rpms/ruby/FC-6 ruby-1.8.5-CVE-2007-5162.patch, NONE, 1.1 .cvsignore, 1.20, 1.21 ruby-deprecated-search-path.patch, 1.3, 1.4 ruby-deprecated-sitelib-search-path.patch, 1.2, 1.3 ruby.spec, 1.93, 1.94 sources, 1.19, 1.20
fedora-cvs-commits at redhat.com
fedora-cvs-commits at redhat.com
Thu Oct 4 14:08:17 UTC 2007
- Previous message (by thread): rpms/postfix/FC-6 postfix-2.4.0-cyrus.patch, NONE, 1.1 .cvsignore, 1.22, 1.23 postfix-etc-init.d-postfix, 1.9, 1.10 postfix-sasl.conf, 1.1, 1.2 postfix.spec, 1.48, 1.49 sources, 1.22, 1.23
- Next message (by thread): October 71% OFF
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
Author: tagoh
Update of /cvs/dist/rpms/ruby/FC-6
In directory cvs.devel.redhat.com:/tmp/cvs-serv7990
Modified Files:
.cvsignore ruby-deprecated-search-path.patch
ruby-deprecated-sitelib-search-path.patch ruby.spec sources
Added Files:
ruby-1.8.5-CVE-2007-5162.patch
Log Message:
* Thu Oct 4 2007 Akira TAGOH <tagoh at redhat.com> - 1.8.5.113-1
- New upstream release.
- ruby-1.8.5-CVE-2007-5162.patch: security fix for Net::HTTP that is
insufficient verification of SSL certificate. (#313801)
ruby-1.8.5-CVE-2007-5162.patch:
ext/openssl/lib/openssl/ssl.rb | 2 +-
lib/net/http.rb | 12 ++++++++++++
lib/open-uri.rb | 11 +----------
version.h | 8 ++++----
4 files changed, 18 insertions(+), 15 deletions(-)
--- NEW FILE ruby-1.8.5-CVE-2007-5162.patch ---
diff -ruN ruby-1.8.5-p113.orig/ext/openssl/lib/openssl/ssl.rb ruby-1.8.5-p113/ext/openssl/lib/openssl/ssl.rb
--- ruby-1.8.5-p113.orig/ext/openssl/lib/openssl/ssl.rb 2007-02-13 08:01:19.000000000 +0900
+++ ruby-1.8.5-p113/ext/openssl/lib/openssl/ssl.rb 2007-10-04 19:04:41.000000000 +0900
@@ -88,7 +88,7 @@
end
}
end
- raise SSLError, "hostname not match"
+ raise SSLError, "hostname not match with the server certificate"
end
end
diff -ruN ruby-1.8.5-p113.orig/lib/net/http.rb ruby-1.8.5-p113/lib/net/http.rb
--- ruby-1.8.5-p113.orig/lib/net/http.rb 2007-02-13 08:01:19.000000000 +0900
+++ ruby-1.8.5-p113/lib/net/http.rb 2007-10-04 19:09:02.000000000 +0900
@@ -470,6 +470,7 @@
@debug_output = nil
@use_ssl = false
@ssl_context = nil
+ @enable_post_connection_check = true
end
def inspect
@@ -526,6 +527,9 @@
false # redefined in net/https
end
+ # specify enabling SSL server certificate and hostname checking.
+ attr_accessor :enable_post_connection_check
+
# Opens TCP connection and HTTP session.
#
# When this method is called with block, gives a HTTP object
@@ -584,6 +588,14 @@
HTTPResponse.read_new(@socket).value
end
s.connect
+ if @ssl_context.verify_mode != OpenSSL::SSL::VERIFY_NONE
+ begin
+ s.post_connection_check(@address)
+ rescue OpenSSL::SSL::SSLError => ex
+ raise ex if @enable_post_connection_check
+ warn ex.message
+ end
+ end
end
on_connect
end
diff -ruN ruby-1.8.5-p113.orig/lib/open-uri.rb ruby-1.8.5-p113/lib/open-uri.rb
--- ruby-1.8.5-p113.orig/lib/open-uri.rb 2007-02-13 08:01:19.000000000 +0900
+++ ruby-1.8.5-p113/lib/open-uri.rb 2007-10-04 19:10:12.000000000 +0900
@@ -229,6 +229,7 @@
if target.class == URI::HTTPS
require 'net/https'
http.use_ssl = true
+ http.enable_post_connection_check = true
http.verify_mode = OpenSSL::SSL::VERIFY_PEER
store = OpenSSL::X509::Store.new
store.set_default_paths
@@ -240,16 +241,6 @@
resp = nil
http.start {
- if target.class == URI::HTTPS
- # xxx: information hiding violation
- sock = http.instance_variable_get(:@socket)
- if sock.respond_to?(:io)
- sock = sock.io # 1.9
- else
- sock = sock.instance_variable_get(:@socket) # 1.8
- end
- sock.post_connection_check(target_host)
- end
req = Net::HTTP::Get.new(request_uri, header)
if options.include? :http_basic_authentication
user, pass = options[:http_basic_authentication]
diff -ruN ruby-1.8.5-p113.orig/version.h ruby-1.8.5-p113/version.h
--- ruby-1.8.5-p113.orig/version.h 2007-09-23 06:09:23.000000000 +0900
+++ ruby-1.8.5-p113/version.h 2007-10-04 19:10:57.000000000 +0900
@@ -1,15 +1,15 @@
#define RUBY_VERSION "1.8.5"
-#define RUBY_RELEASE_DATE "2007-09-23"
+#define RUBY_RELEASE_DATE "2007-09-24"
#define RUBY_VERSION_CODE 185
-#define RUBY_RELEASE_CODE 20070923
-#define RUBY_PATCHLEVEL 113
+#define RUBY_RELEASE_CODE 20070924
+#define RUBY_PATCHLEVEL 114
#define RUBY_VERSION_MAJOR 1
#define RUBY_VERSION_MINOR 8
#define RUBY_VERSION_TEENY 5
#define RUBY_RELEASE_YEAR 2007
#define RUBY_RELEASE_MONTH 9
-#define RUBY_RELEASE_DAY 23
+#define RUBY_RELEASE_DAY 24
#ifdef RUBY_EXTERN
RUBY_EXTERN const char ruby_version[];
Index: .cvsignore
===================================================================
RCS file: /cvs/dist/rpms/ruby/FC-6/.cvsignore,v
retrieving revision 1.20
retrieving revision 1.21
diff -u -r1.20 -r1.21
--- .cvsignore 20 Jun 2007 14:48:39 -0000 1.20
+++ .cvsignore 4 Oct 2007 14:08:14 -0000 1.21
@@ -14,3 +14,4 @@
ruby-1.8.5-p12.tar.gz
ruby-1.8.5-p35.tar.gz
ruby-1.8.5-p52.tar.bz2
+ruby-1.8.5-p113.tar.bz2
ruby-deprecated-search-path.patch:
configure.in | 4 ++++
ruby.c | 9 +++++++++
2 files changed, 13 insertions(+)
Index: ruby-deprecated-search-path.patch
===================================================================
RCS file: /cvs/dist/rpms/ruby/FC-6/ruby-deprecated-search-path.patch,v
retrieving revision 1.3
retrieving revision 1.4
diff -u -r1.3 -r1.4
--- ruby-deprecated-search-path.patch 8 Jun 2006 07:53:37 -0000 1.3
+++ ruby-deprecated-search-path.patch 4 Oct 2007 14:08:15 -0000 1.4
@@ -1,7 +1,7 @@
-diff -ruN ruby-1.8.4.orig/configure.in ruby-1.8.4/configure.in
---- ruby-1.8.4.orig/configure.in 2006-04-20 12:53:38.000000000 +0900
-+++ ruby-1.8.4/configure.in 2006-04-20 13:06:07.000000000 +0900
-@@ -1472,12 +1472,16 @@
+diff -ruN ruby-1.8.5-p113.orig/configure.in ruby-1.8.5-p113/configure.in
+--- ruby-1.8.5-p113.orig/configure.in 2007-10-04 18:54:45.000000000 +0900
++++ ruby-1.8.5-p113/configure.in 2007-10-04 18:59:31.000000000 +0900
+@@ -1547,12 +1547,16 @@
esac
RUBY_SITE_LIB_PATH3="${RUBY_SITE_LIB_PATH2}/${MAJOR}.${MINOR}"
RUBY_SITE_LIB_PATH2="${RUBY_SITE_LIB_PATH}/${MAJOR}.${MINOR}"
@@ -18,34 +18,34 @@
AC_SUBST(arch)dnl
AC_SUBST(sitearch)dnl
-diff -ruN ruby-1.8.4.orig/ruby.c ruby-1.8.4/ruby.c
---- ruby-1.8.4.orig/ruby.c 2005-12-12 09:36:52.000000000 +0900
-+++ ruby-1.8.4/ruby.c 2006-04-20 12:59:50.000000000 +0900
-@@ -292,11 +292,17 @@
+diff -ruN ruby-1.8.5-p113.orig/ruby.c ruby-1.8.5-p113/ruby.c
+--- ruby-1.8.5-p113.orig/ruby.c 2007-10-04 18:54:45.000000000 +0900
++++ ruby-1.8.5-p113/ruby.c 2007-10-04 19:01:16.000000000 +0900
+@@ -316,11 +316,17 @@
#endif
- ruby_incpush(RUBY_RELATIVE(RUBY_SITE_LIB2));
+ incpush(RUBY_RELATIVE(RUBY_SITE_LIB2));
+#ifdef RUBY_DEPRECATED_SITE_LIB
-+ ruby_incpush(RUBY_RELATIVE(RUBY_DEPRECATED_SITE_LIB2));
++ incpush(RUBY_RELATIVE(RUBY_DEPRECATED_SITE_LIB2));
+#endif
#ifdef RUBY_SITE_THIN_ARCHLIB
- ruby_incpush(RUBY_RELATIVE(RUBY_SITE_THIN_ARCHLIB));
+ incpush(RUBY_RELATIVE(RUBY_SITE_THIN_ARCHLIB));
#endif
- ruby_incpush(RUBY_RELATIVE(RUBY_SITE_ARCHLIB));
- ruby_incpush(RUBY_RELATIVE(RUBY_SITE_LIB));
+ incpush(RUBY_RELATIVE(RUBY_SITE_ARCHLIB));
+ incpush(RUBY_RELATIVE(RUBY_SITE_LIB));
+#ifdef RUBY_DEPRECATED_SITE_LIB
-+ ruby_incpush(RUBY_RELATIVE(RUBY_DEPRECATED_SITE_LIB));
++ incpush(RUBY_RELATIVE(RUBY_DEPRECATED_SITE_LIB));
+#endif
#ifdef RUBY_DEPRECATED_OLD_SITE_LIB2
- ruby_incpush(RUBY_RELATIVE(RUBY_DEPRECATED_OLD_SITE_LIB2));
+ incpush(RUBY_RELATIVE(RUBY_DEPRECATED_OLD_SITE_LIB2));
#endif
-@@ -308,6 +314,9 @@
+@@ -332,6 +338,9 @@
#endif
- ruby_incpush(RUBY_RELATIVE(RUBY_LIB));
+ incpush(RUBY_RELATIVE(RUBY_LIB));
+#ifdef RUBY_DEPRECATED_LIB
-+ ruby_incpush(RUBY_RELATIVE(RUBY_DEPRECATED_LIB));
++ incpush(RUBY_RELATIVE(RUBY_DEPRECATED_LIB));
+#endif
#ifdef RUBY_THIN_ARCHLIB
- ruby_incpush(RUBY_RELATIVE(RUBY_THIN_ARCHLIB));
+ incpush(RUBY_RELATIVE(RUBY_THIN_ARCHLIB));
#endif
ruby-deprecated-sitelib-search-path.patch:
configure.in | 3 +++
ruby.c | 9 +++++++++
2 files changed, 12 insertions(+)
Index: ruby-deprecated-sitelib-search-path.patch
===================================================================
RCS file: /cvs/dist/rpms/ruby/FC-6/ruby-deprecated-sitelib-search-path.patch,v
retrieving revision 1.2
retrieving revision 1.3
diff -u -r1.2 -r1.3
--- ruby-deprecated-sitelib-search-path.patch 8 Jun 2006 07:53:37 -0000 1.2
+++ ruby-deprecated-sitelib-search-path.patch 4 Oct 2007 14:08:15 -0000 1.3
@@ -1,7 +1,7 @@
-diff -ruN ruby-1.8.4.orig/configure.in ruby-1.8.4/configure.in
---- ruby-1.8.4.orig/configure.in 2006-06-07 13:58:03.000000000 +0900
-+++ ruby-1.8.4/configure.in 2006-06-07 15:54:36.000000000 +0900
-@@ -1476,6 +1476,8 @@
+diff -ruN ruby-1.8.5-p113.orig/configure.in ruby-1.8.5-p113/configure.in
+--- ruby-1.8.5-p113.orig/configure.in 2007-10-04 17:28:26.000000000 +0900
++++ ruby-1.8.5-p113/configure.in 2007-10-04 17:31:14.000000000 +0900
+@@ -1551,6 +1551,8 @@
AC_DEFINE_UNQUOTED(RUBY_LIB, "${RUBY_LIB_PATH}")
AC_DEFINE_UNQUOTED(RUBY_SITE_LIB, "${RUBY_SITE_LIB_PATH}")
AC_DEFINE_UNQUOTED(RUBY_SITE_LIB2, "${RUBY_SITE_LIB_PATH2}")
@@ -10,7 +10,7 @@
AC_SUBST(arch)dnl
AC_SUBST(sitearch)dnl
-@@ -1506,6 +1508,7 @@
+@@ -1581,6 +1583,7 @@
AC_DEFINE_UNQUOTED(RUBY_ARCHLIB, "${RUBY_LIB_PATH2}/${arch}")
AC_DEFINE_UNQUOTED(RUBY_SITE_ARCHLIB, "${RUBY_SITE_LIB_PATH3}/${sitearch}")
@@ -18,22 +18,22 @@
AC_ARG_WITH(search-path,
[ --with-search-path=DIR specify the additional search path],
-diff -ruN ruby-1.8.4.orig/ruby.c ruby-1.8.4/ruby.c
---- ruby-1.8.4.orig/ruby.c 2005-12-12 09:36:52.000000000 +0900
-+++ ruby-1.8.4/ruby.c 2006-06-07 15:56:14.000000000 +0900
-@@ -297,6 +297,15 @@
+diff -ruN ruby-1.8.5-p113.orig/ruby.c ruby-1.8.5-p113/ruby.c
+--- ruby-1.8.5-p113.orig/ruby.c 2007-09-17 04:51:38.000000000 +0900
++++ ruby-1.8.5-p113/ruby.c 2007-10-04 17:33:07.000000000 +0900
+@@ -321,6 +321,15 @@
#endif
- ruby_incpush(RUBY_RELATIVE(RUBY_SITE_ARCHLIB));
- ruby_incpush(RUBY_RELATIVE(RUBY_SITE_LIB));
+ incpush(RUBY_RELATIVE(RUBY_SITE_ARCHLIB));
+ incpush(RUBY_RELATIVE(RUBY_SITE_LIB));
+#ifdef RUBY_DEPRECATED_OLD_SITE_LIB2
-+ ruby_incpush(RUBY_RELATIVE(RUBY_DEPRECATED_OLD_SITE_LIB2));
++ incpush(RUBY_RELATIVE(RUBY_DEPRECATED_OLD_SITE_LIB2));
+#endif
+#ifdef RUBY_DEPRECATED_OLD_SITE_ARCHLIB
-+ ruby_incpush(RUBY_RELATIVE(RUBY_DEPRECATED_OLD_SITE_ARCHLIB));
++ incpush(RUBY_RELATIVE(RUBY_DEPRECATED_OLD_SITE_ARCHLIB));
+#endif
+#ifdef RUBY_DEPRECATED_OLD_SITE_LIB
-+ ruby_incpush(RUBY_RELATIVE(RUBY_DEPRECATED_OLD_SITE_LIB));
++ incpush(RUBY_RELATIVE(RUBY_DEPRECATED_OLD_SITE_LIB));
+#endif
- ruby_incpush(RUBY_RELATIVE(RUBY_LIB));
+ incpush(RUBY_RELATIVE(RUBY_LIB));
#ifdef RUBY_THIN_ARCHLIB
Index: ruby.spec
===================================================================
RCS file: /cvs/dist/rpms/ruby/FC-6/ruby.spec,v
retrieving revision 1.93
retrieving revision 1.94
diff -u -r1.93 -r1.94
--- ruby.spec 20 Jun 2007 14:48:39 -0000 1.93
+++ ruby.spec 4 Oct 2007 14:08:15 -0000 1.94
@@ -1,7 +1,7 @@
%define manver 1.4.6
%define rubyxver 1.8
%define rubyver 1.8.5
-%define _patchlevel 52
+%define _patchlevel 113
%define dotpatchlevel %{?_patchlevel:.%{_patchlevel}}
%define patchlevel %{?_patchlevel:-p%{_patchlevel}}
%define sitedir %{_libdir}/ruby/site_ruby
@@ -12,7 +12,7 @@
Name: ruby
Version: %{rubyver}%{?dotpatchlevel}
Release: 1%{?dist}
-License: Ruby License/GPL - see COPYING
+License: Ruby or GPL+
URL: http://www.ruby-lang.org/
BuildRoot: %{_tmppath}/%{name}-%{version}-%{release}-root-%(%{__id_u} -n)
BuildRequires: readline readline-devel ncurses ncurses-devel gdbm gdbm-devel glibc-devel tcl-devel tk-devel libX11-devel autoconf gcc unzip openssl-devel db4-devel byacc
@@ -38,6 +38,7 @@
Patch23: ruby-multilib.patch
Patch24: ruby-tcltk-multilib.patch
Patch25: ruby-fix-autoconf-magic-code.patch
+Patch26: ruby-1.8.5-CVE-2007-5162.patch
Summary: An interpreter of object-oriented scripting language
Group: Development/Languages
@@ -156,6 +157,7 @@
%patch24 -p1
%endif
#%%patch25 -p1
+%patch26 -p1
popd
%build
@@ -467,6 +469,11 @@
%endif
%changelog
+* Thu Oct 4 2007 Akira TAGOH <tagoh at redhat.com> - 1.8.5.113-1
+- New upstream release.
+- ruby-1.8.5-CVE-2007-5162.patch: security fix for Net::HTTP that is
+ insufficient verification of SSL certificate. (#313801)
+
* Wed Jul 20 2007 Akira TAGOH <tagoh at redhat.com> - 1.8.5.52-1
- New upstream release.
Index: sources
===================================================================
RCS file: /cvs/dist/rpms/ruby/FC-6/sources,v
retrieving revision 1.19
retrieving revision 1.20
diff -u -r1.19 -r1.20
--- sources 20 Jun 2007 14:48:39 -0000 1.19
+++ sources 4 Oct 2007 14:08:15 -0000 1.20
@@ -2,4 +2,4 @@
d65e3a216d6d345a2a6f1aa8758c2f75 ruby-refm-rdp-1.8.1-ja-html.tar.gz
7f3e181c0be9a1579e43a5a8b26372d6 rubyfaq-990927.tar.bz2
8aa2e2da327dc43ff6e46e634eb657b6 rubyfaq-jp-990927.tar.bz2
-bc19ddcca90a54692306b45c43f8e1a9 ruby-1.8.5-p52.tar.bz2
+682117fbca4cd2ceac6beb6a403eef59 ruby-1.8.5-p113.tar.bz2
- Previous message (by thread): rpms/postfix/FC-6 postfix-2.4.0-cyrus.patch, NONE, 1.1 .cvsignore, 1.22, 1.23 postfix-etc-init.d-postfix, 1.9, 1.10 postfix-sasl.conf, 1.1, 1.2 postfix.spec, 1.48, 1.49 sources, 1.22, 1.23
- Next message (by thread): October 71% OFF
- Messages sorted by:
[ date ]
[ thread ]
[ subject ]
[ author ]
More information about the fedora-cvs-commits
mailing list