<div dir="ltr">Yes. You should always specify the target branch in the subject if it is not for master.<div><br></div><div>Alex</div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Tue, 11 Feb 2020 at 14:06, rahul chauhan <<a href="mailto:rahulchauhankitps@gmail.com">rahulchauhankitps@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex"><div dir="ltr"><div>Hi community members,</div><div><br></div><div>This patch Fixes CVE-2019-16254 on zeus branch.</div>patch test failed, since I did not use --subject-prefix="zeus][PATCH" at the time of patch submission to <a href="mailto:openembedded-core@lists.openembedded.org" target="_blank">openembedded-core@lists.openembedded.org</a>.<br> <br><div>should i resubmit this patch with --subject-prefix="zeus][PATCH"</div><div>or <br></div><div>can anyone guide me what should do next in this situation ?<br></div><div><br></div><div>Thanks & Regards</div><div>Rahul Chauhan<br></div></div><br><div class="gmail_quote"><div dir="ltr" class="gmail_attr">On Mon, Feb 10, 2020 at 11:47 PM Rahul Chauhan <<a href="mailto:rahulchauhankitps@gmail.com" target="_blank">rahulchauhankitps@gmail.com</a>> wrote:<br></div><blockquote class="gmail_quote" style="margin:0px 0px 0px 0.8ex;border-left-width:1px;border-left-style:solid;border-left-color:rgb(204,204,204);padding-left:1ex">Signed-off-by: Rahul Chauhan <<a href="mailto:rahulchauhankitps@gmail.com" target="_blank">rahulchauhankitps@gmail.com</a>><br>
---<br>
.../ruby/ruby/fix-CVE-2019-16254.patch | 106 +++++++++++++++++++++<br>
meta/recipes-devtools/ruby/<a href="http://ruby_2.5.5.bb" rel="noreferrer" target="_blank">ruby_2.5.5.bb</a> | 1 +<br>
2 files changed, 107 insertions(+)<br>
create mode 100644 meta/recipes-devtools/ruby/ruby/fix-CVE-2019-16254.patch<br>
<br>
diff --git a/meta/recipes-devtools/ruby/ruby/fix-CVE-2019-16254.patch b/meta/recipes-devtools/ruby/ruby/fix-CVE-2019-16254.patch<br>
new file mode 100644<br>
index 0000000..704c850<br>
--- /dev/null<br>
+++ b/meta/recipes-devtools/ruby/ruby/fix-CVE-2019-16254.patch<br>
@@ -0,0 +1,106 @@<br>
+From 18d5289b4579822e391b3f5c16541e6552e9f06c Mon Sep 17 00:00:00 2001<br>
+From: Yusuke Endoh <<a href="mailto:mame@ruby-lang.org" target="_blank">mame@ruby-lang.org</a>><br>
+Date: Tue, 1 Oct 2019 12:29:18 +0900<br>
+Subject: [PATCH] WEBrick: prevent response splitting and header injection<br>
+<br>
+This is a follow up to d9d4a28f1cdd05a0e8dabb36d747d40bbcc30f16.<br>
+The commit prevented CRLR, but did not address an isolated CR or an<br>
+isolated LF.<br>
+<br>
+Upstream-Status: Backport <a href="https://github.com/ruby/ruby/commit/3ce238b5f9795581eb84114dcfbdf4aa086bfecc" rel="noreferrer" target="_blank">https://github.com/ruby/ruby/commit/3ce238b5f9795581eb84114dcfbdf4aa086bfecc</a><br>
+CVE: CVE-2019-16254<br>
+<br>
+Co-Authored-By: NARUSE, Yui <<a href="mailto:naruse@airemix.jp" target="_blank">naruse@airemix.jp</a>><br>
+Signed-off-by: Rahul Chauhan <<a href="mailto:rahulchauhankitps@gmail.com" target="_blank">rahulchauhankitps@gmail.com</a>><br>
+---<br>
+ lib/webrick/httpresponse.rb | 3 ++-<br>
+ test/webrick/test_httpresponse.rb | 46 +++++++++++++++++++++++++++++++++++++--<br>
+ 2 files changed, 46 insertions(+), 3 deletions(-)<br>
+<br>
+diff --git a/lib/webrick/httpresponse.rb b/lib/webrick/httpresponse.rb<br>
+index 6d77692..d26324c 100644<br>
+--- a/lib/webrick/httpresponse.rb<br>
++++ b/lib/webrick/httpresponse.rb<br>
+@@ -367,7 +367,8 @@ def set_error(ex, backtrace=false)<br>
+ private<br>
+<br>
+ def check_header(header_value)<br>
+- if header_value =~ /\r\n/<br>
++ header_value = header_value.to_s<br>
++ if /[\r\n]/ =~ header_value<br>
+ raise InvalidHeader<br>
+ else<br>
+ header_value<br>
+diff --git a/test/webrick/test_httpresponse.rb b/test/webrick/test_httpresponse.rb<br>
+index 6263e0a..24a6968 100644<br>
+--- a/test/webrick/test_httpresponse.rb<br>
++++ b/test/webrick/test_httpresponse.rb<br>
+@@ -29,7 +29,7 @@ def setup<br>
+ @res.keep_alive = true<br>
+ end<br>
+<br>
+- def test_prevent_response_splitting_headers<br>
++ def test_prevent_response_splitting_headers_crlf<br>
+ res['X-header'] = "malicious\r\nCookie: hack"<br>
+ io = StringIO.new<br>
+ res.send_response io<br>
+@@ -39,7 +39,7 @@ def test_prevent_response_splitting_headers<br>
+ refute_match 'hack', io.string<br>
+ end<br>
+<br>
+- def test_prevent_response_splitting_cookie_headers<br>
++ def test_prevent_response_splitting_cookie_headers_crlf<br>
+ user_input = "malicious\r\nCookie: hack"<br>
+ res.cookies << WEBrick::Cookie.new('author', user_input)<br>
+ io = StringIO.new<br>
+@@ -50,6 +50,48 @@ def test_prevent_response_splitting_cookie_headers<br>
+ refute_match 'hack', io.string<br>
+ end<br>
+<br>
++ def test_prevent_response_splitting_headers_cr<br>
++ res['X-header'] = "malicious\rCookie: hack"<br>
++ io = StringIO.new<br>
++ res.send_response io<br>
++ io.rewind<br>
++ res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io))<br>
++ assert_equal '500', res.code<br>
++ refute_match 'hack', io.string<br>
++ end<br>
++<br>
++ def test_prevent_response_splitting_cookie_headers_cr<br>
++ user_input = "malicious\rCookie: hack"<br>
++ res.cookies << WEBrick::Cookie.new('author', user_input)<br>
++ io = StringIO.new<br>
++ res.send_response io<br>
++ io.rewind<br>
++ res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io))<br>
++ assert_equal '500', res.code<br>
++ refute_match 'hack', io.string<br>
++ end<br>
++<br>
++ def test_prevent_response_splitting_headers_lf<br>
++ res['X-header'] = "malicious\nCookie: hack"<br>
++ io = StringIO.new<br>
++ res.send_response io<br>
++ io.rewind<br>
++ res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io))<br>
++ assert_equal '500', res.code<br>
++ refute_match 'hack', io.string<br>
++ end<br>
++<br>
++ def test_prevent_response_splitting_cookie_headers_lf<br>
++ user_input = "malicious\nCookie: hack"<br>
++ res.cookies << WEBrick::Cookie.new('author', user_input)<br>
++ io = StringIO.new<br>
++ res.send_response io<br>
++ io.rewind<br>
++ res = Net::HTTPResponse.read_new(Net::BufferedIO.new(io))<br>
++ assert_equal '500', res.code<br>
++ refute_match 'hack', io.string<br>
++ end<br>
++<br>
+ def test_304_does_not_log_warning<br>
+ res.status = 304<br>
+ res.setup_header<br>
+--<br>
+2.7.4<br>
diff --git a/meta/recipes-devtools/ruby/<a href="http://ruby_2.5.5.bb" rel="noreferrer" target="_blank">ruby_2.5.5.bb</a> b/meta/recipes-devtools/ruby/<a href="http://ruby_2.5.5.bb" rel="noreferrer" target="_blank">ruby_2.5.5.bb</a><br>
index 223b037..58bb97f 100644<br>
--- a/meta/recipes-devtools/ruby/<a href="http://ruby_2.5.5.bb" rel="noreferrer" target="_blank">ruby_2.5.5.bb</a><br>
+++ b/meta/recipes-devtools/ruby/<a href="http://ruby_2.5.5.bb" rel="noreferrer" target="_blank">ruby_2.5.5.bb</a><br>
@@ -3,6 +3,7 @@ require ruby.inc<br>
SRC_URI += " \<br>
file://0001-configure.ac-check-finite-isinf-isnan-as-macros-firs.patch \<br>
file://run-ptest \<br>
+ file://fix-CVE-2019-16254.patch \<br>
"<br>
<br>
SRC_URI[md5sum] = "7e156fb526b8f4bb1b30a3dd8a7ce400"<br>
-- <br>
2.7.4<br>
<br>
</blockquote></div>
-- <br>
_______________________________________________<br>
Openembedded-core mailing list<br>
<a href="mailto:Openembedded-core@lists.openembedded.org" target="_blank">Openembedded-core@lists.openembedded.org</a><br>
<a href="http://lists.openembedded.org/mailman/listinfo/openembedded-core" rel="noreferrer" target="_blank">http://lists.openembedded.org/mailman/listinfo/openembedded-core</a><br>
</blockquote></div>