mirror of
https://github.com/puma/puma.git
synced 2022-11-09 13:48:40 -05:00
42 lines
1.5 KiB
Text
42 lines
1.5 KiB
Text
|
|
||
|
|
cgi_multipart_eof_fix
|
||
|
|
|
||
|
|
Fix an exploitable bug in CGI multipart parsing.
|
||
|
|
|
||
|
|
== License
|
||
|
|
|
||
|
|
Copyright 2006, 2007 Cloudburst, LLC. Portions copyright 2006 Jeremy Kemper, Jamis Buck, Zed A. Shaw, and Yukihiro Matsumoto, and used with permission. See the included LICENSE file.
|
||
|
|
|
||
|
|
== Description
|
||
|
|
|
||
|
|
Fixes an exploitable bug in CGI multipart parsing which affects Ruby <= 1.8.5. When multipart boundary attributes contain non-halting regular expression strings, the boundary searcher in the CGI module does not properly escape the parameter and will execute arbitrary regular expressions. This fix adds escaping for the user data.
|
||
|
|
|
||
|
|
This is fix is cumulative with previous CGI multipart vulnerability fixes; see version 1.0.0 of the gem by Jamis Buck et. al.
|
||
|
|
|
||
|
|
== Installation
|
||
|
|
|
||
|
|
sudo gem install cgi_multipart_eof_fix
|
||
|
|
|
||
|
|
== Scope
|
||
|
|
|
||
|
|
* Affected: standalone CGI, Mongrel, WEBrick
|
||
|
|
* Unaffected: FastCGI, Ruby 1.8.6 (all servers)
|
||
|
|
* Unknown: mod_ruby
|
||
|
|
|
||
|
|
This library will not modify versions of Ruby greater than 1.8.5.
|
||
|
|
|
||
|
|
== Usage
|
||
|
|
|
||
|
|
Run the included test to verify that the patch works as intended. Then, <tt>require</tt> the gem in every affected application, as follows:
|
||
|
|
|
||
|
|
require 'rubygems'
|
||
|
|
require 'cgi_multipart_eof_fix'
|
||
|
|
|
||
|
|
Currently Mongrel requires this gem automatically. However, Mongrel may change in the future.
|
||
|
|
|
||
|
|
== Further resources
|
||
|
|
|
||
|
|
* http://blog.evanweaver.com/pages/code#cgi_multipart_eof_fix
|
||
|
|
* http://rubyforge.org/forum/forum.php?forum_id=13985
|
||
|
|
* http://www.ruby-lang.org/en/news/2006/12/04/another-dos-vulnerability-in-cgi-library/
|