3cd2ea3699
* Upgrade to Ruby 3.0.7. Resolves: RHEL-35740 The released Ruby 3.0.5 includes the following fix. * Fix HTTP response splitting in CGI. Resolves: RHEL-35741 The released Ruby 3.0.6 includes the following fixes. * Fix ReDoS vulnerability in URI. Resolves: RHEL-35742 * Fix ReDoS vulnerability in Time. Resolves: RHEL-35743 The released Ruby 3.0.7 includes the following fixes. * Fix buffer overread vulnerability in StringIO. Resolves: RHEL-35744 * Fix RCE vulnerability with .rdoc_options in RDoc. Resolves: RHEL-35746 * Fix arbitrary memory address read vulnerability with Regex search. Resolves: RHEL-35747 Replaced the patch ruby-3.0.3-ext-openssl-extconf.rb-require-OpenSSL-version-1.0.1.patch with the tiny patch ruby-ext-openssl-extconf.rb-ignore-OpenSSL-version-check.patch not using the reverse logic. Because it was hard to maintain the patch file, when the included file was updated on the upstream. Added the following patches. * Fix net-http test errors due to expired certificate. The patch ruby-3.4.0-ruby-net-http-Renew-test-certificates.patch was copied from the part on the Fedora rawhide <05a6c9c8f3>. * Fix `TestNetHTTPS#test_session_reuse_but_expire` test failure cause. The patch ruby-3.3.1-Fix-test-session-reuse-but-expire.patch was copied from the part on Fedora rawhide <a34f33bc50>. As a reference, the part comes from Fedora ruby-3.3 branch <99d21ecc4c>.
29 lines
985 B
Diff
29 lines
985 B
Diff
From 1816c142a4d66a75c23ccf6fd89a06cbe422e34f Mon Sep 17 00:00:00 2001
|
|
From: "NARUSE, Yui" <nurse@users.noreply.github.com>
|
|
Date: Sat, 3 Feb 2024 22:35:44 +0900
|
|
Subject: [PATCH] Fix test session reuse but expire (#9824)
|
|
|
|
* OpenSSL 3.2.1 30 Jan 2024 is also broken
|
|
|
|
Import 45064610725ddd81a5ea3775da35aa46985bc789 from ruby_3_3 branch
|
|
tentatively.
|
|
---
|
|
test/net/http/test_https.rb | 1 +
|
|
1 file changed, 1 insertion(+)
|
|
|
|
diff --git a/test/net/http/test_https.rb b/test/net/http/test_https.rb
|
|
index 7b97e39586..aef748dfa0 100644
|
|
--- a/test/net/http/test_https.rb
|
|
+++ b/test/net/http/test_https.rb
|
|
@@ -178,6 +178,7 @@ def test_session_reuse
|
|
def test_session_reuse_but_expire
|
|
# FIXME: The new_session_cb is known broken for clients in OpenSSL 1.1.0h.
|
|
skip if OpenSSL::OPENSSL_LIBRARY_VERSION =~ /OpenSSL 1.1.0h/
|
|
+ omit if OpenSSL::OPENSSL_LIBRARY_VERSION.include?('OpenSSL 3.2.')
|
|
|
|
http = Net::HTTP.new("localhost", config("port"))
|
|
http.use_ssl = true
|
|
--
|
|
2.44.0
|
|
|