From owner-svn-ports-head@FreeBSD.ORG Sun Nov 24 05:36:30 2013 Return-Path: Delivered-To: svn-ports-head@freebsd.org Received: from mx1.freebsd.org (mx1.freebsd.org [8.8.178.115]) (using TLSv1 with cipher ADH-AES256-SHA (256/256 bits)) (No client certificate requested) by hub.freebsd.org (Postfix) with ESMTPS id 4B6A341A; Sun, 24 Nov 2013 05:36:30 +0000 (UTC) Received: from svn.freebsd.org (svn.freebsd.org [IPv6:2001:1900:2254:2068::e6a:0]) (using TLSv1.2 with cipher ECDHE-RSA-AES256-GCM-SHA384 (256/256 bits)) (No client certificate requested) by mx1.freebsd.org (Postfix) with ESMTPS id 208EC2F2A; Sun, 24 Nov 2013 05:36:30 +0000 (UTC) Received: from svn.freebsd.org ([127.0.1.70]) by svn.freebsd.org (8.14.7/8.14.7) with ESMTP id rAO5aTNL059373; Sun, 24 Nov 2013 05:36:29 GMT (envelope-from swills@svn.freebsd.org) Received: (from swills@localhost) by svn.freebsd.org (8.14.7/8.14.5/Submit) id rAO5aTAX059344; Sun, 24 Nov 2013 05:36:29 GMT (envelope-from swills@svn.freebsd.org) Message-Id: <201311240536.rAO5aTAX059344@svn.freebsd.org> From: Steve Wills Date: Sun, 24 Nov 2013 05:36:29 +0000 (UTC) To: ports-committers@freebsd.org, svn-ports-all@freebsd.org, svn-ports-head@freebsd.org Subject: svn commit: r334705 - in head: devel/ruby-gems security/vuxml X-SVN-Group: ports-head MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit X-BeenThere: svn-ports-head@freebsd.org X-Mailman-Version: 2.1.16 Precedence: list List-Id: SVN commit messages for the ports tree for head List-Unsubscribe: , List-Archive: List-Post: List-Help: List-Subscribe: , X-List-Received-Date: Sun, 24 Nov 2013 05:36:30 -0000 Author: swills Date: Sun Nov 24 05:36:28 2013 New Revision: 334705 URL: http://svnweb.freebsd.org/changeset/ports/334705 Log: - Update devel/ruby-gems to 1.8.28 - Document security issues with 1.8.26 and 1.8.27 (CVE-2013-4287 and CVE-2013-4363) Security: 742eb9e4-e3cb-4f5a-b94e-0e9a39420600 Security: 54237182-9635-4a8b-92d7-33bfaeed84cd Modified: head/devel/ruby-gems/Makefile head/devel/ruby-gems/distinfo head/devel/ruby-gems/pkg-plist (contents, props changed) head/security/vuxml/vuln.xml Modified: head/devel/ruby-gems/Makefile ============================================================================== --- head/devel/ruby-gems/Makefile Sun Nov 24 01:29:02 2013 (r334704) +++ head/devel/ruby-gems/Makefile Sun Nov 24 05:36:28 2013 (r334705) @@ -2,7 +2,7 @@ # $FreeBSD$ PORTNAME= gems -PORTVERSION= 1.8.25 +PORTVERSION= 1.8.28 CATEGORIES= devel ruby MASTER_SITES= ${MASTER_SITE_RUBYGEMS:S/\/gems\//\/rubygems\//} PKGNAMEPREFIX= ${RUBY_PKGNAMEPREFIX} @@ -43,7 +43,7 @@ NO_STAGE= yes do-install: @${MKDIR} ${PREFIX}/${GEMS_DOC_BASE_DIR}/ @${TOUCH} ${PREFIX}/${GEMS_DOC_BASE_DIR}/.keep_this - cd ${WRKSRC}; ${RUBY} ${RUBY_SETUP} ${RUBY_SETUP_OPTIONS} + cd ${WRKSRC}; ${SETENV} ${GEM_ENV} ${RUBY} ${RUBY_SETUP} ${RUBY_SETUP_OPTIONS} post-install: @${LN} -sf ${PREFIX}/bin/gem${RUBY_VER_SHORT} ${PREFIX}/bin/gem Modified: head/devel/ruby-gems/distinfo ============================================================================== --- head/devel/ruby-gems/distinfo Sun Nov 24 01:29:02 2013 (r334704) +++ head/devel/ruby-gems/distinfo Sun Nov 24 05:36:28 2013 (r334705) @@ -1,2 +1,2 @@ -SHA256 (ruby/rubygems-1.8.25.tgz) = 649348ddf8746887fb1ee79c55dc508f0627d3d0bfa7fcdbcd4edb24908f1cc8 -SIZE (ruby/rubygems-1.8.25.tgz) = 380540 +SHA256 (ruby/rubygems-1.8.28.tgz) = f5f1aae263cd7f44634adf47733a5521f676ce76f19006db85d78c685defed39 +SIZE (ruby/rubygems-1.8.28.tgz) = 270451 Modified: head/devel/ruby-gems/pkg-plist ============================================================================== --- head/devel/ruby-gems/pkg-plist Sun Nov 24 01:29:02 2013 (r334704) +++ head/devel/ruby-gems/pkg-plist Sun Nov 24 05:36:28 2013 (r334705) @@ -84,7 +84,6 @@ bin/gem%%RUBY_VER_SHORT%% %%RUBY_SITELIBDIR%%/rubygems/source_index.rb %%RUBY_SITELIBDIR%%/rubygems/spec_fetcher.rb %%RUBY_SITELIBDIR%%/rubygems/specification.rb -%%RUBY_SITELIBDIR%%/rubygems/ssl_certs/ca-bundle.pem %%RUBY_SITELIBDIR%%/rubygems/syck_hack.rb %%RUBY_SITELIBDIR%%/rubygems/test_case.rb %%RUBY_SITELIBDIR%%/rubygems/test_utilities.rb Modified: head/security/vuxml/vuln.xml ============================================================================== --- head/security/vuxml/vuln.xml Sun Nov 24 01:29:02 2013 (r334704) +++ head/security/vuxml/vuln.xml Sun Nov 24 05:36:28 2013 (r334705) @@ -51,6 +51,73 @@ Note: Please add new entries to the beg --> + + ruby-gems -- Algorithmic Complexity Vulnerability + + + ruby19-gems + 1.8.27 + + + ruby20-gems + 1.8.27 + + + + +

Ruby Gem developers report:

+
+

The patch for CVE-2013-4363 was insufficiently verified so the + combined regular expression for verifying gem version remains + vulnerable following CVE-2013-4363.

+

RubyGems validates versions with a regular expression that is + vulnerable to denial of service due to backtracking. For specially + crafted RubyGems versions attackers can cause denial of service + through CPU consumption.

+
+ + + + CVE-2013-4363 + + + 2013-09-24 + 2013-11-24 + + + + + ruby-gems -- Algorithmic Complexity Vulnerability + + + ruby19-gems + 1.8.26 + + + ruby20-gems + 1.8.26 + + + + +

Ruby Gem developers report:

+
+

RubyGems validates versions with a regular expression that is + vulnerable to denial of service due to backtracking. For specially + crafted RubyGems versions attackers can cause denial of service + through CPU consumption.

+
+ + + + CVE-2013-4287 + + + 2013-09-09 + 2013-11-24 + + + ruby -- Heap Overflow in Floating Point Parsing