components/ruby/ruby-18/rubygems-patches/01-CVE-2013-4287-4363.patch
author April Chin <april.chin@oracle.com>
Thu, 21 Nov 2013 13:50:26 -0800
changeset 1567 b5493d203180
permissions -rw-r--r--
17650524 problem in UTILITY/RUBY
Ignore whitespace changes - Everywhere: Within whitespace: At end of lines:
1567
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
     1
Fix for the following two CVE issues:
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
     2
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
     3
CVE-2013-4287 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
     4
Algorithmic complexity vulnerability in Gem::Version::VERSION_PATTERN in 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
     5
lib/rubygems/version.rb in RubyGems before 1.8.23.1, 1.8.24 through 1.8.25, 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
     6
2.0.x before 2.0.8, and 2.1.x before 2.1.0, as used in Ruby 1.9.0 through 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
     7
2.0.0p247, allows remote attackers to cause a denial of service (CPU 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
     8
consumption) via a crafted gem version that triggers a large amount of 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
     9
backtracking in a regular expression. 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    10
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    11
CVE-2013-4363 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    12
Algorithmic complexity vulnerability in 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    13
Gem::Version::ANCHORED_VERSION_PATTERN in lib/rubygems/version.rb in RubyGems 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    14
before 1.8.23.2, 1.8.24 through 1.8.26, 2.0.x before 2.0.10, and 2.1.x before 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    15
2.1.5, as used in Ruby 1.9.0 through 2.0.0p247, allows remote attackers to 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    16
cause a denial of service (CPU consumption) via a crafted gem version that 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    17
triggers a large amount of backtracking in a regular expression. NOTE: this 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    18
issue is due to an incomplete fix for CVE-2013-4287. 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    19
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    20
The fixes come from
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    21
http://rubygems.rubyforge.org/rubygems-update/CVE-2013-4287_txt.html 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    22
and 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    23
http://rubygems.rubyforge.org/rubygems-update/CVE-2013-4363_txt.html 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    24
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    25
--- rubygems-1.3.5-orig//lib/rubygems/version.rb	Mon Jun 22 15:54:36 2009
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    26
+++ rubygems-1.3.5/lib/rubygems/version.rb	Thu Oct 24 16:02:38 2013
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    27
@@ -69,12 +69,12 @@
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    28
 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    29
   include Comparable
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    30
 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    31
-  VERSION_PATTERN = '[0-9]+(\.[0-9a-z]+)*'
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    32
+  VERSION_PATTERN = '[0-9]+(?>\.[0-9a-z]+)*'
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    33
 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    34
   attr_reader :version
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    35
 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    36
   def self.correct?(version)
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    37
-    pattern = /\A\s*(#{VERSION_PATTERN})*\s*\z/
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    38
+    pattern = /\A\s*(#{VERSION_PATTERN})?\s*\z/
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    39
 
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    40
     version.is_a? Integer or
b5493d203180 17650524 problem in UTILITY/RUBY
April Chin <april.chin@oracle.com>
parents:
diff changeset
    41
       version =~ pattern or