diff options
author | Lee Chee Yang <chee.yang.lee@intel.com> | 2021-06-09 16:54:49 +0800 |
---|---|---|
committer | Steve Sakoman <steve@sakoman.com> | 2021-06-09 04:35:50 -1000 |
commit | 4de0d54827bc4645b69e5a0043b6f285b0193402 (patch) | |
tree | 1fa15dfcf21740d23adb8adbb7f8444d18c4b0fa /meta | |
parent | d7e56f1910b7963d8b704107903ecf40e9472d3c (diff) | |
download | openembedded-core-contrib-4de0d54827bc4645b69e5a0043b6f285b0193402.tar.gz |
ruby: 2.7.1 -> 2.7.3
This release includes security fixes.
CVE-2021-28965: XML round-trip vulnerability in REXML
CVE-2021-28966: Path traversal in Tempfile on Windows
CVE-2020-25613 fixed in 2.7.2, do drop the patch
release notes for 2.7.2 and 2.7.3
https://www.ruby-lang.org/en/news/2020/10/02/ruby-2-7-2-released/
https://www.ruby-lang.org/en/news/2021/04/05/ruby-2-7-3-released/
Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
Diffstat (limited to 'meta')
-rw-r--r-- | meta/recipes-devtools/ruby/ruby/CVE-2020-25613.patch | 40 | ||||
-rw-r--r-- | meta/recipes-devtools/ruby/ruby_2.7.3.bb (renamed from meta/recipes-devtools/ruby/ruby_2.7.1.bb) | 5 |
2 files changed, 2 insertions, 43 deletions
diff --git a/meta/recipes-devtools/ruby/ruby/CVE-2020-25613.patch b/meta/recipes-devtools/ruby/ruby/CVE-2020-25613.patch deleted file mode 100644 index 1abcb7547e..0000000000 --- a/meta/recipes-devtools/ruby/ruby/CVE-2020-25613.patch +++ /dev/null @@ -1,40 +0,0 @@ -From 8946bb38b4d87549f0d99ed73c62c41933f97cc7 Mon Sep 17 00:00:00 2001 -From: Yusuke Endoh <mame@ruby-lang.org> -Date: Tue, 29 Sep 2020 13:15:58 +0900 -Subject: [PATCH] Make it more strict to interpret some headers - -Some regexps were too tolerant. - -Upstream-Status: Backport -[https://github.com/ruby/webrick/commit/8946bb38b4d87549f0d99ed73c62c41933f97cc7] -CVE: CVE-2020-25613 -Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com> ---- - lib/webrick/httprequest.rb | 6 +++--- - 1 file changed, 3 insertions(+), 3 deletions(-) - -diff --git a/lib/webrick/httprequest.rb b/lib/webrick/httprequest.rb -index 294bd91..d34eac7 100644 ---- a/lib/webrick/httprequest.rb -+++ b/lib/webrick/httprequest.rb -@@ -227,9 +227,9 @@ def parse(socket=nil) - raise HTTPStatus::BadRequest, "bad URI `#{@unparsed_uri}'." - end - -- if /close/io =~ self["connection"] -+ if /\Aclose\z/io =~ self["connection"] - @keep_alive = false -- elsif /keep-alive/io =~ self["connection"] -+ elsif /\Akeep-alive\z/io =~ self["connection"] - @keep_alive = true - elsif @http_version < "1.1" - @keep_alive = false -@@ -508,7 +508,7 @@ def read_body(socket, block) - return unless socket - if tc = self['transfer-encoding'] - case tc -- when /chunked/io then read_chunked(socket, block) -+ when /\Achunked\z/io then read_chunked(socket, block) - else raise HTTPStatus::NotImplemented, "Transfer-Encoding: #{tc}." - end - elsif self['content-length'] || @remaining_size diff --git a/meta/recipes-devtools/ruby/ruby_2.7.1.bb b/meta/recipes-devtools/ruby/ruby_2.7.3.bb index a6c65e887b..318b9acdae 100644 --- a/meta/recipes-devtools/ruby/ruby_2.7.1.bb +++ b/meta/recipes-devtools/ruby/ruby_2.7.3.bb @@ -6,12 +6,11 @@ SRC_URI += " \ file://remove_has_include_macros.patch \ file://run-ptest \ file://0001-Modify-shebang-of-libexec-y2racc-and-libexec-racc2y.patch \ - file://CVE-2020-25613.patch \ file://0001-template-Makefile.in-do-not-write-host-cross-cc-item.patch \ " -SRC_URI[md5sum] = "debb9c325bf65021214451660f46e909" -SRC_URI[sha256sum] = "d418483bdd0000576c1370571121a6eb24582116db0b7bb2005e90e250eae418" +SRC_URI[md5sum] = "72ef97685008981de3ddb748d0dab31f" +SRC_URI[sha256sum] = "8925a95e31d8f2c81749025a52a544ea1d05dad18794e6828709268b92e55338" PACKAGECONFIG ??= "" PACKAGECONFIG += "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}" |