Bug #15637: Backport RubyGems 3.0.3/2.7.9

• Status: Closed
• Assignee: -
• Target version: -
• Backport: 2.4: DONE, 2.5: DONE, 2.6: DONE

[hsbt (Hiroshi SHIBATA)]

I released RubyGems 3.0.3 and 2.7.9 today. They contain multiple vulnerability fixes.

• https://blog.rubygems.org/2019/03/05/3.0.3-released.html
• https://blog.rubygems.org/2019/03/05/2.7.9-released.html

I attached the patches for Ruby 2.4, 2.5 and 2.6.

[hsbt (Hiroshi SHIBATA)]

• File ruby-2.4.5-rubygems.patch ruby-2.4.5-rubygems.patch added
• File ruby-2.5.3-rubygems.patch ruby-2.5.3-rubygems.patch added
• File ruby-2.6.1-rubygems.patch ruby-2.6.1-rubygems.patch added

[duerst (Martin Dürst)]

It says "They contain multiple vulnerabilities.". I hope the intent was to write something like "They fix multiple vulnerabilities." or "They contain multiple vulnerability fixes.".

[hsbt (Hiroshi SHIBATA)]

• Description updated (diff)

@duerst (Martin Dürst)

Thanks for your proofreading :)

[hsbt (Hiroshi SHIBATA)]

I added a test fix at r67171 for Windows platform. Please backport it too.

[jeremyevans0 (Jeremy Evans)]

It looks like the uploaded patch files for 2.4.5 and 2.5.3 do not apply with either BSD or GNU patch, resulting in:

patch: **** malformed patch at line 391:      package = Gem::Package.new @gem

Line 350 in both patch files should probably be changed from:

@@ -480,6 +480,40 @@ def test_extract_symlink_parent

to

@@ -480,6 +480,42 @@ def test_extract_symlink_parent

as there were 36 lines added by that patch hunk.

[hsbt (Hiroshi SHIBATA)]

• File ruby-2.4.5-rubygems-v2.patch ruby-2.4.5-rubygems-v2.patch added
• File ruby-2.5.3-rubygems-v2.patch ruby-2.5.3-rubygems-v2.patch added
• File ruby-2.6.1-rubygems-v2.patch ruby-2.6.1-rubygems-v2.patch added

I attached the patches with r67171.

@jeremyevans0 (Jeremy Evans)

Thanks, I fixed it at v2 patches. Can you try them again?

[jeremyevans0 (Jeremy Evans)]

hsbt (Hiroshi SHIBATA) wrote:

Thanks, I fixed it at v2 patches. Can you try them again?

Yes, all patches apply now, thank you very much.

[naruse (Yui NARUSE)]

• Backport changed from 2.4: REQUIRED, 2.5: REQUIRED, 2.6: REQUIRED to 2.4: REQUIRED, 2.5: REQUIRED, 2.6: DONE

ruby_2_6 r67182 merged the patch.

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 2.4: REQUIRED, 2.5: REQUIRED, 2.6: DONE to 2.4: REQUIRED, 2.5: DONE, 2.6: DONE

The patch for 2.5.3 was merged at r67234.

[jeremyevans0 (Jeremy Evans)]

Are there plans to backport the Rubygems security patches to Ruby 2.3? Ruby 2.3 is still in security maintenance status until the end of the month, so I think this would qualify, but I'm not sure.

[usa (Usaku NAKAMURA)]

• Backport changed from 2.4: REQUIRED, 2.5: DONE, 2.6: DONE to 2.4: DONE, 2.5: DONE, 2.6: DONE

[jaruga (Jun Aruga)]

Hi htbt,
Thanks for fixing the vulnerability issues.
I have just a question.

In case I want to fix only CVE-2019-8324: Installing a malicious gem may lead to arbitrary code execution, applying the below commit is good enough, right?

Merge branch 'h1-328571' into master-private

• master: https://github.com/rubygems/rubygems/commit/bcc96123e916a2b8d302dc0f350d9068bd014188
• v3.0.3: https://github.com/rubygems/rubygems/commit/1e6f6a0561a8531ab99c608655c4fb15524ceee2
• v2.7.9: https://github.com/rubygems/rubygems/commit/8e61a52f49c9530706cd73d2f1edc10f097e591f

[hsbt (Hiroshi SHIBATA)]

@jaruga (Jun Aruga)

Sorry, my late response. your list is correct commits..

[jaruga (Jun Aruga)]

@hsbt (Hiroshi SHIBATA), sure. Thank you for the checking!