mirror of
https://git.yoctoproject.org/poky
synced 2026-03-09 16:59:40 +01:00
61c55b9e30
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.9 has a ReDoS vulnerability when it parses an XML that has many digits between &# and x...; in a hex numeric character reference (&#x.... This does not happen with Ruby 3.2 or later. Ruby 3.1 is the only affected maintained Ruby. The REXML gem 3.3.9 or later include the patch to fix the vulnerability. CVE-2024-49761-0009.patch is the CVE fix and rest are dependent commits. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-49761 Upstream-patch:810d22852383ca5c4b0f51217dbcc67e4049f6a6fc6cad570b7712855547370666e314a579730f25ce59f2eb1a(From OE-Core rev: 5b453400e9dd878b81b1447d14b3f518809de17e) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
47 lines
1.8 KiB
Diff
47 lines
1.8 KiB
Diff
From ce59f2eb1aeb371fe1643414f06618dbe031979f Mon Sep 17 00:00:00 2001
|
|
From: Sutou Kouhei <kou@clear-code.com>
|
|
Date: Thu, 24 Oct 2024 14:45:31 +0900
|
|
Subject: [PATCH] parser: fix a bug that �x...; is accepted as a character
|
|
reference
|
|
|
|
CVE: CVE-2024-49761
|
|
|
|
Upstream-Status: Backport [https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f]
|
|
|
|
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
|
|
---
|
|
.../gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb | 10 +++++++---
|
|
1 file changed, 7 insertions(+), 3 deletions(-)
|
|
|
|
diff --git a/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb b/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb
|
|
index 9983d51..661f0e2 100644
|
|
--- a/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb
|
|
+++ b/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb
|
|
@@ -122,7 +122,7 @@ module REXML
|
|
PEDECL_PATTERN = "\\s+(%)\\s+#{NAME}\\s+#{PEDEF}\\s*>"
|
|
ENTITYDECL_PATTERN = /(?:#{GEDECL_PATTERN})|(?:#{PEDECL_PATTERN})/um
|
|
CARRIAGE_RETURN_NEWLINE_PATTERN = /\r\n?/
|
|
- CHARACTER_REFERENCES = /�*((?:\d+)|(?:x[a-fA-F0-9]+));/
|
|
+ CHARACTER_REFERENCES = /&#((?:\d+)|(?:x[a-fA-F0-9]+));/
|
|
DEFAULT_ENTITIES_PATTERNS = {}
|
|
default_entities = ['gt', 'lt', 'quot', 'apos', 'amp']
|
|
default_entities.each do |term|
|
|
@@ -477,8 +477,12 @@ module REXML
|
|
return rv if matches.size == 0
|
|
rv.gsub!( Private::CHARACTER_REFERENCES ) {
|
|
m=$1
|
|
- m = "0#{m}" if m[0] == ?x
|
|
- [Integer(m)].pack('U*')
|
|
+ if m.start_with?("x")
|
|
+ code_point = Integer(m[1..-1], 16)
|
|
+ else
|
|
+ code_point = Integer(m, 10)
|
|
+ end
|
|
+ [code_point].pack('U*')
|
|
}
|
|
matches.collect!{|x|x[0]}.compact!
|
|
if matches.size > 0
|
|
--
|
|
2.40.0
|
|
|