mirror of
https://git.yoctoproject.org/poky
synced 2026-06-02 13:29:49 +00:00
ruby: 2.7.1 -> 2.7.3
This release includes security fixes. CVE-2021-28965: XML round-trip vulnerability in REXML CVE-2021-28966: Path traversal in Tempfile on Windows CVE-2020-25613 fixed in 2.7.2, do drop the patch release notes for 2.7.2 and 2.7.3 https://www.ruby-lang.org/en/news/2020/10/02/ruby-2-7-2-released/ https://www.ruby-lang.org/en/news/2021/04/05/ruby-2-7-3-released/ (From OE-Core rev: 4de0d54827bc4645b69e5a0043b6f285b0193402) Signed-off-by: Lee Chee Yang <chee.yang.lee@intel.com> Signed-off-by: Steve Sakoman <steve@sakoman.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>
This commit is contained in:
committed by
Richard Purdie
parent
1ed30171a6
commit
7860e4b563
@@ -1,40 +0,0 @@
|
||||
From 8946bb38b4d87549f0d99ed73c62c41933f97cc7 Mon Sep 17 00:00:00 2001
|
||||
From: Yusuke Endoh <mame@ruby-lang.org>
|
||||
Date: Tue, 29 Sep 2020 13:15:58 +0900
|
||||
Subject: [PATCH] Make it more strict to interpret some headers
|
||||
|
||||
Some regexps were too tolerant.
|
||||
|
||||
Upstream-Status: Backport
|
||||
[https://github.com/ruby/webrick/commit/8946bb38b4d87549f0d99ed73c62c41933f97cc7]
|
||||
CVE: CVE-2020-25613
|
||||
Signed-off-by: Chee Yang Lee <chee.yang.lee@intel.com>
|
||||
---
|
||||
lib/webrick/httprequest.rb | 6 +++---
|
||||
1 file changed, 3 insertions(+), 3 deletions(-)
|
||||
|
||||
diff --git a/lib/webrick/httprequest.rb b/lib/webrick/httprequest.rb
|
||||
index 294bd91..d34eac7 100644
|
||||
--- a/lib/webrick/httprequest.rb
|
||||
+++ b/lib/webrick/httprequest.rb
|
||||
@@ -227,9 +227,9 @@ def parse(socket=nil)
|
||||
raise HTTPStatus::BadRequest, "bad URI `#{@unparsed_uri}'."
|
||||
end
|
||||
|
||||
- if /close/io =~ self["connection"]
|
||||
+ if /\Aclose\z/io =~ self["connection"]
|
||||
@keep_alive = false
|
||||
- elsif /keep-alive/io =~ self["connection"]
|
||||
+ elsif /\Akeep-alive\z/io =~ self["connection"]
|
||||
@keep_alive = true
|
||||
elsif @http_version < "1.1"
|
||||
@keep_alive = false
|
||||
@@ -508,7 +508,7 @@ def read_body(socket, block)
|
||||
return unless socket
|
||||
if tc = self['transfer-encoding']
|
||||
case tc
|
||||
- when /chunked/io then read_chunked(socket, block)
|
||||
+ when /\Achunked\z/io then read_chunked(socket, block)
|
||||
else raise HTTPStatus::NotImplemented, "Transfer-Encoding: #{tc}."
|
||||
end
|
||||
elsif self['content-length'] || @remaining_size
|
||||
@@ -6,12 +6,11 @@ SRC_URI += " \
|
||||
file://remove_has_include_macros.patch \
|
||||
file://run-ptest \
|
||||
file://0001-Modify-shebang-of-libexec-y2racc-and-libexec-racc2y.patch \
|
||||
file://CVE-2020-25613.patch \
|
||||
file://0001-template-Makefile.in-do-not-write-host-cross-cc-item.patch \
|
||||
"
|
||||
|
||||
SRC_URI[md5sum] = "debb9c325bf65021214451660f46e909"
|
||||
SRC_URI[sha256sum] = "d418483bdd0000576c1370571121a6eb24582116db0b7bb2005e90e250eae418"
|
||||
SRC_URI[md5sum] = "72ef97685008981de3ddb748d0dab31f"
|
||||
SRC_URI[sha256sum] = "8925a95e31d8f2c81749025a52a544ea1d05dad18794e6828709268b92e55338"
|
||||
|
||||
PACKAGECONFIG ??= ""
|
||||
PACKAGECONFIG += "${@bb.utils.filter('DISTRO_FEATURES', 'ipv6', d)}"
|
||||
Reference in New Issue
Block a user