BSD Ports

www/rubygem-cgi_multipart_eof_fix 2.5.0 DragonFly

Fix an exploitable bug in CGI multipart parsing

System
DragonFly
Repository
DPorts
Maintainer
[email protected] (as in FreeBSD)
License
GPLv2, RUBY
Categories
rubygems, www
Package size
13.2 KiB, 36.8 KiB installed

Description

Fixes an exploitable bug in CGI multipart parsing which affects Ruby <= 1.8.5. When multipart boundary attributes contain non-halting regular expression strings, the boundary searcher in the CGI module does not properly escape the parameter and will execute arbitrary regular expressions. This fix adds escaping for the user data.

\* Affected application servers: standalone CGI, Mongrel, WEBrick
\* Unaffected: FastCGI, Ruby 1.8.6 (all servers)
\* Unknown: mod\_ruby

This fix will not modify versions of Ruby greater than 1.8.5, and is cumulative with previous CGI multipart vulnerability fixes.

In the other systems

SystemPortVersion
DragonFlywww/rubygem-cgi_multipart_eof_fix2.5.0
FreeBSDwww/rubygem-cgi_multipart_eof_fix2.5.0
HardenedBSDwww/rubygem-cgi_multipart_eof_fix2.5.0
GhostBSDwww/rubygem-cgi_multipart_eof_fix2.5.0

Install

Binary package:

pkg install rubygem-cgi_multipart_eof_fix

From DPorts:

cd /usr/dports/www/rubygem-cgi_multipart_eof_fix && make install clean

Dependencies

Run dependencies 2

No port depends on this one.