rubygem-cgi_multipart_eof_fix 2.5.0 www =0

Fix an exploitable bug in CGI multipart parsing
Maintained by: ruby@FreeBSD.org
Port Added: 08 Dec 2010 19:18:47
Also Listed In: rubygems
License: not specified in port

---

---

Fixes an exploitable bug in CGI multipart parsing which affects Ruby <= 1.8.5.
When multipart boundary attributes contain non-halting regular 
expression strings, the boundary searcher in the CGI module does not properly 
escape the parameter and will execute arbitrary regular expressions. 
This fix adds escaping for the user data.

    * Affected application servers: standalone CGI, Mongrel, WEBrick
    * Unaffected: FastCGI, Ruby 1.8.6 (all servers)
    * Unknown: mod_ruby

This fix will not modify versions of Ruby greater than 1.8.5, and is 
cumulative with previous CGI multipart vulnerability fixes. 

WWW: http://blog.evanweaver.com/pages/code#cgi_multipart_eof_fix

CVSWeb : Sources : Main Web Site : Distfiles Availability : PortsMon

---

NOTE: FreshPorts displays only required dependencies information. Optional dependencies are not covered.
Required To Build: devel/ruby-gems, lang/ruby18
Required To Run: devel/ruby-gems, lang/ruby18, lang/ruby18
There are no ports dependent upon this port

---

To install the port: cd /usr/ports/www/rubygem-cgi_multipart_eof_fix/ && make install clean
To add the package: pkg_add -r rubygem-cgi_multipart_eof_fix

---

Configuration Options

     No options to configure

---

Master Sites:

http://production.s3.rubygems.org/gems/

http://production.cf.rubygems.org/gems/

ftp://ftp.FreeBSD.org/pub/FreeBSD/ports/distfiles/rubygem/

- pkg-desc WWW updates

Fixes an exploitable bug in CGI multipart parsing which affects Ruby <= 1.8.5.
When multipart boundary attributes contain non-halting regular
expression strings, the boundary searcher in the CGI module does not properly
escape the parameter and will execute arbitrary regular expressions.
This fix adds escaping for the user data.

    * Affected application servers: standalone CGI, Mongrel, WEBrick
    * Unaffected: FastCGI, Ruby 1.8.6 (all servers)
    * Unknown: mod_ruby

This fix will not modify versions of Ruby greater than 1.8.5, and is
cumulative with previous CGI multipart vulnerability fixes.

WWW:    http://blog.evanweaver.com/#cgi_multipart_eof_fix

12 vulnerabilities affecting 17 ports have been reported in the past 14 days

^* - modified, not new

All vulnerabilities