From 852d1eeb18a7f82c7bd7c2f8be5dc82ad79169b6 Mon Sep 17 00:00:00 2001 From: changtao Date: Thu, 20 Feb 2025 01:08:48 +0800 Subject: [PATCH] fix CVE-2025-25184 (cherry picked from commit 612d980df88782bcc696ef98e4ce9c04d881f0f4) --- CVE-2025-25184.patch | 34 ++++++++++++++++++++++++++++++++++ rubygem-rack.spec | 9 ++++++++- 2 files changed, 42 insertions(+), 1 deletion(-) create mode 100644 CVE-2025-25184.patch diff --git a/CVE-2025-25184.patch b/CVE-2025-25184.patch new file mode 100644 index 0000000..34e30ff --- /dev/null +++ b/CVE-2025-25184.patch @@ -0,0 +1,34 @@ +From 074ae244430cda05c27ca91cda699709cfb3ad8e Mon Sep 17 00:00:00 2001 +From: Jeremy Evans +Date: Tue, 11 Feb 2025 19:10:05 -0800 +Subject: [PATCH] Escape non-printable characters when logging. +--- + lib/rack/common_logger.rb | 5 +++-- + 1 file changed, 3 insertions(+), 2 deletions(-) + +diff --git a/lib/rack/common_logger.rb b/lib/rack/common_logger.rb +index 9c6f921..68399c7 100644 +--- a/lib/rack/common_logger.rb ++++ b/lib/rack/common_logger.rb +@@ -15,7 +15,7 @@ module Rack + # The actual format is slightly different than the above due to the + # separation of SCRIPT_NAME and PATH_INFO, and because the elapsed + # time in seconds is included at the end. +- FORMAT = %{%s - %s [%s] "%s %s%s%s %s" %d %s %0.4f\n} ++ FORMAT = %{%s - %s [%s] "%s %s%s%s %s" %d %s %0.4f } + + # +logger+ can be any object that supports the +write+ or +<<+ methods, + # which includes the standard library Logger. These methods are called +@@ -60,7 +60,8 @@ module Rack + length, + Utils.clock_time - began_at ] + +- msg.gsub!(/[^[:print:]\n]/) { |c| "\\x#{c.ord}" } ++ msg.gsub!(/[^[:print:]]/) { |c| sprintf("\\x%x", c.ord) } ++ msg[-1] = "\n" + + logger = @logger || env[RACK_ERRORS] + +-- +2.46.0 + diff --git a/rubygem-rack.spec b/rubygem-rack.spec index bd728f1..7b3c7c5 100644 --- a/rubygem-rack.spec +++ b/rubygem-rack.spec @@ -4,7 +4,7 @@ Name: rubygem-%{gem_name} Version: 2.2.3.1 Epoch: 1 -Release: 7 +Release: 8 Summary: A modular Ruby webserver interface License: MIT and BSD URL: https://rack.github.io/ @@ -19,6 +19,7 @@ Patch5: CVE-2022-44571.patch Patch6: CVE-2022-44572.patch Patch7: CVE-2025-27610.patch Patch8: CVE-2025-27111.patch +Patch9: CVE-2025-25184.patch BuildRequires: ruby(release) rubygems-devel ruby >= 2.2.2 rubygem(concurrent-ruby) BuildRequires: memcached rubygem(memcache-client) rubygem(minitest) @@ -108,6 +109,12 @@ popd %doc %{gem_instdir}/contrib %changelog +* Tue Mar 18 2025 changtao - 1:2.2.3.1-8 +- Type:CVE +- CVE:CVE-2025-25184 +- SUG:NA +- DESC:fix CVE-2025-25184 + * Thu Mar 13 2025 changtao - 1:2.2.3.1-7 - Type:CVE - CVE:CVE-2025-27111 -- Gitee