mirror of
https://git.yoctoproject.org/poky
synced 2026-07-23 04:17:46 +02:00
6639c7b295
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.2 has some DoS vulnerabilities when it parses an XML that has many specific characters such as whitespace character, `>]` and `]>`. The REXML gem 3.3.3 or later include the patches to fix these vulnerabilities. Reference: https://nvd.nist.gov/vuln/detail/CVE-2024-41123 Upstream-patches:2c39c91a654444a04eceebc3e85bfa6cac15d458e2546e6eca(From OE-Core rev: 6b2a2e689a69deef6098f6c266542234e46fb24b) Signed-off-by: Divya Chellam <divya.chellam@windriver.com> Signed-off-by: Steve Sakoman <steve@sakoman.com>
38 lines
1.1 KiB
Diff
38 lines
1.1 KiB
Diff
From 4444a04ece4c02a7bd51e8c75623f22dc12d882b Mon Sep 17 00:00:00 2001
|
|
From: Sutou Kouhei <kou@clear-code.com>
|
|
Date: Sun, 2 Jun 2024 16:59:16 +0900
|
|
Subject: [PATCH] Add missing encode for custom term
|
|
|
|
CVE: CVE-2024-41123
|
|
|
|
Upstream-Status: Backport [https://github.com/ruby/rexml/commit/4444a04ece4c02a7bd51e8c75623f22dc12d882b]
|
|
|
|
Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
|
|
---
|
|
.bundle/gems/rexml-3.2.5/lib/rexml/source.rb | 2 ++
|
|
1 file changed, 2 insertions(+)
|
|
|
|
diff --git a/.bundle/gems/rexml-3.2.5/lib/rexml/source.rb b/.bundle/gems/rexml-3.2.5/lib/rexml/source.rb
|
|
index 08a035c..7be430a 100644
|
|
--- a/.bundle/gems/rexml-3.2.5/lib/rexml/source.rb
|
|
+++ b/.bundle/gems/rexml-3.2.5/lib/rexml/source.rb
|
|
@@ -160,6 +160,7 @@ module REXML
|
|
end
|
|
|
|
def read(term = nil)
|
|
+ term = encode(term) if term
|
|
begin
|
|
@scanner << readline(term)
|
|
true
|
|
@@ -171,6 +172,7 @@ module REXML
|
|
|
|
def read_until(term)
|
|
pattern = Regexp.union(term)
|
|
+ term = encode(term)
|
|
data = []
|
|
begin
|
|
until str = @scanner.scan_until(pattern)
|
|
--
|
|
2.40.0
|
|
|