From 9904202d3401ba627a8a6f696ed9001992dd19e9 Mon Sep 17 00:00:00 2001 From: jackie_wu Date: Thu, 5 Nov 2020 17:07:15 +0800 Subject: [PATCH] fix CVE-2020-25613 --- CVE-2020-25613.patch | 35 +++++++++++++++++++++++++++++++++++ ruby.spec | 11 ++++++++++- 2 files changed, 45 insertions(+), 1 deletion(-) create mode 100644 CVE-2020-25613.patch diff --git a/CVE-2020-25613.patch b/CVE-2020-25613.patch new file mode 100644 index 0000000..75edbfd --- /dev/null +++ b/CVE-2020-25613.patch @@ -0,0 +1,35 @@ +From 8946bb38b4d87549f0d99ed73c62c41933f97cc7 Mon Sep 17 00:00:00 2001 +From: Yusuke Endoh +Date: Tue, 29 Sep 2020 13:15:58 +0900 +Subject: [PATCH] Make it more strict to interpret some headers + +Some regexps were too tolerant. +--- + lib/webrick/httprequest.rb | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/lib/webrick/httprequest.rb b/lib/webrick/httprequest.rb +index 294bd91..d34eac7 100644 +--- a/lib/webrick/httprequest.rb ++++ b/lib/webrick/httprequest.rb +@@ -227,9 +227,9 @@ def parse(socket=nil) + raise HTTPStatus::BadRequest, "bad URI `#{@unparsed_uri}'." + end + +- if /close/io =~ self["connection"] ++ if /\Aclose\z/io =~ self["connection"] + @keep_alive = false +- elsif /keep-alive/io =~ self["connection"] ++ elsif /\Akeep-alive\z/io =~ self["connection"] + @keep_alive = true + elsif @http_version < "1.1" + @keep_alive = false +@@ -508,7 +508,7 @@ def read_body(socket, block) + return unless socket + if tc = self['transfer-encoding'] + case tc +- when /chunked/io then read_chunked(socket, block) ++ when /\Achunked\z/io then read_chunked(socket, block) + else raise HTTPStatus::NotImplemented, "Transfer-Encoding: #{tc}." + end + elsif self['content-length'] || @remaining_size diff --git a/ruby.spec b/ruby.spec index d112d81..639a87f 100644 --- a/ruby.spec +++ b/ruby.spec @@ -1,6 +1,6 @@ Name: ruby Version: 2.5.8 -Release: 1 +Release: 2 Summary: Object-oriented scripting language interpreter License: (Ruby or BSD) and Public Domain and MIT and CC0 and zlib and UCD URL: https://www.ruby-lang.org/ @@ -38,6 +38,7 @@ Patch0012: ruby-2.5.1-Avoid-need-of-C++-compiler-to-pass-the-test-suite.patch Patch0013: CVE-2019-19204.patch Patch0014: CVE-2019-19246.patch Patch0015: CVE-2019-16163.patch +Patch0016: CVE-2020-25613.patch Provides: %{name}-libs = %{version}-%{release} Obsoletes: %{name}-libs < %{version}-%{release} @@ -575,6 +576,14 @@ make runruby TESTRUN_SCRIPT=%{SOURCE13} %exclude %{gem_dir}/gems/xmlrpc-0.3.0/.* %changelog +* Thu Nov 5 2020 wutao - 2.5.8-2 +- fix CVE-2020-25613 +- WEBrick,a simple HTTP server bundled with Ruby,had not +- checked the transfer-encoding header value rigorously. +- An attacker may potentially exploit this issue to bypass +- a reverse proxy,which may lead to an HTTP Request Smuggling +- attack + * Tue Aug 04 2020 shanzhikun - 2.5.8-1 - upgrade ruby to 2.5.8. -- Gitee