From 033ba67e539a6109ebab8192c1ce76329ea36fcc Mon Sep 17 00:00:00 2001 From: Yi Zhao Date: Tue, 14 Sep 2021 16:57:17 +0800 Subject: ruby: Security fixes for CVE-2021-31810/CVE-2021-32066 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit CVE-2021-31810: A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes Net::FTP extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions). CVE-2021-32066: Net::IMAP does not raise an exception when StartTLS fails with an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a “StartTLS stripping attack.” References: https://www.ruby-lang.org/en/news/2021/07/07/trusting-pasv-responses-in-net-ftp/ https://www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap/ Patches from: https://github.com/ruby/ruby/commit/bf4d05173c7cf04d8892e4b64508ecf7902717cd https://github.com/ruby/ruby/commit/e2ac25d0eb66de99f098d6669cf4f06796aa6256 (From OE-Core rev: e14761916290c01683d72eb8e3de530f944fdfab) Signed-off-by: Yi Zhao Signed-off-by: Anuj Mittal Signed-off-by: Richard Purdie --- meta/recipes-devtools/ruby/ruby_3.0.1.bb | 2 ++ 1 file changed, 2 insertions(+) (limited to 'meta/recipes-devtools/ruby/ruby_3.0.1.bb') diff --git a/meta/recipes-devtools/ruby/ruby_3.0.1.bb b/meta/recipes-devtools/ruby/ruby_3.0.1.bb index 944cb81c1d..ae953a0a89 100644 --- a/meta/recipes-devtools/ruby/ruby_3.0.1.bb +++ b/meta/recipes-devtools/ruby/ruby_3.0.1.bb @@ -6,6 +6,8 @@ SRC_URI += " \ file://remove_has_include_macros.patch \ file://run-ptest \ file://0001-template-Makefile.in-do-not-write-host-cross-cc-item.patch \ + file://CVE-2021-31810.patch \ + file://CVE-2021-32066.patch \ " SRC_URI[sha256sum] = "369825db2199f6aeef16b408df6a04ebaddb664fb9af0ec8c686b0ce7ab77727" -- cgit v1.2.3-54-g00ecf