tags 517639 + patch tags 522939 + patch
Hi, attached is a patch for an NMU to fix this bug. Cheers Nico -- Nico Golde - http://www.ngolde.de - [email protected] - GPG: 0x73647CFF For security reasons, all text in this mail is double-rot13 encrypted.
diff -u ruby1.8-1.8.7.72/debian/changelog ruby1.8-1.8.7.72/debian/changelog --- ruby1.8-1.8.7.72/debian/changelog +++ ruby1.8-1.8.7.72/debian/changelog @@ -1,3 +1,10 @@ +ruby1.8 (1.8.7.72-3.1) unstable; urgency=high + + * Non-maintainer upload by the Security Team. + * Add upstream patch to properly check return values of the + OCSP_basic_verify function (CVE-2009-0642; Closes: #522939,#517639) + -- Nico Golde <[email protected]> Tue, 07 Apr 2009 15:52:53 +0200 + ruby1.8 (1.8.7.72-3) unstable; urgency=medium * applied debian/patches/905_class_dup_should_copy_constants.dpatch: diff -u ruby1.8-1.8.7.72/debian/patches/00list ruby1.8-1.8.7.72/debian/patches/00list --- ruby1.8-1.8.7.72/debian/patches/00list +++ ruby1.8-1.8.7.72/debian/patches/00list @@ -12,0 +13 @@ +931_CVE-2009-0642 only in patch2: unchanged: --- ruby1.8-1.8.7.72.orig/debian/patches/931_CVE-2009-0642.dpatch +++ ruby1.8-1.8.7.72/debian/patches/931_CVE-2009-0642.dpatch @@ -0,0 +1,37 @@ +#! /bin/sh /usr/share/dpatch/dpatch-run +## 931_CVE-2009-0642.dpatch by Nico Golde <[email protected]> +## +## All lines beginning with `## DP:' are a description of the patch. +## DP: No description. + +...@dpatch@ +diff -urNad ruby1.9-1.9.0.2~/ext/openssl/ossl_ocsp.c ruby1.9-1.9.0.2/ext/openssl/ossl_ocsp.c +--- ruby1.9-1.9.0.2~/ext/openssl/ossl_ocsp.c 2007-02-13 00:01:19.000000000 +0100 ++++ ruby1.9-1.9.0.2/ext/openssl/ossl_ocsp.c 2009-04-06 18:43:12.000000000 +0200 +@@ -589,22 +589,22 @@ + static VALUE + ossl_ocspbres_verify(int argc, VALUE *argv, VALUE self) + { +- VALUE certs, store, flags; ++ VALUE certs, store, flags, result; + OCSP_BASICRESP *bs; + STACK_OF(X509) *x509s; + X509_STORE *x509st; +- int flg, result; ++ int flg; + + rb_scan_args(argc, argv, "21", &certs, &store, &flags); + x509st = GetX509StorePtr(store); + flg = NIL_P(flags) ? 0 : INT2NUM(flags); + x509s = ossl_x509_ary2sk(certs); + GetOCSPBasicRes(self, bs); +- result = OCSP_basic_verify(bs, x509s, x509st, flg); ++ result = OCSP_basic_verify(bs, x509s, x509st, flg) > 0 ? Qtrue : Qfalse; + sk_X509_pop_free(x509s, X509_free); + if(!result) rb_warn("%s", ERR_error_string(ERR_peek_error(), NULL)); + +- return result ? Qtrue : Qfalse; ++ return result; + } + + /*
pgpLK0oSRWcLE.pgp
Description: PGP signature
