161f074cf1
When multipart boundary attributes contain non-halting regular
expression strings, the boundary searcher in the CGI module does not properly
escape the parameter and will execute arbitrary regular expressions.
This fix adds escaping for the user data.
* Affected application servers: standalone CGI, Mongrel, WEBrick
* Unaffected: FastCGI, Ruby 1.8.6 (all servers)
* Unknown: mod_ruby
This fix will not modify versions of Ruby greater than 1.8.5, and is
cumulative with previous CGI multipart vulnerability fixes.
WWW: http://blog.evanweaver.com/#cgi_multipart_eof_fix
19 lines
429 B
Makefile
19 lines
429 B
Makefile
# Ports collection makefile for: rubygem-cgi_multipart_eof_fix
|
|
# Date created: December 08, 2010
|
|
# Whom: Philip M. Gollucci <pgollucci@p6m7g8.com>
|
|
#
|
|
# $FreeBSD$
|
|
|
|
PORTNAME= cgi_multipart_eof_fix
|
|
PORTVERSION= 2.5.0
|
|
CATEGORIES= www rubygems
|
|
MASTER_SITES= RG
|
|
|
|
MAINTAINER= ruby@FreeBSD.org
|
|
COMMENT= Fix an exploitable bug in CGI multipart parsing
|
|
|
|
USE_RUBY= yes
|
|
USE_RUBYGEMS= yes
|
|
RUBYGEM_AUTOPLIST= yes
|
|
|
|
.include <bsd.port.mk>
|