From e036ecc2713d2bce011e47ab7f47a6729d034f4c Mon Sep 17 00:00:00 2001 From: Jarek Prokop Date: Tue, 20 Jul 2021 17:37:00 +0200 Subject: [PATCH] Upgrade to Ruby 3.0.2. - Fix command injection vulnerability in RDoc. (CVE-2021-31799) - Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host. (CVE-2021-31810) - Fix StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066) - Fix dependencies of gems with explicit source installed from a different source. (CVE-2020-36327) Related: rhbz#1938942 --- ...0-Enable-configuration-of-archlibdir.patch | 2 +- ...ed-paths-when-empty-version-string-i.patch | 2 +- ruby-2.1.0-always-use-i386.patch | 2 +- ruby-2.1.0-custom-rubygems-location.patch | 8 +++---- ruby-2.3.0-ruby_version.patch | 10 ++++----- ruby.spec | 22 ++++++++++++++----- sources | 2 +- 7 files changed, 29 insertions(+), 19 deletions(-) diff --git a/ruby-2.1.0-Enable-configuration-of-archlibdir.patch b/ruby-2.1.0-Enable-configuration-of-archlibdir.patch index 9759776..32806da 100644 --- a/ruby-2.1.0-Enable-configuration-of-archlibdir.patch +++ b/ruby-2.1.0-Enable-configuration-of-archlibdir.patch @@ -11,7 +11,7 @@ diff --git a/configure.ac b/configure.ac index d261ea57b5..3c13076b82 100644 --- a/configure.ac +++ b/configure.ac -@@ -3211,6 +3211,11 @@ AS_IF([test ${multiarch+set}], [ +@@ -3240,6 +3240,11 @@ AS_IF([test ${multiarch+set}], [ ]) archlibdir='${libdir}/${arch}' diff --git a/ruby-2.1.0-Prevent-duplicated-paths-when-empty-version-string-i.patch b/ruby-2.1.0-Prevent-duplicated-paths-when-empty-version-string-i.patch index 2e751cb..118203c 100644 --- a/ruby-2.1.0-Prevent-duplicated-paths-when-empty-version-string-i.patch +++ b/ruby-2.1.0-Prevent-duplicated-paths-when-empty-version-string-i.patch @@ -14,7 +14,7 @@ diff --git a/configure.ac b/configure.ac index c42436c23d..d261ea57b5 100644 --- a/configure.ac +++ b/configure.ac -@@ -3852,7 +3852,8 @@ AS_CASE(["$ruby_version_dir_name"], +@@ -3881,7 +3881,8 @@ AS_CASE(["$ruby_version_dir_name"], ruby_version_dir=/'${ruby_version_dir_name}' if test -z "${ruby_version_dir_name}"; then diff --git a/ruby-2.1.0-always-use-i386.patch b/ruby-2.1.0-always-use-i386.patch index c1b3942..de58295 100644 --- a/ruby-2.1.0-always-use-i386.patch +++ b/ruby-2.1.0-always-use-i386.patch @@ -11,7 +11,7 @@ diff --git a/configure.ac b/configure.ac index 3c13076b82..93af30321d 100644 --- a/configure.ac +++ b/configure.ac -@@ -3916,6 +3916,8 @@ AC_SUBST(vendorarchdir)dnl +@@ -3945,6 +3945,8 @@ AC_SUBST(vendorarchdir)dnl AC_SUBST(CONFIGURE, "`echo $0 | sed 's|.*/||'`")dnl AC_SUBST(configure_args, "`echo "${ac_configure_args}" | sed 's/\\$/$$/g'`")dnl diff --git a/ruby-2.1.0-custom-rubygems-location.patch b/ruby-2.1.0-custom-rubygems-location.patch index 1646675..b7157ff 100644 --- a/ruby-2.1.0-custom-rubygems-location.patch +++ b/ruby-2.1.0-custom-rubygems-location.patch @@ -15,7 +15,7 @@ diff --git a/configure.ac b/configure.ac index 93af30321d..bc13397e0e 100644 --- a/configure.ac +++ b/configure.ac -@@ -3888,6 +3888,10 @@ AC_ARG_WITH(vendorarchdir, +@@ -3917,6 +3917,10 @@ AC_ARG_WITH(vendorarchdir, [vendorarchdir=$withval], [vendorarchdir=${multiarch+'${rubysitearchprefix}/vendor_ruby'${ruby_version_dir}}${multiarch-'${vendorlibdir}/${sitearch}'}]) @@ -26,7 +26,7 @@ index 93af30321d..bc13397e0e 100644 AS_IF([test "${LOAD_RELATIVE+set}"], [ AC_DEFINE_UNQUOTED(LOAD_RELATIVE, $LOAD_RELATIVE) RUBY_EXEC_PREFIX='' -@@ -3912,6 +3916,7 @@ AC_SUBST(sitearchdir)dnl +@@ -3941,6 +3941,7 @@ AC_SUBST(sitearchdir)dnl AC_SUBST(vendordir)dnl AC_SUBST(vendorlibdir)dnl AC_SUBST(vendorarchdir)dnl @@ -67,7 +67,7 @@ diff --git a/tool/rbinstall.rb b/tool/rbinstall.rb index e9110a17ca..76a1f0a315 100755 --- a/tool/rbinstall.rb +++ b/tool/rbinstall.rb -@@ -348,6 +348,7 @@ def CONFIG.[](name, mandatory = false) +@@ -349,6 +349,7 @@ def CONFIG.[](name, mandatory = false) vendorlibdir = CONFIG["vendorlibdir"] vendorarchlibdir = CONFIG["vendorarchdir"] end @@ -75,7 +75,7 @@ index e9110a17ca..76a1f0a315 100755 mandir = CONFIG["mandir", true] docdir = CONFIG["docdir", true] enable_shared = CONFIG["ENABLE_SHARED"] == 'yes' -@@ -580,7 +581,16 @@ def stub +@@ -581,7 +581,16 @@ def stub install?(:local, :comm, :lib) do prepare "library scripts", rubylibdir noinst = %w[*.txt *.rdoc *.gemspec] diff --git a/ruby-2.3.0-ruby_version.patch b/ruby-2.3.0-ruby_version.patch index f596602..4fd6530 100644 --- a/ruby-2.3.0-ruby_version.patch +++ b/ruby-2.3.0-ruby_version.patch @@ -20,7 +20,7 @@ diff --git a/configure.ac b/configure.ac index 80b137e380..63cd3b4f8b 100644 --- a/configure.ac +++ b/configure.ac -@@ -3803,9 +3803,6 @@ AS_CASE(["$target_os"], +@@ -3832,9 +3832,6 @@ AS_CASE(["$target_os"], rubyw_install_name='$(RUBYW_INSTALL_NAME)' ]) @@ -30,7 +30,7 @@ index 80b137e380..63cd3b4f8b 100644 rubyarchprefix=${multiarch+'${archlibdir}/${RUBY_BASE_NAME}'}${multiarch-'${rubylibprefix}/${arch}'} AC_ARG_WITH(rubyarchprefix, AS_HELP_STRING([--with-rubyarchprefix=DIR], -@@ -3828,56 +3825,62 @@ AC_ARG_WITH(ridir, +@@ -3857,56 +3857,62 @@ AC_ARG_WITH(ridir, AC_SUBST(ridir) AC_SUBST(RI_BASE_NAME) @@ -120,7 +120,7 @@ index 80b137e380..63cd3b4f8b 100644 AS_IF([test "${LOAD_RELATIVE+set}"], [ AC_DEFINE_UNQUOTED(LOAD_RELATIVE, $LOAD_RELATIVE) -@@ -3894,6 +3897,7 @@ AC_SUBST(sitearchincludedir)dnl +@@ -3923,6 +3923,7 @@ AC_SUBST(sitearchincludedir)dnl AC_SUBST(arch)dnl AC_SUBST(sitearch)dnl AC_SUBST(ruby_version)dnl @@ -171,7 +171,7 @@ diff --git a/tool/rbinstall.rb b/tool/rbinstall.rb index d4c110e..d39c9a6 100755 --- a/tool/rbinstall.rb +++ b/tool/rbinstall.rb -@@ -438,7 +438,7 @@ def CONFIG.[](name, mandatory = false) +@@ -439,7 +439,7 @@ def CONFIG.[](name, mandatory = false) install?(:doc, :rdoc) do if $rdocdir @@ -274,7 +274,7 @@ diff --git a/configure.ac b/configure.ac index a00f2b6776..999e2d6d5d 100644 --- a/configure.ac +++ b/configure.ac -@@ -81,7 +81,7 @@ RUBY_BASE_NAME=`echo ruby | sed "$program_transform_name"` +@@ -107,7 +107,7 @@ RUBY_BASE_NAME=`echo ruby | sed "$program_transform_name"` RUBYW_BASE_NAME=`echo rubyw | sed "$program_transform_name"` AC_SUBST(RUBY_BASE_NAME) AC_SUBST(RUBYW_BASE_NAME) diff --git a/ruby.spec b/ruby.spec index cf9f28b..5ea6891 100644 --- a/ruby.spec +++ b/ruby.spec @@ -1,6 +1,6 @@ %global major_version 3 %global minor_version 0 -%global teeny_version 1 +%global teeny_version 2 %global major_minor_version %{major_version}.%{minor_version} %global ruby_version %{major_minor_version}.%{teeny_version} @@ -22,7 +22,7 @@ %endif -%global release 138 +%global release 139 %{!?release_string:%define release_string %{?development_release:0.}%{release}%{?development_release:.%{development_release}}%{?dist}} # The RubyGems library has to stay out of Ruby directory tree, since the @@ -30,11 +30,11 @@ %global rubygems_dir %{_datadir}/rubygems # Bundled libraries versions -%global rubygems_version 3.2.15 +%global rubygems_version 3.2.22 %global rubygems_molinillo_version 0.7.0 # Default gems. -%global bundler_version 2.2.15 +%global bundler_version 2.2.22 %global bundler_connection_pool_version 2.2.2 %global bundler_fileutils_version 1.4.1 %global bundler_molinillo_version 0.7.0 @@ -52,7 +52,7 @@ %global openssl_version 2.2.0 %global psych_version 3.3.0 %global racc_version 1.5.1 -%global rdoc_version 6.3.0 +%global rdoc_version 6.3.1 # Bundled gems. %global minitest_version 5.14.2 @@ -1146,7 +1146,7 @@ MSPECOPTS="" %{gem_dir}/specifications/default/logger-1.4.3.gemspec %{gem_dir}/specifications/default/matrix-0.3.1.gemspec %{gem_dir}/specifications/default/mutex_m-0.1.1.gemspec -%{gem_dir}/specifications/default/net-ftp-0.1.1.gemspec +%{gem_dir}/specifications/default/net-ftp-0.1.2.gemspec %{gem_dir}/specifications/default/net-http-0.1.1.gemspec %{gem_dir}/specifications/default/net-imap-0.1.1.gemspec %{gem_dir}/specifications/default/net-pop-0.1.1.gemspec @@ -1339,6 +1339,16 @@ MSPECOPTS="" %changelog +* Tue Jul 13 2021 Jarek Prokop - 3.0.2-139 +- Upgrade to Ruby 3.0.2. + Related: rhbz#1938942 +- Fix command injection vulnerability in RDoc. (CVE-2021-31799) +- Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host. + (CVE-2021-31810) +- Fix StartTLS stripping vulnerability in Net::IMAP (CVE-2021-32066) +- Fix dependencies of gems with explicit source installed from a + different source. (CVE-2020-36327) + * Mon Jun 07 2021 Jarek Prokop - 3.0.1-138 - Upgrade to Ruby 3.0.1 by merging Fedora rawhide branch (commit: 6b2ff68). * Add missing `rubygem-` prefix for bundled provide of 'connection_pool'. diff --git a/sources b/sources index bed9a6d..fc750ca 100644 --- a/sources +++ b/sources @@ -1 +1 @@ -SHA512 (ruby-3.0.1.tar.xz) = 97d2e883656060846b304368d9d836e2f3ef39859c36171c9398a0573818e4ed75bfd7460f901a9553f7f53518c505327a66e74f83704a881469f5ac61fe13d7 +SHA512 (ruby-3.0.2.tar.xz) = 0f702e2d8ca1342a9d4284dbdd234a3588e057b92566353aa7c21835cf09a3932864b2acf459a976960a1704e9befa562155d36b98b7cda8bd99526e10a374c4