[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]

rpms/ruby/FC-6 ruby-1.8.5-CVE-2007-5162.patch, NONE, 1.1 .cvsignore, 1.20, 1.21 ruby-deprecated-search-path.patch, 1.3, 1.4 ruby-deprecated-sitelib-search-path.patch, 1.2, 1.3 ruby.spec, 1.93, 1.94 sources, 1.19, 1.20



Author: tagoh

Update of /cvs/dist/rpms/ruby/FC-6
In directory cvs.devel.redhat.com:/tmp/cvs-serv7990

Modified Files:
	.cvsignore ruby-deprecated-search-path.patch 
	ruby-deprecated-sitelib-search-path.patch ruby.spec sources 
Added Files:
	ruby-1.8.5-CVE-2007-5162.patch 
Log Message:
* Thu Oct  4 2007 Akira TAGOH <tagoh redhat com> - 1.8.5.113-1
- New upstream release.
- ruby-1.8.5-CVE-2007-5162.patch: security fix for Net::HTTP that is
  insufficient verification of SSL certificate. (#313801)

ruby-1.8.5-CVE-2007-5162.patch:
 ext/openssl/lib/openssl/ssl.rb |    2 +-
 lib/net/http.rb                |   12 ++++++++++++
 lib/open-uri.rb                |   11 +----------
 version.h                      |    8 ++++----
 4 files changed, 18 insertions(+), 15 deletions(-)

--- NEW FILE ruby-1.8.5-CVE-2007-5162.patch ---
diff -ruN ruby-1.8.5-p113.orig/ext/openssl/lib/openssl/ssl.rb ruby-1.8.5-p113/ext/openssl/lib/openssl/ssl.rb
--- ruby-1.8.5-p113.orig/ext/openssl/lib/openssl/ssl.rb	2007-02-13 08:01:19.000000000 +0900
+++ ruby-1.8.5-p113/ext/openssl/lib/openssl/ssl.rb	2007-10-04 19:04:41.000000000 +0900
@@ -88,7 +88,7 @@
             end
           }
         end
-        raise SSLError, "hostname not match"
+        raise SSLError, "hostname not match with the server certificate"
       end
     end
 
diff -ruN ruby-1.8.5-p113.orig/lib/net/http.rb ruby-1.8.5-p113/lib/net/http.rb
--- ruby-1.8.5-p113.orig/lib/net/http.rb	2007-02-13 08:01:19.000000000 +0900
+++ ruby-1.8.5-p113/lib/net/http.rb	2007-10-04 19:09:02.000000000 +0900
@@ -470,6 +470,7 @@
       @debug_output = nil
       @use_ssl = false
       @ssl_context = nil
+      @enable_post_connection_check = true
     end
 
     def inspect
@@ -526,6 +527,9 @@
       false   # redefined in net/https
     end
 
+    # specify enabling SSL server certificate and hostname checking.
+    attr_accessor :enable_post_connection_check
+
     # Opens TCP connection and HTTP session.
     # 
     # When this method is called with block, gives a HTTP object
@@ -584,6 +588,14 @@
           HTTPResponse.read_new(@socket).value
         end
         s.connect
+        if @ssl_context.verify_mode != OpenSSL::SSL::VERIFY_NONE
+          begin
+           s.post_connection_check(@address)
+          rescue OpenSSL::SSL::SSLError => ex
+           raise ex if @enable_post_connection_check
+           warn ex.message
+          end
+        end
       end
       on_connect
     end
diff -ruN ruby-1.8.5-p113.orig/lib/open-uri.rb ruby-1.8.5-p113/lib/open-uri.rb
--- ruby-1.8.5-p113.orig/lib/open-uri.rb	2007-02-13 08:01:19.000000000 +0900
+++ ruby-1.8.5-p113/lib/open-uri.rb	2007-10-04 19:10:12.000000000 +0900
@@ -229,6 +229,7 @@
     if target.class == URI::HTTPS
       require 'net/https'
       http.use_ssl = true
+      http.enable_post_connection_check = true
       http.verify_mode = OpenSSL::SSL::VERIFY_PEER
       store = OpenSSL::X509::Store.new
       store.set_default_paths
@@ -240,16 +241,6 @@
 
     resp = nil
     http.start {
-      if target.class == URI::HTTPS
-        # xxx: information hiding violation
-        sock = http.instance_variable_get(:@socket)
-        if sock.respond_to?(:io)
-          sock = sock.io # 1.9
-        else
-          sock = sock.instance_variable_get(:@socket) # 1.8
-        end
-        sock.post_connection_check(target_host)
-      end
       req = Net::HTTP::Get.new(request_uri, header)
       if options.include? :http_basic_authentication
         user, pass = options[:http_basic_authentication]
diff -ruN ruby-1.8.5-p113.orig/version.h ruby-1.8.5-p113/version.h
--- ruby-1.8.5-p113.orig/version.h	2007-09-23 06:09:23.000000000 +0900
+++ ruby-1.8.5-p113/version.h	2007-10-04 19:10:57.000000000 +0900
@@ -1,15 +1,15 @@
 #define RUBY_VERSION "1.8.5"
-#define RUBY_RELEASE_DATE "2007-09-23"
+#define RUBY_RELEASE_DATE "2007-09-24"
 #define RUBY_VERSION_CODE 185
-#define RUBY_RELEASE_CODE 20070923
-#define RUBY_PATCHLEVEL 113
+#define RUBY_RELEASE_CODE 20070924
+#define RUBY_PATCHLEVEL 114
 
 #define RUBY_VERSION_MAJOR 1
 #define RUBY_VERSION_MINOR 8
 #define RUBY_VERSION_TEENY 5
 #define RUBY_RELEASE_YEAR 2007
 #define RUBY_RELEASE_MONTH 9
-#define RUBY_RELEASE_DAY 23
+#define RUBY_RELEASE_DAY 24
 
 #ifdef RUBY_EXTERN
 RUBY_EXTERN const char ruby_version[];


Index: .cvsignore
===================================================================
RCS file: /cvs/dist/rpms/ruby/FC-6/.cvsignore,v
retrieving revision 1.20
retrieving revision 1.21
diff -u -r1.20 -r1.21
--- .cvsignore	20 Jun 2007 14:48:39 -0000	1.20
+++ .cvsignore	4 Oct 2007 14:08:14 -0000	1.21
@@ -14,3 +14,4 @@
 ruby-1.8.5-p12.tar.gz
 ruby-1.8.5-p35.tar.gz
 ruby-1.8.5-p52.tar.bz2
+ruby-1.8.5-p113.tar.bz2

ruby-deprecated-search-path.patch:
 configure.in |    4 ++++
 ruby.c       |    9 +++++++++
 2 files changed, 13 insertions(+)

Index: ruby-deprecated-search-path.patch
===================================================================
RCS file: /cvs/dist/rpms/ruby/FC-6/ruby-deprecated-search-path.patch,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- ruby-deprecated-search-path.patch	8 Jun 2006 07:53:37 -0000	1.3
+++ ruby-deprecated-search-path.patch	4 Oct 2007 14:08:15 -0000	1.4
@@ -1,7 +1,7 @@
-diff -ruN ruby-1.8.4.orig/configure.in ruby-1.8.4/configure.in
---- ruby-1.8.4.orig/configure.in	2006-04-20 12:53:38.000000000 +0900
-+++ ruby-1.8.4/configure.in	2006-04-20 13:06:07.000000000 +0900
-@@ -1472,12 +1472,16 @@
+diff -ruN ruby-1.8.5-p113.orig/configure.in ruby-1.8.5-p113/configure.in
+--- ruby-1.8.5-p113.orig/configure.in	2007-10-04 18:54:45.000000000 +0900
++++ ruby-1.8.5-p113/configure.in	2007-10-04 18:59:31.000000000 +0900
+@@ -1547,12 +1547,16 @@
  esac
  RUBY_SITE_LIB_PATH3="${RUBY_SITE_LIB_PATH2}/${MAJOR}.${MINOR}"
  RUBY_SITE_LIB_PATH2="${RUBY_SITE_LIB_PATH}/${MAJOR}.${MINOR}"
@@ -18,34 +18,34 @@
  
  AC_SUBST(arch)dnl
  AC_SUBST(sitearch)dnl
-diff -ruN ruby-1.8.4.orig/ruby.c ruby-1.8.4/ruby.c
---- ruby-1.8.4.orig/ruby.c	2005-12-12 09:36:52.000000000 +0900
-+++ ruby-1.8.4/ruby.c	2006-04-20 12:59:50.000000000 +0900
-@@ -292,11 +292,17 @@
+diff -ruN ruby-1.8.5-p113.orig/ruby.c ruby-1.8.5-p113/ruby.c
+--- ruby-1.8.5-p113.orig/ruby.c	2007-10-04 18:54:45.000000000 +0900
++++ ruby-1.8.5-p113/ruby.c	2007-10-04 19:01:16.000000000 +0900
+@@ -316,11 +316,17 @@
  #endif
  
-     ruby_incpush(RUBY_RELATIVE(RUBY_SITE_LIB2));
+     incpush(RUBY_RELATIVE(RUBY_SITE_LIB2));
 +#ifdef RUBY_DEPRECATED_SITE_LIB
-+    ruby_incpush(RUBY_RELATIVE(RUBY_DEPRECATED_SITE_LIB2));
++    incpush(RUBY_RELATIVE(RUBY_DEPRECATED_SITE_LIB2));
 +#endif
  #ifdef RUBY_SITE_THIN_ARCHLIB
-     ruby_incpush(RUBY_RELATIVE(RUBY_SITE_THIN_ARCHLIB));
+     incpush(RUBY_RELATIVE(RUBY_SITE_THIN_ARCHLIB));
  #endif
-     ruby_incpush(RUBY_RELATIVE(RUBY_SITE_ARCHLIB));
-     ruby_incpush(RUBY_RELATIVE(RUBY_SITE_LIB));
+     incpush(RUBY_RELATIVE(RUBY_SITE_ARCHLIB));
+     incpush(RUBY_RELATIVE(RUBY_SITE_LIB));
 +#ifdef RUBY_DEPRECATED_SITE_LIB
-+    ruby_incpush(RUBY_RELATIVE(RUBY_DEPRECATED_SITE_LIB));
++    incpush(RUBY_RELATIVE(RUBY_DEPRECATED_SITE_LIB));
 +#endif
  #ifdef RUBY_DEPRECATED_OLD_SITE_LIB2
-     ruby_incpush(RUBY_RELATIVE(RUBY_DEPRECATED_OLD_SITE_LIB2));
+     incpush(RUBY_RELATIVE(RUBY_DEPRECATED_OLD_SITE_LIB2));
  #endif
-@@ -308,6 +314,9 @@
+@@ -332,6 +338,9 @@
  #endif
  
-     ruby_incpush(RUBY_RELATIVE(RUBY_LIB));
+     incpush(RUBY_RELATIVE(RUBY_LIB));
 +#ifdef RUBY_DEPRECATED_LIB
-+    ruby_incpush(RUBY_RELATIVE(RUBY_DEPRECATED_LIB));
++    incpush(RUBY_RELATIVE(RUBY_DEPRECATED_LIB));
 +#endif
  #ifdef RUBY_THIN_ARCHLIB
-     ruby_incpush(RUBY_RELATIVE(RUBY_THIN_ARCHLIB));
+     incpush(RUBY_RELATIVE(RUBY_THIN_ARCHLIB));
  #endif

ruby-deprecated-sitelib-search-path.patch:
 configure.in |    3 +++
 ruby.c       |    9 +++++++++
 2 files changed, 12 insertions(+)

Index: ruby-deprecated-sitelib-search-path.patch
===================================================================
RCS file: /cvs/dist/rpms/ruby/FC-6/ruby-deprecated-sitelib-search-path.patch,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- ruby-deprecated-sitelib-search-path.patch	8 Jun 2006 07:53:37 -0000	1.2
+++ ruby-deprecated-sitelib-search-path.patch	4 Oct 2007 14:08:15 -0000	1.3
@@ -1,7 +1,7 @@
-diff -ruN ruby-1.8.4.orig/configure.in ruby-1.8.4/configure.in
---- ruby-1.8.4.orig/configure.in	2006-06-07 13:58:03.000000000 +0900
-+++ ruby-1.8.4/configure.in	2006-06-07 15:54:36.000000000 +0900
-@@ -1476,6 +1476,8 @@
+diff -ruN ruby-1.8.5-p113.orig/configure.in ruby-1.8.5-p113/configure.in
+--- ruby-1.8.5-p113.orig/configure.in	2007-10-04 17:28:26.000000000 +0900
++++ ruby-1.8.5-p113/configure.in	2007-10-04 17:31:14.000000000 +0900
+@@ -1551,6 +1551,8 @@
  AC_DEFINE_UNQUOTED(RUBY_LIB, "${RUBY_LIB_PATH}")
  AC_DEFINE_UNQUOTED(RUBY_SITE_LIB, "${RUBY_SITE_LIB_PATH}")
  AC_DEFINE_UNQUOTED(RUBY_SITE_LIB2, "${RUBY_SITE_LIB_PATH2}")
@@ -10,7 +10,7 @@
  
  AC_SUBST(arch)dnl
  AC_SUBST(sitearch)dnl
-@@ -1506,6 +1508,7 @@
+@@ -1581,6 +1583,7 @@
  
  AC_DEFINE_UNQUOTED(RUBY_ARCHLIB, "${RUBY_LIB_PATH2}/${arch}")
  AC_DEFINE_UNQUOTED(RUBY_SITE_ARCHLIB, "${RUBY_SITE_LIB_PATH3}/${sitearch}")
@@ -18,22 +18,22 @@
  
  AC_ARG_WITH(search-path,
  		[  --with-search-path=DIR specify the additional search path],
-diff -ruN ruby-1.8.4.orig/ruby.c ruby-1.8.4/ruby.c
---- ruby-1.8.4.orig/ruby.c	2005-12-12 09:36:52.000000000 +0900
-+++ ruby-1.8.4/ruby.c	2006-06-07 15:56:14.000000000 +0900
-@@ -297,6 +297,15 @@
+diff -ruN ruby-1.8.5-p113.orig/ruby.c ruby-1.8.5-p113/ruby.c
+--- ruby-1.8.5-p113.orig/ruby.c	2007-09-17 04:51:38.000000000 +0900
++++ ruby-1.8.5-p113/ruby.c	2007-10-04 17:33:07.000000000 +0900
+@@ -321,6 +321,15 @@
  #endif
-     ruby_incpush(RUBY_RELATIVE(RUBY_SITE_ARCHLIB));
-     ruby_incpush(RUBY_RELATIVE(RUBY_SITE_LIB));
+     incpush(RUBY_RELATIVE(RUBY_SITE_ARCHLIB));
+     incpush(RUBY_RELATIVE(RUBY_SITE_LIB));
 +#ifdef RUBY_DEPRECATED_OLD_SITE_LIB2
-+    ruby_incpush(RUBY_RELATIVE(RUBY_DEPRECATED_OLD_SITE_LIB2));
++    incpush(RUBY_RELATIVE(RUBY_DEPRECATED_OLD_SITE_LIB2));
 +#endif
 +#ifdef RUBY_DEPRECATED_OLD_SITE_ARCHLIB
-+    ruby_incpush(RUBY_RELATIVE(RUBY_DEPRECATED_OLD_SITE_ARCHLIB));
++    incpush(RUBY_RELATIVE(RUBY_DEPRECATED_OLD_SITE_ARCHLIB));
 +#endif
 +#ifdef RUBY_DEPRECATED_OLD_SITE_LIB
-+    ruby_incpush(RUBY_RELATIVE(RUBY_DEPRECATED_OLD_SITE_LIB));
++    incpush(RUBY_RELATIVE(RUBY_DEPRECATED_OLD_SITE_LIB));
 +#endif
  
-     ruby_incpush(RUBY_RELATIVE(RUBY_LIB));
+     incpush(RUBY_RELATIVE(RUBY_LIB));
  #ifdef RUBY_THIN_ARCHLIB


Index: ruby.spec
===================================================================
RCS file: /cvs/dist/rpms/ruby/FC-6/ruby.spec,v
retrieving revision 1.93
retrieving revision 1.94
diff -u -r1.93 -r1.94
--- ruby.spec	20 Jun 2007 14:48:39 -0000	1.93
+++ ruby.spec	4 Oct 2007 14:08:15 -0000	1.94
@@ -1,7 +1,7 @@
 %define manver		1.4.6
 %define	rubyxver	1.8
 %define	rubyver		1.8.5
-%define _patchlevel	52
+%define _patchlevel	113
 %define dotpatchlevel	%{?_patchlevel:.%{_patchlevel}}
 %define patchlevel	%{?_patchlevel:-p%{_patchlevel}}
 %define	sitedir		%{_libdir}/ruby/site_ruby
@@ -12,7 +12,7 @@
 Name:		ruby
 Version:	%{rubyver}%{?dotpatchlevel}
 Release:	1%{?dist}
-License:	Ruby License/GPL - see COPYING
+License:	Ruby or GPL+
 URL:		http://www.ruby-lang.org/
 BuildRoot:	%{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
 BuildRequires:	readline readline-devel ncurses ncurses-devel gdbm gdbm-devel glibc-devel tcl-devel tk-devel libX11-devel autoconf gcc unzip openssl-devel db4-devel byacc
@@ -38,6 +38,7 @@
 Patch23:	ruby-multilib.patch
 Patch24:	ruby-tcltk-multilib.patch
 Patch25:	ruby-fix-autoconf-magic-code.patch
+Patch26:	ruby-1.8.5-CVE-2007-5162.patch
 
 Summary:	An interpreter of object-oriented scripting language
 Group:		Development/Languages
@@ -156,6 +157,7 @@
 %patch24 -p1
 %endif
 #%%patch25 -p1
+%patch26 -p1
 popd
 
 %build
@@ -467,6 +469,11 @@
 %endif
 
 %changelog
+* Thu Oct  4 2007 Akira TAGOH <tagoh redhat com> - 1.8.5.113-1
+- New upstream release.
+- ruby-1.8.5-CVE-2007-5162.patch: security fix for Net::HTTP that is
+  insufficient verification of SSL certificate. (#313801)
+
 * Wed Jul 20 2007 Akira TAGOH <tagoh redhat com> - 1.8.5.52-1
 - New upstream release.
 


Index: sources
===================================================================
RCS file: /cvs/dist/rpms/ruby/FC-6/sources,v
retrieving revision 1.19
retrieving revision 1.20
diff -u -r1.19 -r1.20
--- sources	20 Jun 2007 14:48:39 -0000	1.19
+++ sources	4 Oct 2007 14:08:15 -0000	1.20
@@ -2,4 +2,4 @@
 d65e3a216d6d345a2a6f1aa8758c2f75  ruby-refm-rdp-1.8.1-ja-html.tar.gz
 7f3e181c0be9a1579e43a5a8b26372d6  rubyfaq-990927.tar.bz2
 8aa2e2da327dc43ff6e46e634eb657b6  rubyfaq-jp-990927.tar.bz2
-bc19ddcca90a54692306b45c43f8e1a9  ruby-1.8.5-p52.tar.bz2
+682117fbca4cd2ceac6beb6a403eef59  ruby-1.8.5-p113.tar.bz2


[Date Prev][Date Next]   [Thread Prev][Thread Next]   [Thread Index] [Date Index] [Author Index]