From ba01b0b8d0037cdd86a22b38565d3b1b4e76db68 Mon Sep 17 00:00:00 2001 From: ruebb Date: Sun, 2 Feb 2020 23:48:42 -0500 Subject: [PATCH] fix CVE-2019-16254 --- CVE-2019-16254.patch | 106 +++++++++++++++++++++++++++++++++++++++++++ ruby.spec | 9 +++- 2 files changed, 114 insertions(+), 1 deletion(-) create mode 100644 CVE-2019-16254.patch diff --git a/CVE-2019-16254.patch b/CVE-2019-16254.patch new file mode 100644 index 0000000..5bd05e7 --- /dev/null +++ b/CVE-2019-16254.patch @@ -0,0 +1,106 @@ +From f98b3023bd786b4e7dfdb94b573a5f5d3d37d145 Mon Sep 17 00:00:00 2001 +From: usa +Date: Tue, 1 Oct 2019 11:01:05 +0000 +Subject: [PATCH] merge revision(s) 3ce238b5f9795581eb84114dcfbdf4aa086bfecc + +WEBrick: prevent response splitting and header injection + +This is a follow up to d9d4a28. +The commit prevented CRLR, but did not address an isolated CR or an +isolated LF. + +Co-Authored-By: NARUSE, Yui + + +git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/branches/ruby_2_5@67813 b2dd03c8-39d4-4d8f-98ff-823fe69b080e +--- + lib/webrick/httpresponse.rb | 3 +- + test/webrick/test_httpresponse.rb | 46 +++++++++++++++++++++++++++++-- + 2 files changed, 46 insertions(+), 3 deletions(-) + +diff --git a/lib/webrick/httpresponse.rb b/lib/webrick/httpresponse.rb +index 6d77692140f0..d26324c54a11 100644 +--- a/lib/webrick/httpresponse.rb ++++ b/lib/webrick/httpresponse.rb +@@ -367,7 +367,8 @@ def set_error(ex, backtrace=false) + private + + def check_header(header_value) +- if header_value =~ /\r\n/ ++ header_value = header_value.to_s ++ if /[\r\n]/ =~ header_value + raise InvalidHeader + else + header_value +diff --git a/test/webrick/test_httpresponse.rb b/test/webrick/test_httpresponse.rb +index 6263e0a71044..24a6968582e9 100644 +--- a/test/webrick/test_httpresponse.rb ++++ b/test/webrick/test_httpresponse.rb +@@ -29,7 +29,7 @@ def setup + @res.keep_alive = true + end + +- def test_prevent_response_splitting_headers ++ def test_prevent_response_splitting_headers_crlf + res['X-header'] = "malicious\r\nCookie: hack" + io = StringIO.new + res.send_response io +@@ -39,7 +39,7 @@ def test_prevent_response_splitting_headers + refute_match 'hack', io.string + end + +- def test_prevent_response_splitting_cookie_headers ++ def test_prevent_response_splitting_cookie_headers_crlf + user_input = "malicious\r\nCookie: hack" + res.cookies << WEBrick::Cookie.new('author', user_input) + io = StringIO.new +@@ -50,6 +50,48 @@ def test_prevent_response_splitting_cookie_headers + refute_match 'hack', io.string + end + ++ def test_prevent_response_splitting_headers_cr ++ res['X-header'] = "malicious\rCookie: hack" ++ io = StringIO.new ++ res.send_response io ++ io.rewind ++ res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io)) ++ assert_equal '500', res.code ++ refute_match 'hack', io.string ++ end ++ ++ def test_prevent_response_splitting_cookie_headers_cr ++ user_input = "malicious\rCookie: hack" ++ res.cookies << WEBrick::Cookie.new('author', user_input) ++ io = StringIO.new ++ res.send_response io ++ io.rewind ++ res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io)) ++ assert_equal '500', res.code ++ refute_match 'hack', io.string ++ end ++ ++ def test_prevent_response_splitting_headers_lf ++ res['X-header'] = "malicious\nCookie: hack" ++ io = StringIO.new ++ res.send_response io ++ io.rewind ++ res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io)) ++ assert_equal '500', res.code ++ refute_match 'hack', io.string ++ end ++ ++ def test_prevent_response_splitting_cookie_headers_lf ++ user_input = "malicious\nCookie: hack" ++ res.cookies << WEBrick::Cookie.new('author', user_input) ++ io = StringIO.new ++ res.send_response io ++ io.rewind ++ res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io)) ++ assert_equal '500', res.code ++ refute_match 'hack', io.string ++ end ++ + def test_304_does_not_log_warning + res.status = 304 + res.setup_header + diff --git a/ruby.spec b/ruby.spec index 2729cbf..0a0fb61 100644 --- a/ruby.spec +++ b/ruby.spec @@ -1,6 +1,6 @@ Name: ruby Version: 2.5.1 -Release: 102 +Release: 103 Summary: Object-oriented scripting language interpreter License: (Ruby or BSD) and Public Domain and MIT and CC0 and zlib and UCD URL: http://ruby-lang.org/ @@ -45,6 +45,7 @@ Patch6002: ruby-2.6.0-Try-to-update-cert.patch Patch6003: CVE-2019-8322-8323-8324-8325.patch Patch6004: CVE-2019-15845.patch Patch6005: CVE-2019-16201.patch +Patch6006: CVE-2019-16254.patch Provides: %{name}-libs = %{version}-%{release} Obsoletes: %{name}-libs < %{version}-%{release} @@ -582,6 +583,12 @@ make runruby TESTRUN_SCRIPT=%{SOURCE13} %exclude %{gem_dir}/gems/xmlrpc-0.3.0/.* %changelog +* Mon Feb 03 2020 Yiru Wang - 2.5.1-103 +- Type:cves +- ID:CVE-2019-16254 +- SUG:N/A +- DESC:fix CVE-2019-16254 + * Thu Jan 16 2020 fengbing - 2.5.1-102 - Type:N/A - ID:N/A