From 29bfbca71e6d109b987a97afeea40f8090a15d7f Mon Sep 17 00:00:00 2001 From: jackie_wu Date: Thu, 5 Nov 2020 16:52:49 +0800 Subject: [PATCH] fix CVE-2020-25613 --- CVE-2020-25613.patch | 35 +++++++++++++++++++++++++++++++++++ ruby.spec | 11 ++++++++++- 2 files changed, 45 insertions(+), 1 deletion(-) create mode 100644 CVE-2020-25613.patch diff --git a/CVE-2020-25613.patch b/CVE-2020-25613.patch new file mode 100644 index 0000000..75edbfd --- /dev/null +++ b/CVE-2020-25613.patch @@ -0,0 +1,35 @@ +From 8946bb38b4d87549f0d99ed73c62c41933f97cc7 Mon Sep 17 00:00:00 2001 +From: Yusuke Endoh +Date: Tue, 29 Sep 2020 13:15:58 +0900 +Subject: [PATCH] Make it more strict to interpret some headers + +Some regexps were too tolerant. +--- + lib/webrick/httprequest.rb | 6 +++--- + 1 file changed, 3 insertions(+), 3 deletions(-) + +diff --git a/lib/webrick/httprequest.rb b/lib/webrick/httprequest.rb +index 294bd91..d34eac7 100644 +--- a/lib/webrick/httprequest.rb ++++ b/lib/webrick/httprequest.rb +@@ -227,9 +227,9 @@ def parse(socket=nil) + raise HTTPStatus::BadRequest, "bad URI `#{@unparsed_uri}'." + end + +- if /close/io =~ self["connection"] ++ if /\Aclose\z/io =~ self["connection"] + @keep_alive = false +- elsif /keep-alive/io =~ self["connection"] ++ elsif /\Akeep-alive\z/io =~ self["connection"] + @keep_alive = true + elsif @http_version < "1.1" + @keep_alive = false +@@ -508,7 +508,7 @@ def read_body(socket, block) + return unless socket + if tc = self['transfer-encoding'] + case tc +- when /chunked/io then read_chunked(socket, block) ++ when /\Achunked\z/io then read_chunked(socket, block) + else raise HTTPStatus::NotImplemented, "Transfer-Encoding: #{tc}." + end + elsif self['content-length'] || @remaining_size diff --git a/ruby.spec b/ruby.spec index c7456a6..2a9c6a2 100644 --- a/ruby.spec +++ b/ruby.spec @@ -1,6 +1,6 @@ Name: ruby Version: 2.5.8 -Release: 3 +Release: 4 Summary: Object-oriented scripting language interpreter License: (Ruby or BSD) and Public Domain and MIT and CC0 and zlib and UCD URL: https://www.ruby-lang.org/en/ @@ -37,6 +37,7 @@ Patch0012: ruby-2.5.1-Avoid-need-of-C++-compiler-to-pass-the-test-suite.patch Patch6000: CVE-2019-19204.patch Patch6001: CVE-2019-19246.patch Patch6002: CVE-2019-16163.patch +Patch6003: CVE-2020-25613.patch Provides: %{name}-libs = %{version}-%{release} Obsoletes: %{name}-libs < %{version}-%{release} @@ -574,6 +575,14 @@ make runruby TESTRUN_SCRIPT=%{SOURCE13} %exclude %{gem_dir}/gems/xmlrpc-0.3.0/.* %changelog +* Thu Nov 5 2020 wutao - 2.5.8-4 +- fix CVE-2020-25613 +- WEBrick,a simple HTTP server bundled with Ruby,had not +- checked the transfer-encoding header value rigorously. +- An attacker may potentially exploit this issue to bypass +- a reverse proxy,which may lead to an HTTP Request Smuggling +- attack. + * Fri Aug 7 2020 shixuantong - 2.5.8-3 - Type:bugfix - ID:NA -- Gitee