From 61c6e190698c4d8ceb3097ac262d3fadb4e57ca9 Mon Sep 17 00:00:00 2001 From: changtao Date: Tue, 18 Feb 2025 17:59:42 +0800 Subject: [PATCH] fix CVE-2025-27610 (cherry picked from commit 6d9851b633126c0de15227aea6a60bbe0259539c) --- Fix-CVE-2025-27610.patch | 28 ++++++++++++++++++++++++++++ rubygem-rack.spec | 9 ++++++++- 2 files changed, 36 insertions(+), 1 deletion(-) create mode 100644 Fix-CVE-2025-27610.patch diff --git a/Fix-CVE-2025-27610.patch b/Fix-CVE-2025-27610.patch new file mode 100644 index 0000000..bc1a3e1 --- /dev/null +++ b/Fix-CVE-2025-27610.patch @@ -0,0 +1,28 @@ +From 50caab74fa01ee8f5dbdee7bb2782126d20c6583 Mon Sep 17 00:00:00 2001 +From: Samuel Williams +Date: Sat, 8 Mar 2025 11:13:39 +1300 +Subject: [PATCH] Use a fully resolved file path when confirming if a file can + be served by `Rack::Static`. + +--- + lib/rack/static.rb | 3 ++- + 1 file changed, 2 insertions(+), 1 deletion(-) + +diff --git a/lib/rack/static.rb b/lib/rack/static.rb +index 8cb58b2..0ea78a1 100644 +--- a/lib/rack/static.rb ++++ b/lib/rack/static.rb +@@ -122,8 +122,9 @@ module Rack + + def call(env) + path = env[PATH_INFO] ++ actual_path = Utils.clean_path_info(Utils.unescape_path(path)) + +- if can_serve(path) ++ if can_serve(actual_path) + if overwrite_file_path(path) + env[PATH_INFO] = (add_index_root?(path) ? path + @index : @urls[path]) + elsif @gzip && env['HTTP_ACCEPT_ENCODING'] && /\bgzip\b/.match?(env['HTTP_ACCEPT_ENCODING']) +-- +2.46.0 + diff --git a/rubygem-rack.spec b/rubygem-rack.spec index d948d8c..5cb3fa8 100644 --- a/rubygem-rack.spec +++ b/rubygem-rack.spec @@ -4,7 +4,7 @@ Name: rubygem-%{gem_name} Version: 2.2.4 Epoch: 1 -Release: 8 +Release: 9 Summary: A modular Ruby webserver interface License: MIT and BSD URL: https://rack.github.io/ @@ -17,6 +17,7 @@ Patch4: Fix-CVE-2024-25126.patch Patch5: Fix-CVE-2022-44570.patch Patch6: Fix-CVE-2022-44571.patch Patch7: Fix-CVE-2022-44572.patch +Patch8: Fix-CVE-2025-27610.patch BuildRequires: ruby(release) rubygems-devel ruby >= 2.2.2 git BuildRequires: memcached rubygem(memcache-client) rubygem(minitest) BuildRequires: rubygem(memcache-client) @@ -105,6 +106,12 @@ popd %doc %{gem_instdir}/contrib %changelog +* Wed Mar 12 2025 changtao - 1:2.2.4-9 +- Type:CVE +- CVE:CVE-2025-27610 +- SUG:NA +- DESC:fix CVE-2025-27610 + * Thu Apr 11 2024 zouzhimin - 1:2.2.4-8 - Type:CVES - ID:CVE-2022-44572 -- Gitee