unofficial mirror of guix-devel@gnu.org 
 help / color / mirror / code / Atom feed

blob d1faa3a4d85a2766f0d1fb0627c72eba6ec09564 1038 bytes (raw)
name: gnu/packages/patches/ruby-1.8-CVE-2017-17790.patch 	 # note: path name is non-authoritative(*)

Fix CVE-2017-17790:

https://github.com/ruby/ruby/pull/1777
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-17790
https://security-tracker.debian.org/tracker/CVE-2017-17790

Patch copied from snapshot.debian.org:

https://snapshot.debian.org/archive/debian-security/20180423T104456Z/pool/updates/main/r/ruby1.8/ruby1.8_1.8.7.358-7.1%2Bdeb7u6.debian.tar.gz

From: =?utf-8?q?Guido_G=C3=BCnther?= <agx@sigxcpu.org>
Date: Sun, 24 Dec 2017 16:19:08 +0100
Subject: CVE-2017-17790: Fixed command injection in
 Resolv::Hosts#lazy_initialize

---
 lib/resolv.rb | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/lib/resolv.rb b/lib/resolv.rb
index 5cc0313..417fe0c 100644
--- a/lib/resolv.rb
+++ b/lib/resolv.rb
@@ -186,7 +186,7 @@ class Resolv
         unless @initialized
           @name2addr = {}
           @addr2name = {}
-          open(@filename) {|f|
+          File.open(@filename) {|f|
             f.each {|line|
               line.sub!(/#.*/, '')
               addr, hostname, *aliases = line.split(/\s+/)

debug log:

solving d1faa3a4d ...
found d1faa3a4d in https://yhetil.org/guix-devel/875zwmzj1g.fsf@gmail.com/

applying [1/1] https://yhetil.org/guix-devel/875zwmzj1g.fsf@gmail.com/
diff --git a/gnu/packages/patches/ruby-1.8-CVE-2017-17790.patch b/gnu/packages/patches/ruby-1.8-CVE-2017-17790.patch
new file mode 100644
index 000000000..d1faa3a4d

Checking patch gnu/packages/patches/ruby-1.8-CVE-2017-17790.patch...
Applied patch gnu/packages/patches/ruby-1.8-CVE-2017-17790.patch cleanly.

index at:
100644 d1faa3a4d85a2766f0d1fb0627c72eba6ec09564	gnu/packages/patches/ruby-1.8-CVE-2017-17790.patch

(*) Git path names are given by the tree(s) the blob belongs to.
    Blobs themselves have no identifier aside from the hash of its contents.^

Code repositories for project(s) associated with this public inbox

	https://git.savannah.gnu.org/cgit/guix.git

This is a public inbox, see mirroring instructions
for how to clone and mirror all data and code used for this inbox;
as well as URLs for read-only IMAP folder(s) and NNTP newsgroup(s).