Hi, I intent to NMU this bug, quite some time passed since this was initally reported.
Attached is a debdiff. Cheers Nico -- Nico Golde - http://www.ngolde.de - n...@jabber.ccc.de - GPG: 0x73647CFF For security reasons, all text in this mail is double-rot13 encrypted.
diff -u ruby1.9-1.9.0.2/debian/changelog ruby1.9-1.9.0.2/debian/changelog
--- ruby1.9-1.9.0.2/debian/changelog
+++ ruby1.9-1.9.0.2/debian/changelog
@@ -1,3 +1,11 @@
+ruby1.9 (1.9.0.2-9.1) unstable; urgency=high
+
+ * Non-maintainer upload by the Security Team.
+ * Add upstream patch to properly check return values of the
+ OCSP_basic_verify function (CVE-2009-0642; Closes: #513528)
+
+ -- Nico Golde <n...@debian.org> Mon, 06 Apr 2009 18:43:32 +0200
+
ruby1.9 (1.9.0.2-9) unstable; urgency=high
* fixes regression:
diff -u ruby1.9-1.9.0.2/debian/patches/00list ruby1.9-1.9.0.2/debian/patches/00list
--- ruby1.9-1.9.0.2/debian/patches/00list
+++ ruby1.9-1.9.0.2/debian/patches/00list
@@ -21,0 +22 @@
+931_CVE-2009-0642
only in patch2:
unchanged:
--- ruby1.9-1.9.0.2.orig/debian/patches/931_CVE-2009-0642.dpatch
+++ ruby1.9-1.9.0.2/debian/patches/931_CVE-2009-0642.dpatch
@@ -0,0 +1,37 @@
+#! /bin/sh /usr/share/dpatch/dpatch-run
+## 931_CVE-2009-0642.dpatch by Nico Golde <n...@debian.org>
+##
+## All lines beginning with `## DP:' are a description of the patch.
+## DP: No description.
+
+...@dpatch@
+diff -urNad ruby1.9-1.9.0.2~/ext/openssl/ossl_ocsp.c ruby1.9-1.9.0.2/ext/openssl/ossl_ocsp.c
+--- ruby1.9-1.9.0.2~/ext/openssl/ossl_ocsp.c 2007-02-13 00:01:19.000000000 +0100
++++ ruby1.9-1.9.0.2/ext/openssl/ossl_ocsp.c 2009-04-06 18:43:12.000000000 +0200
+@@ -589,22 +589,22 @@
+ static VALUE
+ ossl_ocspbres_verify(int argc, VALUE *argv, VALUE self)
+ {
+- VALUE certs, store, flags;
++ VALUE certs, store, flags, result;
+ OCSP_BASICRESP *bs;
+ STACK_OF(X509) *x509s;
+ X509_STORE *x509st;
+- int flg, result;
++ int flg;
+
+ rb_scan_args(argc, argv, "21", &certs, &store, &flags);
+ x509st = GetX509StorePtr(store);
+ flg = NIL_P(flags) ? 0 : INT2NUM(flags);
+ x509s = ossl_x509_ary2sk(certs);
+ GetOCSPBasicRes(self, bs);
+- result = OCSP_basic_verify(bs, x509s, x509st, flg);
++ result = OCSP_basic_verify(bs, x509s, x509st, flg) > 0 ? Qtrue : Qfalse;
+ sk_X509_pop_free(x509s, X509_free);
+ if(!result) rb_warn("%s", ERR_error_string(ERR_peek_error(), NULL));
+
+- return result ? Qtrue : Qfalse;
++ return result;
+ }
+
+ /*
pgpuR96pGE94V.pgp
Description: PGP signature
