/[packages]/updates/5/ruby/current/SOURCES/ruby-2.0.0-CVE-2015-9096.patch
ViewVC logotype

Contents of /updates/5/ruby/current/SOURCES/ruby-2.0.0-CVE-2015-9096.patch

Parent Directory Parent Directory | Revision Log Revision Log


Revision 1141714 - (show annotations) (download)
Sat Aug 19 20:07:07 2017 UTC (6 years, 8 months ago) by pterjan
File size: 1308 byte(s)
Add patches for CVE-2015-9096 and CVE-2016-2337
1 From 0827a7e52ba3d957a634b063bf5a391239b9ffee Mon Sep 17 00:00:00 2001
2 From: shugo <shugo@b2dd03c8-39d4-4d8f-98ff-823fe69b080e>
3 Date: Wed, 8 Jun 2016 07:06:57 +0000
4 Subject: [PATCH] * lib/net/smtp.rb (getok, get_response): raise an
5 ArgumentError when CR or LF is included in a line, because they are not
6 allowed in RFC5321.
7
8 git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@55324 b2dd03c8-39d4-4d8f-98ff-823fe69b080e
9 ---
10 ChangeLog | 6 ++++++
11 lib/net/smtp.rb | 9 +++++++++
12 test/net/smtp/test_smtp.rb | 47 ++++++++++++++++++++++++++++++++++++++++++++++
13 3 files changed, 62 insertions(+)
14
15 diff --git a/lib/net/smtp.rb b/lib/net/smtp.rb
16 index 250293bdbe21..a7130a593b40 100644
17 --- a/lib/net/smtp.rb
18 +++ b/lib/net/smtp.rb
19 @@ -926,7 +926,15 @@ def quit
20
21 private
22
23 + def validate_line(line)
24 + # A bare CR or LF is not allowed in RFC5321.
25 + if /[\r\n]/ =~ line
26 + raise ArgumentError, "A line must not contain CR or LF"
27 + end
28 + end
29 +
30 def getok(reqline)
31 + validate_line reqline
32 res = critical {
33 @socket.writeline reqline
34 recv_response()
35 @@ -936,6 +944,7 @@ def getok(reqline)
36 end
37
38 def get_response(reqline)
39 + validate_line reqline
40 @socket.writeline reqline
41 recv_response()
42 end

  ViewVC Help
Powered by ViewVC 1.1.30