diff options
| author | taca <taca@pkgsrc.org> | 2019-03-12 04:23:45 +0000 |
|---|---|---|
| committer | taca <taca@pkgsrc.org> | 2019-03-12 04:23:45 +0000 |
| commit | 21e1153f857c7e948494061fe708aaed7f8143a2 (patch) | |
| tree | ffd039ce006094d4185b7c99137343c6b8da958e /lang | |
| parent | 63eb81f09aa68e465399745bec1a2df2de4a9800 (diff) | |
| download | pkgsrc-21e1153f857c7e948494061fe708aaed7f8143a2.tar.gz | |
lang/ruby24-base: Add security patch for rubygems
Add security patch for rubygems, fixing these problem.
* CVE-2019-8320: Delete directory using symlink when decompressing tar
* CVE-2019-8321: Escape sequence injection vulnerability in verbose
* CVE-2019-8322: Escape sequence injection vulnerability in gem owner
* CVE-2019-8323: Escape sequence injection vulnerability in API response handlin
g
* CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution
* CVE-2019-8325: Escape sequence injection vulnerability in errors
https://www.ruby-lang.org/en/news/2019/03/05/multiple-vulnerabilities-in-rubygems/
Since original patch included in official announce dose not cleanly applied to
Ruby 2.4.5, use a local version which drop patch to none existing test.
Bump PKGREVISION.
Diffstat (limited to 'lang')
| -rw-r--r-- | lang/ruby24-base/Makefile | 6 | ||||
| -rw-r--r-- | lang/ruby24-base/distinfo | 6 |
2 files changed, 10 insertions, 2 deletions
diff --git a/lang/ruby24-base/Makefile b/lang/ruby24-base/Makefile index be934a3a2d9..ffe75955be1 100644 --- a/lang/ruby24-base/Makefile +++ b/lang/ruby24-base/Makefile @@ -1,10 +1,14 @@ -# $NetBSD: Makefile,v 1.9 2018/07/17 10:56:24 jperkin Exp $ +# $NetBSD: Makefile,v 1.10 2019/03/12 04:23:45 taca Exp $ DISTNAME= ${RUBY_DISTNAME} PKGNAME= ${RUBY_PKGPREFIX}-base-${RUBY_VERSION} CATEGORIES= lang ruby MASTER_SITES= ${MASTER_SITE_RUBY} +# announced patch is failed to apply, so use local version. +PATCHFILES= ruby-2.4.5-rubygems.patch-20190311 +PATCH_SITES= ${MASTER_SITE_LOCAL} + MAINTAINER= taca@NetBSD.org HOMEPAGE= ${RUBY_HOMEPAGE} COMMENT= Ruby ${RUBY_VERSION} release minimum base package diff --git a/lang/ruby24-base/distinfo b/lang/ruby24-base/distinfo index f525454787c..34e21e91eba 100644 --- a/lang/ruby24-base/distinfo +++ b/lang/ruby24-base/distinfo @@ -1,5 +1,9 @@ -$NetBSD: distinfo,v 1.11 2019/01/03 05:19:03 taca Exp $ +$NetBSD: distinfo,v 1.12 2019/03/12 04:23:45 taca Exp $ +SHA1 (ruby-2.4.5-rubygems.patch-20190311) = 3205fcafc9ff8b76b1f0ae31a87c3847bc93e69d +RMD160 (ruby-2.4.5-rubygems.patch-20190311) = 9748f8de0d57930522fd9d423d08fa938a7467f7 +SHA512 (ruby-2.4.5-rubygems.patch-20190311) = 4273fe6fbf9a27720a243453723ddb7d6e7268b7f4d6a0d65af72a06d712fa18552bafca676e4aae92dc057e86a0c1628e056d0475fa20e0f5b57364b8408c67 +Size (ruby-2.4.5-rubygems.patch-20190311) = 12191 bytes SHA1 (ruby-2.4.5.tar.xz) = b5be590b37487248da3a85541a62fb81f7f7e29a RMD160 (ruby-2.4.5.tar.xz) = b0704071c12223b416ca5bd52a52671376d8ad5c SHA512 (ruby-2.4.5.tar.xz) = 658f676c623109f4c7499615e191c98c3dd72cfcaeeaf121337d0b8a33c5243145edd50ec5e2775f988e3cd19788984f105fa165e3049779066566f67172c1b4 |