Skip to content

Commit b2015ea

Browse files
CBL-Mariner-Botharshitgupta1337
CBL-Mariner-Bot
and
harshitgupta1337
authored
[AUTO-CHERRYPICK] Add patch for CVE-2024-41946 to ruby and rubygem-rexml - branch main (#10510)
Co-authored-by: Harshit Gupta <harshitgupta1337@gmail.com>
1 parent d0eb3f3 commit b2015ea

4 files changed

Lines changed: 233 additions & 2 deletions

File tree

‎SPECS/ruby/CVE-2024-41946.patch‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
From c5565ff926fde19da10b7b4b1b9768d5dadb67e1 Mon Sep 17 00:00:00 2001
2+
From: Harshit Gupta <guptaharshit@microsoft.com>
3+
Date: Thu, 19 Sep 2024 06:30:45 -0700
4+
Subject: [PATCH] Apply patch for CVE-2024-41946
5+
6+
---
7+
.../lib/rexml/parsers/baseparser.rb | 19 ++++++++++++++++++-
8+
.../lib/rexml/parsers/pullparser.rb | 4 ++++
9+
.../lib/rexml/parsers/sax2parser.rb | 4 ++++
10+
3 files changed, 26 insertions(+), 1 deletion(-)
11+
12+
Based on upstream commit
13+
https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368
14+
15+
diff --git a/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb b/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb
16+
index ee30e17..30e8d65 100644
17+
--- a/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb
18+
+++ b/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/baseparser.rb
19+
@@ -115,6 +115,7 @@ module REXML
20+
def initialize( source )
21+
self.stream = source
22+
@listeners = []
23+
+ @entity_expansion_count = 0
24+
end
25+
26+
def add_listener( listener )
27+
@@ -122,6 +123,7 @@ module REXML
28+
end
29+
30+
attr_reader :source
31+
+ attr_reader :entity_expansion_count
32+
33+
def stream=( source )
34+
@source = SourceFactory.create_from( source )
35+
@@ -438,7 +440,9 @@ module REXML
36+
def entity( reference, entities )
37+
value = nil
38+
value = entities[ reference ] if entities
39+
- if not value
40+
+ if value
41+
+ record_entity_expansion
42+
+ else
43+
value = DEFAULT_ENTITIES[ reference ]
44+
value = value[2] if value
45+
end
46+
@@ -474,12 +478,17 @@ module REXML
47+
}
48+
matches.collect!{|x|x[0]}.compact!
49+
if matches.size > 0
50+
+ sum = 0
51+
matches.each do |entity_reference|
52+
unless filter and filter.include?(entity_reference)
53+
entity_value = entity( entity_reference, entities )
54+
if entity_value
55+
re = /&#{entity_reference};/
56+
rv.gsub!( re, entity_value )
57+
+ sum += rv.bytesize
58+
+ if sum > Security.entity_expansion_text_limit
59+
+ raise "entity expansion has grown too large"
60+
+ end
61+
else
62+
er = DEFAULT_ENTITIES[entity_reference]
63+
rv.gsub!( er[0], er[2] ) if er
64+
@@ -492,6 +501,14 @@ module REXML
65+
end
66+
67+
private
68+
+
69+
+ def record_entity_expansion
70+
+ @entity_expansion_count += 1
71+
+ if @entity_expansion_count > Security.entity_expansion_limit
72+
+ raise "number of entity expansions exceeded, processing aborted."
73+
+ end
74+
+ end
75+
+
76+
def need_source_encoding_update?(xml_declaration_encoding)
77+
return false if xml_declaration_encoding.nil?
78+
return false if /\AUTF-16\z/i =~ xml_declaration_encoding
79+
diff --git a/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/pullparser.rb b/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/pullparser.rb
80+
index f8b232a..36b4595 100644
81+
--- a/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/pullparser.rb
82+
+++ b/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/pullparser.rb
83+
@@ -47,6 +47,10 @@ module REXML
84+
@listeners << listener
85+
end
86+
87+
+ def entity_expansion_count
88+
+ @parser.entity_expansion_count
89+
+ end
90+
+
91+
def each
92+
while has_next?
93+
yield self.pull
94+
diff --git a/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/sax2parser.rb b/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/sax2parser.rb
95+
index 6a24ce2..01cb469 100644
96+
--- a/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/sax2parser.rb
97+
+++ b/.bundle/gems/rexml-3.2.5/lib/rexml/parsers/sax2parser.rb
98+
@@ -22,6 +22,10 @@ module REXML
99+
@parser.source
100+
end
101+
102+
+ def entity_expansion_count
103+
+ @parser.entity_expansion_count
104+
+ end
105+
+
106+
def add_listener( listener )
107+
@parser.add_listener( listener )
108+
end
109+
--
110+
2.34.1
111+

‎SPECS/ruby/ruby.spec‎

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -83,7 +83,7 @@ Name: ruby
8383
# provides should be versioned according to the ruby version.
8484
# More info: https://stdgems.org/
8585
Version: 3.1.4
86-
Release: 6%{?dist}
86+
Release: 7%{?dist}
8787
License: (Ruby OR BSD) AND Public Domain AND MIT AND CC0 AND zlib AND UCD
8888
Vendor: Microsoft Corporation
8989
Distribution: Mariner
@@ -104,6 +104,8 @@ Patch2: CVE-2024-27281.patch
104104
Patch3: CVE-2024-27282.patch
105105
# Patch no longer needed if REXML gem is 3.2.7 or later. Now is 3.2.5
106106
Patch4: CVE-2024-35176.patch
107+
# Patch no longer needed if REXML gem is 3.3.3 or later. Now is 3.2.5
108+
Patch5: CVE-2024-41946.patch
107109
BuildRequires: openssl-devel
108110
BuildRequires: readline
109111
BuildRequires: readline-devel
@@ -406,6 +408,9 @@ sudo -u test make test TESTS="-v"
406408
%{_rpmconfigdir}/rubygems.con
407409

408410
%changelog
411+
* Thu Sep 19 2024 Harshit Gupta <guptaharshit@microsoft.com> - 3.1.4-7
412+
- Patch CVE-2024-41946
413+
409414
* Thu May 30 2024 Minghe Ren <mingheren@microsoft.com> - 3.1.4-6
410415
- Patch CVE-2024-35176
411416

‎SPECS/rubygem-rexml/CVE-2024-41946.patch‎

Lines changed: 111 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,111 @@
1+
From f91985dc627c487b3d03b0f83b1087515dd92f7c Mon Sep 17 00:00:00 2001
2+
From: Harshit Gupta <guptaharshit@microsoft.com>
3+
Date: Thu, 19 Sep 2024 07:30:21 -0700
4+
Subject: [PATCH] Apply CVE-2024-41946.patch
5+
6+
---
7+
lib/rexml/parsers/baseparser.rb | 19 ++++++++++++++++++-
8+
lib/rexml/parsers/pullparser.rb | 4 ++++
9+
lib/rexml/parsers/sax2parser.rb | 4 ++++
10+
3 files changed, 26 insertions(+), 1 deletion(-)
11+
12+
Based on upstream commit
13+
https://github.com/ruby/rexml/commit/033d1909a8f259d5a7c53681bcaf14f13bcf0368
14+
15+
diff --git a/lib/rexml/parsers/baseparser.rb b/lib/rexml/parsers/baseparser.rb
16+
index d09237c..61f6787 100644
17+
--- a/lib/rexml/parsers/baseparser.rb
18+
+++ b/lib/rexml/parsers/baseparser.rb
19+
@@ -128,6 +128,7 @@ module REXML
20+
def initialize( source )
21+
self.stream = source
22+
@listeners = []
23+
+ @entity_expansion_count = 0
24+
end
25+
26+
def add_listener( listener )
27+
@@ -135,6 +136,7 @@ module REXML
28+
end
29+
30+
attr_reader :source
31+
+ attr_reader :entity_expansion_count
32+
33+
def stream=( source )
34+
@source = SourceFactory.create_from( source )
35+
@@ -446,7 +448,9 @@ module REXML
36+
def entity( reference, entities )
37+
value = nil
38+
value = entities[ reference ] if entities
39+
- if not value
40+
+ if value
41+
+ record_entity_expansion
42+
+ else
43+
value = DEFAULT_ENTITIES[ reference ]
44+
value = value[2] if value
45+
end
46+
@@ -481,12 +485,17 @@ module REXML
47+
}
48+
matches.collect!{|x|x[0]}.compact!
49+
if matches.size > 0
50+
+ sum = 0
51+
matches.each do |entity_reference|
52+
unless filter and filter.include?(entity_reference)
53+
entity_value = entity( entity_reference, entities )
54+
if entity_value
55+
re = /&#{entity_reference};/
56+
rv.gsub!( re, entity_value )
57+
+ sum += rv.bytesize
58+
+ if sum > Security.entity_expansion_text_limit
59+
+ raise "entity expansion has grown too large"
60+
+ end
61+
else
62+
er = DEFAULT_ENTITIES[entity_reference]
63+
rv.gsub!( er[0], er[2] ) if er
64+
@@ -499,6 +508,14 @@ module REXML
65+
end
66+
67+
private
68+
+
69+
+ def record_entity_expansion
70+
+ @entity_expansion_count += 1
71+
+ if @entity_expansion_count > Security.entity_expansion_limit
72+
+ raise "number of entity expansions exceeded, processing aborted."
73+
+ end
74+
+ end
75+
+
76+
def need_source_encoding_update?(xml_declaration_encoding)
77+
return false if xml_declaration_encoding.nil?
78+
return false if /\AUTF-16\z/i =~ xml_declaration_encoding
79+
diff --git a/lib/rexml/parsers/pullparser.rb b/lib/rexml/parsers/pullparser.rb
80+
index f8b232a..36b4595 100644
81+
--- a/lib/rexml/parsers/pullparser.rb
82+
+++ b/lib/rexml/parsers/pullparser.rb
83+
@@ -47,6 +47,10 @@ module REXML
84+
@listeners << listener
85+
end
86+
87+
+ def entity_expansion_count
88+
+ @parser.entity_expansion_count
89+
+ end
90+
+
91+
def each
92+
while has_next?
93+
yield self.pull
94+
diff --git a/lib/rexml/parsers/sax2parser.rb b/lib/rexml/parsers/sax2parser.rb
95+
index 6a24ce2..01cb469 100644
96+
--- a/lib/rexml/parsers/sax2parser.rb
97+
+++ b/lib/rexml/parsers/sax2parser.rb
98+
@@ -22,6 +22,10 @@ module REXML
99+
@parser.source
100+
end
101+
102+
+ def entity_expansion_count
103+
+ @parser.entity_expansion_count
104+
+ end
105+
+
106+
def add_listener( listener )
107+
@parser.add_listener( listener )
108+
end
109+
--
110+
2.34.1
111+

‎SPECS/rubygem-rexml/rubygem-rexml.spec‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -3,13 +3,14 @@
33
Summary: REXML is an XML toolkit for Ruby
44
Name: rubygem-%{gem_name}
55
Version: 3.2.7
6-
Release: 1%{?dist}
6+
Release: 2%{?dist}
77
License: BSD
88
Vendor: Microsoft Corporation
99
Distribution: Mariner
1010
Group: Development/Languages
1111
URL: https://github.com/ruby/rexml
1212
Source0: https://github.com/ruby/rexml/archive/refs/tags/v%{version}.tar.gz#/%{gem_name}-%{version}.tar.gz
13+
Patch0: CVE-2024-41946.patch
1314
BuildRequires: git
1415
BuildRequires: ruby
1516
Requires: ruby(release)
@@ -34,6 +35,9 @@ gem install -V --local --force --install-dir %{buildroot}/%{gemdir} %{gem_name}-
3435
%{gemdir}
3536

3637
%changelog
38+
* Thu Sep 19 2024 Harshit Gupta <guptaharshit@microsoft.com> - 3.2.7-2
39+
- Add patch for CVE-2024-41946
40+
3741
* Fri May 31 2024 Minghe Ren <mingheren@microsoft.com> - 3.2.7-1
3842
- Upgrade to 3.2.7 to resolve CVE-2024-35176
3943
- Remove CVE-2024-35176.patch as it is no longer needed

0 commit comments

Comments
 (0)