341ee31658
parent27a6fcbd314e7c2fc6be4266ae8a256b5714ef36 (diff)
downloadpoky-456e2b42404e46b352c6ac0d73fe9fcd594e5001.tar.gz
ruby: fix CVE-2020-25613gatesgarth-next
(From OE-Core rev: 4e02862b4fcfbf3a9cace8a35e355f156d26ed37) Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
-rw-r--r--meta/recipes-devtools/ruby/ruby/CVE-2020-25613.patch40
-rw-r--r--meta/recipes-devtools/ruby/ruby_2.7.1.bb1
2 files changed, 41 insertions, 0 deletions
diff --git a/meta/recipes-devtools/ruby/ruby/CVE-2020-25613.patch b/meta/recipes-devtools/ruby/ruby/CVE-2020-25613.patch
new file mode 100644
index 0000000000..1abcb7547e
--- /dev/null
+++ b/meta/recipes-devtools/ruby/ruby/CVE-2020-25613.patch
@@ -0,0 +1,40 @@
1From 8946bb38b4d87549f0d99ed73c62c41933f97cc7 Mon Sep 17 00:00:00 2001
2From: Yusuke Endoh <mame@ruby-lang.org>
3Date: Tue, 29 Sep 2020 13:15:58 +0900
4Subject: [PATCH] Make it more strict to interpret some headers
5
6Some regexps were too tolerant.
7
8Upstream-Status: Backport
9[https://github.com/ruby/webrick/commit/8946bb38b4d87549f0d99ed73c62c41933f97cc7]
10CVE: CVE-2020-25613
11Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
12---
13 lib/webrick/httprequest.rb | 6 +++---
14 1 file changed, 3 insertions(+), 3 deletions(-)
15
16diff --git a/lib/webrick/httprequest.rb b/lib/webrick/httprequest.rb
17index 294bd91..d34eac7 100644
18--- a/lib/webrick/httprequest.rb
19+++ b/lib/webrick/httprequest.rb
20@@ -227,9 +227,9 @@ def parse(socket=nil)
21 raise HTTPStatus::BadRequest, "bad URI `#{@unparsed_uri}'."
22 end
23
24- if /close/io =~ self["connection"]
25+ if /\Aclose\z/io =~ self["connection"]
26 @keep_alive = false
27- elsif /keep-alive/io =~ self["connection"]
28+ elsif /\Akeep-alive\z/io =~ self["connection"]
29 @keep_alive = true
30 elsif @http_version < "1.1"
31 @keep_alive = false
32@@ -508,7 +508,7 @@ def read_body(socket, block)
33 return unless socket
34 if tc = self['transfer-encoding']
35 case tc
36- when /chunked/io then read_chunked(socket, block)
37+ when /\Achunked\z/io then read_chunked(socket, block)
38 else raise HTTPStatus::NotImplemented, "Transfer-Encoding: #{tc}."
39 end
40 elsif self['content-length'] || @remaining_size
diff --git a/meta/recipes-devtools/ruby/ruby_2.7.1.bb b/meta/recipes-devtools/ruby/ruby_2.7.1.bb
index 3dd9fb0a62..f87686f6f7 100644
--- a/meta/recipes-devtools/ruby/ruby_2.7.1.bb
+++ b/meta/recipes-devtools/ruby/ruby_2.7.1.bb
@@ -6,6 +6,7 @@ SRC_URI += " \
6 file://remove_has_include_macros.patch \ 6 file://remove_has_include_macros.patch \
7 file://run-ptest \ 7 file://run-ptest \
8 file://0001-Modify-shebang-of-libexec-y2racc-and-libexec-racc2y.patch \ 8 file://0001-Modify-shebang-of-libexec-y2racc-and-libexec-racc2y.patch \
9 file://CVE-2020-25613.patch \
9 " 10 "
10 11
11SRC_URI[md5sum] = "debb9c325bf65021214451660f46e909" 12SRC_URI[md5sum] = "debb9c325bf65021214451660f46e909"