From 6837cdfb02d0512f90969859e64a4377095bed1b Mon Sep 17 00:00:00 2001 From: shixuantong Date: Fri, 28 Feb 2025 16:44:58 +0800 Subject: [PATCH] fix CVE-2025-27219 CVE-2025-27220 CVE-2025-27221 --- backport-0001-CVE-2025-27221.patch | 53 ++++++++++++++++++++++ backport-0002-CVE-2025-27221.patch | 68 ++++++++++++++++++++++++++++ backport-CVE-2025-27219.patch | 32 +++++++++++++ backport-CVE-2025-27220.patch | 73 ++++++++++++++++++++++++++++++ ruby.spec | 9 +++- 5 files changed, 234 insertions(+), 1 deletion(-) create mode 100644 backport-0001-CVE-2025-27221.patch create mode 100644 backport-0002-CVE-2025-27221.patch create mode 100644 backport-CVE-2025-27219.patch create mode 100644 backport-CVE-2025-27220.patch diff --git a/backport-0001-CVE-2025-27221.patch b/backport-0001-CVE-2025-27221.patch new file mode 100644 index 0000000..d1c20a2 --- /dev/null +++ b/backport-0001-CVE-2025-27221.patch @@ -0,0 +1,53 @@ +From 4263c0d15a582b46d75aac57cd26a47d33941a53 Mon Sep 17 00:00:00 2001 +From: Hiroshi SHIBATA +Date: Fri, 21 Feb 2025 16:29:36 +0900 +Subject: [PATCH] Truncate userinfo with URI#join, URI#merge and URI#+ + +--- + lib/uri/generic.rb | 6 +++++- + test/uri/test_generic.rb | 11 +++++++++++ + 2 files changed, 16 insertions(+), 1 deletion(-) + +diff --git a/lib/uri/generic.rb b/lib/uri/generic.rb +index 69698c4..7d0b889 100644 +--- a/lib/uri/generic.rb ++++ b/lib/uri/generic.rb +@@ -1141,7 +1141,11 @@ module URI + end + + # RFC2396, Section 5.2, 7) +- base.set_userinfo(rel.userinfo) if rel.userinfo ++ if rel.userinfo ++ base.set_userinfo(rel.userinfo) ++ else ++ base.set_userinfo(nil) ++ end + base.set_host(rel.host) if rel.host + base.set_port(rel.port) if rel.port + base.query = rel.query if rel.query +diff --git a/test/uri/test_generic.rb b/test/uri/test_generic.rb +index 3897c3d..30f9cbf 100644 +--- a/test/uri/test_generic.rb ++++ b/test/uri/test_generic.rb +@@ -164,6 +164,17 @@ class URI::TestGeneric < Test::Unit::TestCase + # must be empty string to identify as path-abempty, not path-absolute + assert_equal('', url.host) + assert_equal('http:////example.com', url.to_s) ++ ++ # sec-2957667 ++ url = URI.parse('http://user:pass@example.com').merge('//example.net') ++ assert_equal('http://example.net', url.to_s) ++ assert_nil(url.userinfo) ++ url = URI.join('http://user:pass@example.com', '//example.net') ++ assert_equal('http://example.net', url.to_s) ++ assert_nil(url.userinfo) ++ url = URI.parse('http://user:pass@example.com') + '//example.net' ++ assert_equal('http://example.net', url.to_s) ++ assert_nil(url.userinfo) + end + + def test_parse_scheme_with_symbols +-- +2.33.0 + + diff --git a/backport-0002-CVE-2025-27221.patch b/backport-0002-CVE-2025-27221.patch new file mode 100644 index 0000000..84996c8 --- /dev/null +++ b/backport-0002-CVE-2025-27221.patch @@ -0,0 +1,68 @@ +From 58adef476ef4b5e6deefaf92e7594ab29396c624 Mon Sep 17 00:00:00 2001 +From: Hiroshi SHIBATA +Date: Fri, 21 Feb 2025 18:16:28 +0900 +Subject: [PATCH] Fix merger of URI with authority component + +https://hackerone.com/reports/2957667 + +Co-authored-by: Nobuyoshi Nakada +--- + lib/uri/generic.rb | 19 +++++++------------ + test/uri/test_generic.rb | 7 +++++++ + 2 files changed, 14 insertions(+), 12 deletions(-) + +diff --git a/lib/uri/generic.rb b/lib/uri/generic.rb +index 7d0b889..f7eed57 100644 +--- a/lib/uri/generic.rb ++++ b/lib/uri/generic.rb +@@ -1133,21 +1133,16 @@ module URI + base.fragment=(nil) + + # RFC2396, Section 5.2, 4) +- if !authority +- base.set_path(merge_path(base.path, rel.path)) if base.path && rel.path +- else +- # RFC2396, Section 5.2, 4) +- base.set_path(rel.path) if rel.path ++ if authority ++ base.set_userinfo(rel.userinfo) ++ base.set_host(rel.host) ++ base.set_port(rel.port || base.default_port) ++ base.set_path(rel.path) ++ elsif base.path && rel.path ++ base.set_path(merge_path(base.path, rel.path)) + end + + # RFC2396, Section 5.2, 7) +- if rel.userinfo +- base.set_userinfo(rel.userinfo) +- else +- base.set_userinfo(nil) +- end +- base.set_host(rel.host) if rel.host +- base.set_port(rel.port) if rel.port + base.query = rel.query if rel.query + base.fragment=(rel.fragment) if rel.fragment + +diff --git a/test/uri/test_generic.rb b/test/uri/test_generic.rb +index 30f9cbf..4b5e12c 100644 +--- a/test/uri/test_generic.rb ++++ b/test/uri/test_generic.rb +@@ -267,6 +267,13 @@ class URI::TestGeneric < Test::Unit::TestCase + assert_equal(u0, u1) + end + ++ def test_merge_authority ++ u = URI.parse('http://user:pass@example.com:8080') ++ u0 = URI.parse('http://new.example.org/path') ++ u1 = u.merge('//new.example.org/path') ++ assert_equal(u0, u1) ++ end ++ + def test_route + url = URI.parse('http://hoge/a.html').route_to('http://hoge/b.html') + assert_equal('b.html', url.to_s) +-- +2.33.0 + + diff --git a/backport-CVE-2025-27219.patch b/backport-CVE-2025-27219.patch new file mode 100644 index 0000000..4a9aa70 --- /dev/null +++ b/backport-CVE-2025-27219.patch @@ -0,0 +1,32 @@ +From 2c2d89e7cce0c81d9e63bb29c0e65b0436885af1 Mon Sep 17 00:00:00 2001 +From: Hiroshi SHIBATA +Date: Fri, 21 Feb 2025 16:01:17 +0900 +Subject: [PATCH 1/2] Use String#concat instead of String#+ for reducing cpu + usage + +Co-authored-by: "Yusuke Endoh" +--- + lib/cgi/cookie.rb | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/lib/cgi/cookie.rb b/lib/cgi/cookie.rb +index 9498e2f..1c4ef6a 100644 +--- a/lib/cgi/cookie.rb ++++ b/lib/cgi/cookie.rb +@@ -190,9 +190,10 @@ class CGI + values ||= "" + values = values.split('&').collect{|v| CGI.unescape(v,@@accept_charset) } + if cookies.has_key?(name) +- values = cookies[name].value + values ++ cookies[name].concat(values) ++ else ++ cookies[name] = Cookie.new(name, *values) + end +- cookies[name] = Cookie.new(name, *values) + end + + cookies +-- +2.33.0 + + diff --git a/backport-CVE-2025-27220.patch b/backport-CVE-2025-27220.patch new file mode 100644 index 0000000..0a7e682 --- /dev/null +++ b/backport-CVE-2025-27220.patch @@ -0,0 +1,73 @@ +From da7aadf928d85ffdf594d7e77aed4a441f7c3ebb Mon Sep 17 00:00:00 2001 +From: Hiroshi SHIBATA +Date: Fri, 21 Feb 2025 15:53:31 +0900 +Subject: [PATCH 2/2] Escape/unescape unclosed tags as well + +Co-authored-by: Nobuyoshi Nakada +--- + lib/cgi/util.rb | 4 ++-- + test/cgi/test_cgi_util.rb | 18 ++++++++++++++++++ + 2 files changed, 20 insertions(+), 2 deletions(-) + +diff --git a/lib/cgi/util.rb b/lib/cgi/util.rb +index 5a5c77a..ce77a0c 100644 +--- a/lib/cgi/util.rb ++++ b/lib/cgi/util.rb +@@ -178,7 +178,7 @@ module CGI::Util + def escapeElement(string, *elements) + elements = elements[0] if elements[0].kind_of?(Array) + unless elements.empty? +- string.gsub(/<\/?(?:#{elements.join("|")})(?!\w)(?:.|\n)*?>/i) do ++ string.gsub(/<\/?(?:#{elements.join("|")})\b[^<>]*+>?/im) do + CGI.escapeHTML($&) + end + else +@@ -198,7 +198,7 @@ module CGI::Util + def unescapeElement(string, *elements) + elements = elements[0] if elements[0].kind_of?(Array) + unless elements.empty? +- string.gsub(/<\/?(?:#{elements.join("|")})(?!\w)(?:.|\n)*?>/i) do ++ string.gsub(/<\/?(?:#{elements.join("|")})\b(?>[^&]+|&(?![gl]t;)\w+;)*(?:>)?/im) do + unescapeHTML($&) + end + else +diff --git a/test/cgi/test_cgi_util.rb b/test/cgi/test_cgi_util.rb +index a3be193..d058ccc 100644 +--- a/test/cgi/test_cgi_util.rb ++++ b/test/cgi/test_cgi_util.rb +@@ -244,6 +244,14 @@ class CGIUtilTest < Test::Unit::TestCase + assert_equal("
<A HREF="url"></A>", escapeElement('
', ["A", "IMG"])) + assert_equal("
<A HREF="url"></A>", escape_element('
', "A", "IMG")) + assert_equal("
<A HREF="url"></A>", escape_element('
', ["A", "IMG"])) ++ ++ assert_equal("<A <A HREF="url"></A>", escapeElement('', "A", "IMG")) ++ assert_equal("<A <A HREF="url"></A>", escapeElement('', ["A", "IMG"])) ++ assert_equal("<A <A HREF="url"></A>", escape_element('', "A", "IMG")) ++ assert_equal("<A <A HREF="url"></A>", escape_element('', ["A", "IMG"])) ++ ++ assert_equal("<A <A ", escapeElement('', unescapeElement(escapeHTML('
'), ["A", "IMG"])) + assert_equal('<BR>', unescape_element(escapeHTML('
'), "A", "IMG")) + assert_equal('<BR>', unescape_element(escapeHTML('
'), ["A", "IMG"])) ++ ++ assert_equal('', unescapeElement(escapeHTML(''), "A", "IMG")) ++ assert_equal('', unescapeElement(escapeHTML(''), ["A", "IMG"])) ++ assert_equal('', unescape_element(escapeHTML(''), "A", "IMG")) ++ assert_equal('', unescape_element(escapeHTML(''), ["A", "IMG"])) ++ ++ assert_equal(' - 3.2.7-151 +- fix CVE-2025-27219 CVE-2025-27220 CVE-2025-27221 + * Thu Feb 13 2025 Funda Wang - 3.2.7-150 - update to 3.2.7 - update bundled net-imap to 0.3.8 to fix CVE-2025-25186 -- Gitee