rpms/ruby/F-12 ruby-1.8.6-p383-mkmf-use-shared.patch, NONE, 1.1 ruby-1.8.6.x-CVE-2009-4492.patch, NONE, 1.1 ruby.spec, 1.144, 1.145
Mamoru Tasaka
mtasaka at fedoraproject.org
Tue Jan 12 19:02:42 UTC 2010
Author: mtasaka
Update of /cvs/extras/rpms/ruby/F-12
In directory cvs1.fedora.phx.redhat.com:/tmp/cvs-serv23009/F-12
Modified Files:
ruby.spec
Added Files:
ruby-1.8.6-p383-mkmf-use-shared.patch
ruby-1.8.6.x-CVE-2009-4492.patch
Log Message:
* Wed Jan 13 2010 Mamoru Tasaka <mtasaka at ioa.s.u-tokyo.ac.jp> - 1.8.6.383-6
- CVE-2009-4492 ruby WEBrick log escape sequence (bug 554485)
ruby-1.8.6-p383-mkmf-use-shared.patch:
mkmf.rb | 2 +-
1 file changed, 1 insertion(+), 1 deletion(-)
--- NEW FILE ruby-1.8.6-p383-mkmf-use-shared.patch ---
--- ruby-1.8.6-p383/lib/mkmf.rb.static 2009-03-31 18:19:39.000000000 +0900
+++ ruby-1.8.6-p383/lib/mkmf.rb 2009-12-09 15:03:19.000000000 +0900
@@ -275,7 +275,7 @@
'LDFLAGS' => "#$LDFLAGS #{ldflags}",
'LIBPATH' => libpathflag(libpath),
'LOCAL_LIBS' => "#$LOCAL_LIBS #$libs",
- 'LIBS' => "#$LIBRUBYARG_STATIC #{opt} #$LIBS")
+ 'LIBS' => "#$LIBRUBYARG_SHARED #{opt} #$LIBS")
Config::expand(TRY_LINK.dup, conf)
end
ruby-1.8.6.x-CVE-2009-4492.patch:
accesslog.rb | 12 ++++++++++--
httprequest.rb | 6 +-----
httpresponse.rb | 2 +-
httpstatus.rb | 31 ++++++++++++++++++-------------
httputils.rb | 4 ++--
5 files changed, 32 insertions(+), 23 deletions(-)
--- NEW FILE ruby-1.8.6.x-CVE-2009-4492.patch ---
Index: lib/webrick/httpstatus.rb
===================================================================
--- lib/webrick/httpstatus.rb (revision 26273)
+++ lib/webrick/httpstatus.rb (revision 26274)
@@ -12,7 +12,17 @@
module HTTPStatus
- class Status < StandardError; end
+ class Status < StandardError
+ def initialize(message=self.class, *rest)
+ super(AccessLog.escape(message), *rest)
+ end
+ class << self
+ attr_reader :code, :reason_phrase
+ end
+ def code() self::class::code end
+ def reason_phrase() self::class::reason_phrase end
+ alias to_i code
+ end
class Info < Status; end
class Success < Status; end
class Redirect < Status; end
@@ -68,6 +78,7 @@
CodeToError = {}
StatusMessage.each{|code, message|
+ message.freeze
var_name = message.gsub(/[ \-]/,'_').upcase
err_name = message.gsub(/[ \-]/,'')
@@ -79,18 +90,12 @@
when 500...600; parent = ServerError
end
- eval %-
- RC_#{var_name} = #{code}
- class #{err_name} < #{parent}
- def self.code() RC_#{var_name} end
- def self.reason_phrase() StatusMessage[code] end
- def code() self::class::code end
- def reason_phrase() self::class::reason_phrase end
- alias to_i code
- end
- -
-
- CodeToError[code] = const_get(err_name)
+ const_set("RC_#{var_name}", code)
+ err_class = Class.new(parent)
+ err_class.instance_variable_set(:@code, code)
+ err_class.instance_variable_set(:@reason_phrase, message)
+ const_set(err_name, err_class)
+ CodeToError[code] = err_class
}
def reason_phrase(code)
Index: lib/webrick/httprequest.rb
===================================================================
--- lib/webrick/httprequest.rb (revision 26273)
+++ lib/webrick/httprequest.rb (revision 26274)
@@ -242,11 +242,7 @@
@raw_header << line
end
end
- begin
- @header = HTTPUtils::parse_header(@raw_header)
- rescue => ex
- raise HTTPStatus::BadRequest, ex.message
- end
+ @header = HTTPUtils::parse_header(@raw_header.join)
end
def parse_uri(str, scheme="http")
Index: lib/webrick/httpresponse.rb
===================================================================
--- lib/webrick/httpresponse.rb (revision 26273)
+++ lib/webrick/httpresponse.rb (revision 26274)
@@ -132,7 +132,7 @@
end
end
- # Determin the message length (RFC2616 -- 4.4 Message Length)
+ # Determine the message length (RFC2616 -- 4.4 Message Length)
if @status == 304 || @status == 204 || HTTPStatus::info?(@status)
@header.delete('content-length')
@body = ""
Index: lib/webrick/httputils.rb
===================================================================
--- lib/webrick/httputils.rb (revision 26273)
+++ lib/webrick/httputils.rb (revision 26274)
@@ -128,11 +128,11 @@
when /^\s+(.*?)\s*\z/om
value = $1
unless field
- raise "bad header '#{line.inspect}'."
+ raise HTTPStatus::BadRequest, "bad header '#{line}'."
end
header[field][-1] << " " << value
else
- raise "bad header '#{line.inspect}'."
+ raise HTTPStatus::BadRequest, "bad header '#{line}'."
end
}
header.each{|key, values|
Index: lib/webrick/accesslog.rb
===================================================================
--- lib/webrick/accesslog.rb (revision 26273)
+++ lib/webrick/accesslog.rb (revision 26274)
@@ -53,15 +53,23 @@
when ?e, ?i, ?n, ?o
raise AccessLogError,
"parameter is required for \"#{spec}\"" unless param
- params[spec][param] || "-"
+ param = params[spec][param] ? escape(param) : "-"
when ?t
params[spec].strftime(param || CLF_TIME_FORMAT)
when ?%
"%"
else
- params[spec]
+ escape(params[spec].to_s)
end
}
end
+
+ def escape(data)
+ if data.tainted?
+ data.gsub(/[[:cntrl:]\\]+/) {$&.dump[1...-1]}.untaint
+ else
+ data
+ end
+ end
end
end
Index: ruby.spec
===================================================================
RCS file: /cvs/extras/rpms/ruby/F-12/ruby.spec,v
retrieving revision 1.144
retrieving revision 1.145
diff -u -p -r1.144 -r1.145
--- ruby.spec 29 Oct 2009 16:39:31 -0000 1.144
+++ ruby.spec 12 Jan 2010 19:02:41 -0000 1.145
@@ -16,7 +16,7 @@
Name: ruby
Version: %{rubyver}%{?dotpatchlevel}
-Release: 4%{?dist}
+Release: 6%{?dist}
License: Ruby or GPLv2
URL: http://www.ruby-lang.org/
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
@@ -53,8 +53,11 @@ Patch28: ruby-1.8.6-p287-remove-s
Patch29: ruby-always-use-i386.patch
Patch30: ruby-openssl-1.0.patch
Patch31: ruby-1.8.6-p369-ri-gem_multipath.patch
-# Patch from ruby_1_8 branch
+# Patch32 from ruby_1_8 branch
Patch32: ruby-1.8head-irb-save-history.patch
+Patch33: ruby-1.8.6-p383-mkmf-use-shared.patch
+# Patch34 already applied in 1.8.6p388
+Patch34: ruby-1.8.6.x-CVE-2009-4492.patch
Summary: An interpreter of object-oriented scripting language
Group: Development/Languages
@@ -85,12 +88,20 @@ This package includes the libruby, neces
Summary: A Ruby development environment
Group: Development/Languages
Requires: %{name}-libs = %{version}-%{release}
-Provides: %{name}-libs-static = %{version}-%{release}
+#Provides: %{name}-libs-static = %{version}-%{release}
%description devel
Header files and libraries for building a extension library for the
Ruby or an application embedded Ruby.
+%package static
+Summary: Static libraries for Ruby development environment
+Group: Development/Languages
+Requires: %{name}-devel = %{version}-%{release}
+
+%description static
+Static libraries for for building a extension library for the
+Ruby or an application embedded Ruby.
%package tcltk
Summary: Tcl/Tk interface for scripting language Ruby
@@ -187,6 +198,8 @@ pushd %{name}-%{arcver}
%patch30 -p2
%patch31 -p1
%patch32 -p0
+%patch33 -p1
+%patch34 -p0
popd
%build
@@ -217,6 +230,11 @@ export CFLAGS
%endif
--with-ruby-prefix=%{_prefix}/lib
+# For example ext/socket/extconf.rb uses try_run (for getaddrinfo test),
+# which executes conftest and setting LD_LIBRARY_PATH for libruby.so is
+# needed.
+export LD_LIBRARY_PATH=$(pwd)
+
make RUBY_INSTALL_NAME=ruby %{?_smp_mflags} COPY="cp -p" %{?_smp_mflags}
%ifarch ia64
# Miscompilation? Buggy code?
@@ -408,9 +426,13 @@ rm -rf $RPM_BUILD_ROOT
%doc %{name}-%{arcver}/README.EXT
%lang(ja) %doc %{name}-%{arcver}/README.EXT.ja
%{_libdir}/libruby.so
-%{_libdir}/libruby-static.a
+#%%{_libdir}/libruby-static.a
%{_libdir}/ruby/%{rubyxver}/*/*.h
+%files static
+%defattr(-, root, root, -)
+%{_libdir}/libruby-static.a
+
%files libs
%defattr(-, root, root, -)
%doc %{name}-%{arcver}/README
@@ -553,6 +575,14 @@ rm -rf $RPM_BUILD_ROOT
%{_emacs_sitestartdir}/ruby-mode-init.el
%changelog
+* Wed Jan 13 2010 Mamoru Tasaka <mtasaka at ioa.s.u-tokyo.ac.jp> - 1.8.6.383-6
+- CVE-2009-4492 ruby WEBrick log escape sequence (bug 554485)
+
+* Wed Dec 9 2009 Mamoru Tasaka <mtasaka at ioa.s.u-tokyo.ac.jp> - 1.8.6.383-5
+- Change mkmf.rb to use LIBRUBYARG_SHARED so that have_library() works
+ without libruby-static.a (bug 428384)
+- And move libruby-static.a to -static subpackage
+
* Thu Oct 29 2009 Mamoru Tasaka <mtasaka at ioa.s.u-tokyo.ac.jp> - 1.8.6.383-4
- Use bison to regenerate parse.c to keep the original format of error
messages (bug 530275 comment 4)
More information about the scm-commits
mailing list