From owner-svn-ports-head@FreeBSD.ORG  Sat Nov 10 04:00:42 2012
Return-Path: <owner-svn-ports-head@FreeBSD.ORG>
Delivered-To: svn-ports-head@freebsd.org
Received: from mx1.freebsd.org (mx1.freebsd.org [69.147.83.52])
 by hub.freebsd.org (Postfix) with ESMTP id EF4A62BC;
 Sat, 10 Nov 2012 04:00:41 +0000 (UTC)
 (envelope-from swills@FreeBSD.org)
Received: from svn.freebsd.org (svn.freebsd.org
 [IPv6:2001:1900:2254:2068::e6a:0])
 by mx1.freebsd.org (Postfix) with ESMTP id CED5A8FC12;
 Sat, 10 Nov 2012 04:00:41 +0000 (UTC)
Received: from svn.freebsd.org (localhost [127.0.0.1])
 by svn.freebsd.org (8.14.5/8.14.5) with ESMTP id qAA40faP022147;
 Sat, 10 Nov 2012 04:00:41 GMT (envelope-from swills@svn.freebsd.org)
Received: (from swills@localhost)
 by svn.freebsd.org (8.14.5/8.14.5/Submit) id qAA40fAB022144;
 Sat, 10 Nov 2012 04:00:41 GMT (envelope-from swills@svn.freebsd.org)
Message-Id: <201211100400.qAA40fAB022144@svn.freebsd.org>
From: Steve Wills <swills@FreeBSD.org>
Date: Sat, 10 Nov 2012 04:00:41 +0000 (UTC)
To: ports-committers@freebsd.org, svn-ports-all@freebsd.org,
 svn-ports-head@freebsd.org
Subject: svn commit: r307261 - in head: Mk lang/ruby19 security/vuxml
X-SVN-Group: ports-head
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit
X-BeenThere: svn-ports-head@freebsd.org
X-Mailman-Version: 2.1.14
Precedence: list
List-Id: SVN commit messages for the ports tree for head
 <svn-ports-head.freebsd.org>
List-Unsubscribe: <http://lists.freebsd.org/mailman/options/svn-ports-head>,
 <mailto:svn-ports-head-request@freebsd.org?subject=unsubscribe>
List-Archive: <http://lists.freebsd.org/pipermail/svn-ports-head>
List-Post: <mailto:svn-ports-head@freebsd.org>
List-Help: <mailto:svn-ports-head-request@freebsd.org?subject=help>
List-Subscribe: <http://lists.freebsd.org/mailman/listinfo/svn-ports-head>,
 <mailto:svn-ports-head-request@freebsd.org?subject=subscribe>
X-List-Received-Date: Sat, 10 Nov 2012 04:00:42 -0000

Author: swills
Date: Sat Nov 10 04:00:41 2012
New Revision: 307261
URL: http://svnweb.freebsd.org/changeset/ports/307261

Log:
  - Update lang/ruby19 to 1.9.3p327
  - Document security issue in earlier versions
  
  Security:	5e647ca3-2aea-11e2-b745-001fd0af1a4c
  Feature safe:	yes

Modified:
  head/Mk/bsd.ruby.mk
  head/lang/ruby19/distinfo
  head/security/vuxml/vuln.xml

Modified: head/Mk/bsd.ruby.mk
==============================================================================
--- head/Mk/bsd.ruby.mk	Sat Nov 10 01:37:24 2012	(r307260)
+++ head/Mk/bsd.ruby.mk	Sat Nov 10 04:00:41 2012	(r307261)
@@ -196,7 +196,7 @@ RUBY19=			"@comment "
 RUBY_RELVERSION=	1.9.3
 RUBY_PORTREVISION=	0
 RUBY_PORTEPOCH=		1
-RUBY_PATCHLEVEL=	286
+RUBY_PATCHLEVEL=	327
 
 RUBY_VERSION?=		${RUBY_RELVERSION}.${RUBY_PATCHLEVEL}
 RUBY_DISTVERSION?=	${RUBY_RELVERSION}-p${RUBY_PATCHLEVEL}

Modified: head/lang/ruby19/distinfo
==============================================================================
--- head/lang/ruby19/distinfo	Sat Nov 10 01:37:24 2012	(r307260)
+++ head/lang/ruby19/distinfo	Sat Nov 10 04:00:41 2012	(r307261)
@@ -1,2 +1,2 @@
-SHA256 (ruby/ruby-1.9.3-p286.tar.bz2) = 5281656c7a0ae48b64f28d845a96b4dfa16ba1357a911265752787585fb5ea64
-SIZE (ruby/ruby-1.9.3-p286.tar.bz2) = 9961862
+SHA256 (ruby/ruby-1.9.3-p327.tar.bz2) = d989465242f9b11a8a3aa8cbd2c75a9b3a8c0ec2f14a087a0c7b51abf164e488
+SIZE (ruby/ruby-1.9.3-p327.tar.bz2) = 9975835

Modified: head/security/vuxml/vuln.xml
==============================================================================
--- head/security/vuxml/vuln.xml	Sat Nov 10 01:37:24 2012	(r307260)
+++ head/security/vuxml/vuln.xml	Sat Nov 10 04:00:41 2012	(r307261)
@@ -51,6 +51,41 @@ Note:  Please add new entries to the beg
 
 -->
 <vuxml xmlns="http://www.vuxml.org/apps/vuxml-1">
+  <vuln vid="5e647ca3-2aea-11e2-b745-001fd0af1a4c">
+    <topic>lang/ruby19 -- Hash-flooding DoS vulnerability for ruby 1.9</topic>
+    <affects>
+      <package>
+        <name>ruby</name>
+        <range><ge>1.9</ge><lt>1.9.3.327</lt></range>
+      </package>
+    </affects>
+    <description>
+      <body xmlns="http://www.w3.org/1999/xhtml">
+        <p>Hash-flooding DoS vulnerability</p>
+        <blockquote cite="http://www.ruby-lang.org/en/news/2012/11/09/ruby19-hashdos-cve-2012-5371/">
+          <p>Carefully crafted sequence of strings can cause a denial of service
+             attack on the service that parses the sequence to create a Hash
+             object by using the strings as keys. For instance, this
+             vulnerability affects web application that parses the JSON data
+             sent from untrusted entity.</p>
+          <p>This vulnerability is similar to CVS-2011-4815 for ruby 1.8.7. ruby
+             1.9 versions were using modified MurmurHash function but it's
+             reported that there is a way to create sequence of strings that
+             collide their hash values each other.  This fix changes the Hash
+             function of String object from the MurmurHash to SipHash 2-4.</p>
+        </blockquote>
+      </body>
+    </description>
+    <references>
+      <cvename>CVE-2012-5371</cvename>
+      <url>http://www.ruby-lang.org/en/news/2012/11/09/ruby19-hashdos-cve-2012-5371/</url>
+    </references>
+    <dates>
+      <discovery>2012-11-10</discovery>
+      <entry>2012-11-10</entry>
+    </dates>
+  </vuln>
+
   <vuln vid="152e4c7e-2a2e-11e2-99c7-00a0d181e71d">
     <topic>tomcat -- authentication weaknesses</topic>
     <affects>