diff --git a/.gitignore b/.gitignore index 983ff65..8f31735 100644 --- a/.gitignore +++ b/.gitignore @@ -1 +1 @@ -SOURCES/ruby-2.4.5.tar.xz +SOURCES/ruby-2.4.6.tar.xz diff --git a/.rh-ruby24-ruby.metadata b/.rh-ruby24-ruby.metadata index 198c95f..ce9f497 100644 --- a/.rh-ruby24-ruby.metadata +++ b/.rh-ruby24-ruby.metadata @@ -1 +1 @@ -b5be590b37487248da3a85541a62fb81f7f7e29a SOURCES/ruby-2.4.5.tar.xz +86a4fa22cb3547005ec4bfcf77489a4254226187 SOURCES/ruby-2.4.6.tar.xz diff --git a/SOURCES/ruby-2.6.0-Fix-Tokyo-TZ-tests.patch b/SOURCES/ruby-2.6.0-Fix-Tokyo-TZ-tests.patch deleted file mode 100644 index edc58b6..0000000 --- a/SOURCES/ruby-2.6.0-Fix-Tokyo-TZ-tests.patch +++ /dev/null @@ -1,44 +0,0 @@ -From e71ca6cdcf108e6a2fa47ec9fadefe7554717908 Mon Sep 17 00:00:00 2001 -From: nobu -Date: Fri, 26 Oct 2018 01:47:09 +0000 -Subject: [PATCH] Update for tzdata-2018f - -git-svn-id: svn+ssh://ci.ruby-lang.org/ruby/trunk@65365 b2dd03c8-39d4-4d8f-98ff-823fe69b080e ---- - test/ruby/test_time_tz.rb | 12 +++++++++--- - 1 file changed, 9 insertions(+), 3 deletions(-) - -diff --git a/test/ruby/test_time_tz.rb b/test/ruby/test_time_tz.rb -index 2da4fd8d9ce4..328fde48fc34 100644 ---- a/test/ruby/test_time_tz.rb -+++ b/test/ruby/test_time_tz.rb -@@ -86,7 +86,9 @@ def group_by(e, &block) - has_lisbon_tz &&= have_tz_offset?("Europe/Lisbon") - CORRECT_TOKYO_DST_1951 = with_tz("Asia/Tokyo") { - if Time.local(1951, 5, 6, 12, 0, 0).dst? # noon, DST -- Time.local(1951, 5, 6, 1, 0, 0).dst? # DST with fixed tzdata -+ if Time.local(1951, 5, 6, 1, 0, 0).dst? # DST with fixed tzdata -+ Time.local(1951, 9, 8, 23, 0, 0).dst? ? "2018f" : "2018e" -+ end - end - } - CORRECT_KIRITIMATI_SKIP_1994 = with_tz("Pacific/Kiritimati") { -@@ -347,12 +349,16 @@ def self.gen_zdump_test(data) - Asia/Singapore Thu Dec 31 16:29:59 1981 UTC = Thu Dec 31 23:59:59 1981 SGT isdst=0 gmtoff=27000 - Asia/Singapore Thu Dec 31 16:30:00 1981 UTC = Fri Jan 1 00:30:00 1982 SGT isdst=0 gmtoff=28800 - End -- gen_zdump_test CORRECT_TOKYO_DST_1951 ? <<'End' : <<'End' -+ gen_zdump_test CORRECT_TOKYO_DST_1951 ? <<'End' + (CORRECT_TOKYO_DST_1951 < "2018f" ? <<'2018e' : <<'2018f') : <<'End' - Asia/Tokyo Sat May 5 14:59:59 1951 UTC = Sat May 5 23:59:59 1951 JST isdst=0 gmtoff=32400 - Asia/Tokyo Sat May 5 15:00:00 1951 UTC = Sun May 6 01:00:00 1951 JDT isdst=1 gmtoff=36000 -+End - Asia/Tokyo Sat Sep 8 13:59:59 1951 UTC = Sat Sep 8 23:59:59 1951 JDT isdst=1 gmtoff=36000 - Asia/Tokyo Sat Sep 8 14:00:00 1951 UTC = Sat Sep 8 23:00:00 1951 JST isdst=0 gmtoff=32400 --End -+2018e -+Asia/Tokyo Sat Sep 8 14:59:59 1951 UTC = Sun Sep 9 00:59:59 1951 JDT isdst=1 gmtoff=36000 -+Asia/Tokyo Sat Sep 8 15:00:00 1951 UTC = Sun Sep 9 00:00:00 1951 JST isdst=0 gmtoff=32400 -+2018f - Asia/Tokyo Sat May 5 16:59:59 1951 UTC = Sun May 6 01:59:59 1951 JST isdst=0 gmtoff=32400 - Asia/Tokyo Sat May 5 17:00:00 1951 UTC = Sun May 6 03:00:00 1951 JDT isdst=1 gmtoff=36000 - Asia/Tokyo Fri Sep 7 15:59:59 1951 UTC = Sat Sep 8 01:59:59 1951 JDT isdst=1 gmtoff=36000 diff --git a/SPECS/ruby.spec b/SPECS/ruby.spec index 0c47b65..59c611e 100644 --- a/SPECS/ruby.spec +++ b/SPECS/ruby.spec @@ -3,7 +3,7 @@ %global major_version 2 %global minor_version 4 -%global teeny_version 5 +%global teeny_version 6 %global major_minor_version %{major_version}.%{minor_version} %global ruby_version %{major_minor_version}.%{teeny_version} @@ -24,7 +24,7 @@ %endif -%global release 91 +%global release 92 %{!?release_string:%global release_string %{?development_release:0.}%{release}%{?development_release:.%{development_release}}%{?dist}} # The RubyGems library has to stay out of Ruby directory tree, since the @@ -32,7 +32,7 @@ %global rubygems_dir %{_datadir}/rubygems # Bundled libraries versions -%global rubygems_version 2.6.14.3 +%global rubygems_version 2.6.14.4 %global molinillo_version 0.5.7 # TODO: The IRB has strange versioning. Keep the Ruby's versioning ATM. @@ -144,9 +144,6 @@ Patch9: ruby-2.3.1-Rely-on-ldd-to-detect-glibc.patch # arbitrary code execution # https://bugs.ruby-lang.org/issues/14205 Patch11: ruby-2.5.0-Fixed-command-Injection.patch -# Fix Tokyo TZ tests -# https://github.com/ruby/ruby/commit/e71ca6cdcf108e6a2fa47ec9fadefe7554717908 -Patch12: ruby-2.6.0-Fix-Tokyo-TZ-tests.patch # Properly harden package using -fstack-protector-strong. # https://bugs.ruby-lang.org/issues/15053 Patch13: ruby-2.6.0-configure-fstack-protector-strong.patch @@ -528,7 +525,6 @@ rm -rf ext/fiddle/libffi* %patch7 -p1 %patch9 -p1 %patch11 -p1 -%patch12 -p1 %patch13 -p1 %patch14 -p1 @@ -1069,6 +1065,21 @@ make check TESTS="-v $DISABLE_TESTS" %{gem_dir}/specifications/xmlrpc-%{xmlrpc_version}.gemspec %changelog +* Thu Apr 11 2019 Jun Aruga - 2.4.6-92 +- Upgrade to Ruby 2.4.6. +- Delete directory using symlink when decompressing tar + Resolves: CVE-2019-8320 +- Fix escape sequence injection vulnerability in verbose. + Resolves: CVE-2019-8321 +- Fix escape sequence injection vulnerability in gem owner. + Resolves: CVE-2019-8322 +- Fix escape sequence injection vulnerability in API response handling. + Resolves: CVE-2019-8323 +- Prohibit arbitrary code execution when installing a malicious gem. + Resolves: CVE-2019-8324 +- Fix escape sequence injection vulnerability in errors. + Resolves: CVE-2019-8325 + * Mon Nov 5 2018 Pavel Valena - 2.4.5-91 - Upgrade to Ruby 2.4.5. Resolves: CVE-2018-16395