rpms/ruby
7
0
Fork 0
Code Issues Pull Requests Releases Activity

Upgrade to Ruby 3.0.2.

Browse Source 
- Fix command injection vulnerability in RDoc.
- Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host.
- Fix StartTLS stripping vulnerability in Net::IMAP
- Fix dependencies of gems with explicit source installed from a
  different source.

Resolves: CVE-2021-31810
Resolves: CVE-2021-32066
Resolves: CVE-2021-31799
Resolves: CVE-2020-36327
This commit is contained in:
Jarek Prokop 2021-07-20 17:37:00 +02:00 committed by Pavel Valena
parent 3bf9ce7e0d
commit 772e294b42
7 changed files with 31 additions and 19 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
ruby-2.1.0-Enable-configuration-of-archlibdir.patch
View File

@ -11,7 +11,7 @@ diff --git a/configure.ac b/configure.ac
index d261ea57b5..3c13076b82 100644
--- a/configure.ac
+++ b/configure.ac
@@ -3211,6 +3211,11 @@ AS_IF([test ${multiarch+set}], [
@@ -3240,6 +3240,11 @@ AS_IF([test ${multiarch+set}], [
])
archlibdir='${libdir}/${arch}'

2
ruby-2.1.0-Prevent-duplicated-paths-when-empty-version-string-i.patch
View File

@ -14,7 +14,7 @@ diff --git a/configure.ac b/configure.ac
index c42436c23d..d261ea57b5 100644
--- a/configure.ac
+++ b/configure.ac
@@ -3852,7 +3852,8 @@ AS_CASE(["$ruby_version_dir_name"],
@@ -3881,7 +3881,8 @@ AS_CASE(["$ruby_version_dir_name"],
ruby_version_dir=/'${ruby_version_dir_name}'
if test -z "${ruby_version_dir_name}"; then

2
ruby-2.1.0-always-use-i386.patch
View File

@ -11,7 +11,7 @@ diff --git a/configure.ac b/configure.ac
index 3c13076b82..93af30321d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -3916,6 +3916,8 @@ AC_SUBST(vendorarchdir)dnl
@@ -3945,6 +3945,8 @@ AC_SUBST(vendorarchdir)dnl
AC_SUBST(CONFIGURE, "`echo $0 | sed 's|.*/||'`")dnl
AC_SUBST(configure_args, "`echo "${ac_configure_args}" | sed 's/\\$/$$/g'`")dnl

8
ruby-2.1.0-custom-rubygems-location.patch
View File

@ -15,7 +15,7 @@ diff --git a/configure.ac b/configure.ac
index 93af30321d..bc13397e0e 100644
--- a/configure.ac
+++ b/configure.ac
@@ -3888,6 +3888,10 @@ AC_ARG_WITH(vendorarchdir,
@@ -3917,6 +3917,10 @@ AC_ARG_WITH(vendorarchdir,
[vendorarchdir=$withval],
[vendorarchdir=${multiarch+'${rubysitearchprefix}/vendor_ruby'${ruby_version_dir}}${multiarch-'${vendorlibdir}/${sitearch}'}])
@ -26,7 +26,7 @@ index 93af30321d..bc13397e0e 100644
AS_IF([test "${LOAD_RELATIVE+set}"], [
AC_DEFINE_UNQUOTED(LOAD_RELATIVE, $LOAD_RELATIVE)
RUBY_EXEC_PREFIX=''
@@ -3912,6 +3916,7 @@ AC_SUBST(sitearchdir)dnl
@@ -3941,6 +3941,7 @@ AC_SUBST(sitearchdir)dnl
AC_SUBST(vendordir)dnl
AC_SUBST(vendorlibdir)dnl
AC_SUBST(vendorarchdir)dnl
@ -67,7 +67,7 @@ diff --git a/tool/rbinstall.rb b/tool/rbinstall.rb
index e9110a17ca..76a1f0a315 100755
--- a/tool/rbinstall.rb
+++ b/tool/rbinstall.rb
@@ -348,6 +348,7 @@ def CONFIG.[](name, mandatory = false)
@@ -349,6 +349,7 @@ def CONFIG.[](name, mandatory = false)
vendorlibdir = CONFIG["vendorlibdir"]
vendorarchlibdir = CONFIG["vendorarchdir"]
end
@ -75,7 +75,7 @@ index e9110a17ca..76a1f0a315 100755
mandir = CONFIG["mandir", true]
docdir = CONFIG["docdir", true]
enable_shared = CONFIG["ENABLE_SHARED"] == 'yes'
@@ -580,7 +581,16 @@ def stub
@@ -581,7 +581,16 @@ def stub
install?(:local, :comm, :lib) do
prepare "library scripts", rubylibdir
noinst = %w[*.txt *.rdoc *.gemspec]

10
ruby-2.3.0-ruby_version.patch
View File

@ -20,7 +20,7 @@ diff --git a/configure.ac b/configure.ac
index 80b137e380..63cd3b4f8b 100644
--- a/configure.ac
+++ b/configure.ac
@@ -3803,9 +3803,6 @@ AS_CASE(["$target_os"],
@@ -3832,9 +3832,6 @@ AS_CASE(["$target_os"],
rubyw_install_name='$(RUBYW_INSTALL_NAME)'
])
@ -30,7 +30,7 @@ index 80b137e380..63cd3b4f8b 100644
rubyarchprefix=${multiarch+'${archlibdir}/${RUBY_BASE_NAME}'}${multiarch-'${rubylibprefix}/${arch}'}
AC_ARG_WITH(rubyarchprefix,
AS_HELP_STRING([--with-rubyarchprefix=DIR],
@@ -3828,56 +3825,62 @@ AC_ARG_WITH(ridir,
@@ -3857,56 +3857,62 @@ AC_ARG_WITH(ridir,
AC_SUBST(ridir)
AC_SUBST(RI_BASE_NAME)
@ -120,7 +120,7 @@ index 80b137e380..63cd3b4f8b 100644
AS_IF([test "${LOAD_RELATIVE+set}"], [
AC_DEFINE_UNQUOTED(LOAD_RELATIVE, $LOAD_RELATIVE)
@@ -3894,6 +3897,7 @@ AC_SUBST(sitearchincludedir)dnl
@@ -3923,6 +3923,7 @@ AC_SUBST(sitearchincludedir)dnl
AC_SUBST(arch)dnl
AC_SUBST(sitearch)dnl
AC_SUBST(ruby_version)dnl
@ -171,7 +171,7 @@ diff --git a/tool/rbinstall.rb b/tool/rbinstall.rb
index d4c110e..d39c9a6 100755
--- a/tool/rbinstall.rb
+++ b/tool/rbinstall.rb
@@ -438,7 +438,7 @@ def CONFIG.[](name, mandatory = false)
@@ -439,7 +439,7 @@ def CONFIG.[](name, mandatory = false)
install?(:doc, :rdoc) do
if $rdocdir
@ -274,7 +274,7 @@ diff --git a/configure.ac b/configure.ac
index a00f2b6776..999e2d6d5d 100644
--- a/configure.ac
+++ b/configure.ac
@@ -81,7 +81,7 @@ RUBY_BASE_NAME=`echo ruby | sed "$program_transform_name"`
@@ -107,7 +107,7 @@ RUBY_BASE_NAME=`echo ruby | sed "$program_transform_name"`
RUBYW_BASE_NAME=`echo rubyw | sed "$program_transform_name"`
AC_SUBST(RUBY_BASE_NAME)
AC_SUBST(RUBYW_BASE_NAME)

24
ruby.spec
View File

@ -1,6 +1,6 @@
%global major_version 3
%global minor_version 0
%global teeny_version 1
%global teeny_version 2
%global major_minor_version %{major_version}.%{minor_version}
%global ruby_version %{major_minor_version}.%{teeny_version}
@ -22,7 +22,7 @@
%endif
%global release 153
%global release 154
%{!?release_string:%define release_string %{?development_release:0.}%{release}%{?development_release:.%{development_release}}%{?dist}}
# The RubyGems library has to stay out of Ruby directory tree, since the
@ -30,11 +30,11 @@
%global rubygems_dir %{_datadir}/rubygems
# Bundled libraries versions
%global rubygems_version 3.2.15
%global rubygems_version 3.2.22
%global rubygems_molinillo_version 0.7.0
# Default gems.
%global bundler_version 2.2.15
%global bundler_version 2.2.22
%global bundler_connection_pool_version 2.2.2
%global bundler_fileutils_version 1.4.1
%global bundler_molinillo_version 0.7.0
@ -52,7 +52,7 @@
%global openssl_version 2.2.0
%global psych_version 3.3.0
%global racc_version 1.5.1
%global rdoc_version 6.3.0
%global rdoc_version 6.3.1
# Bundled gems.
%global minitest_version 5.14.2
@ -1229,7 +1229,7 @@ MSPECOPTS=""
%{gem_dir}/specifications/default/logger-1.4.3.gemspec
%{gem_dir}/specifications/default/matrix-0.3.1.gemspec
%{gem_dir}/specifications/default/mutex_m-0.1.1.gemspec
%{gem_dir}/specifications/default/net-ftp-0.1.1.gemspec
%{gem_dir}/specifications/default/net-ftp-0.1.2.gemspec
%{gem_dir}/specifications/default/net-http-0.1.1.gemspec
%{gem_dir}/specifications/default/net-imap-0.1.1.gemspec
%{gem_dir}/specifications/default/net-pop-0.1.1.gemspec
@ -1422,6 +1422,18 @@ MSPECOPTS=""
%changelog
* Mon Aug 16 2021 Pavel Valena <pvalena@redhat.com> - 3.0.1-154
- Upgrade to Ruby 3.0.2.
- Fix command injection vulnerability in RDoc.
Resolves: CVE-2021-31799
- Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host.
Resolves: CVE-2021-31810
- Fix StartTLS stripping vulnerability in Net::IMAP
Resolves: CVE-2021-32066
- Fix dependencies of gems with explicit source installed from a
different source.
Resolves: CVE-2020-36327
* Thu Aug 19 2021 Carlos O'Donell <codonell@redhat.com> - 3.0.1-153
- Rebuilt for libffi 3.4.2 SONAME transition.
Related: rhbz#1891914

2
sources
View File

@ -1 +1 @@
SHA512 (ruby-3.0.1.tar.xz) = 97d2e883656060846b304368d9d836e2f3ef39859c36171c9398a0573818e4ed75bfd7460f901a9553f7f53518c505327a66e74f83704a881469f5ac61fe13d7
SHA512 (ruby-3.0.2.tar.xz) = 0f702e2d8ca1342a9d4284dbdd234a3588e057b92566353aa7c21835cf09a3932864b2acf459a976960a1704e9befa562155d36b98b7cda8bd99526e10a374c4