4 Commits

Include renames

Author	SHA1	Message	Date
Thomas Perrot	09a260e5d4	ruby: fix the reproducibility issue ... Apply some changes on the Ruby makefiles in order to fix the reproducibility: - use a fixed timestamp, - sort linked objects, - doesn't use the current date, - and use UTC date. [YOCTO #14268] (From OE-Core rev: eea2f854fdd0f036dae2671ae52ba4695a83df68) Signed-off-by: Thomas Perrot <thomas.perrot@bootlin.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit 59b07ab51ff932a4632a31675445ba4192bae36b) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>	2021-10-29 11:17:21 +01:00
Mingli Yu	7de4e6b582	ruby: fix CVE-2021-31799 ... Backport a patch to fix CVE-2021-31799. (From OE-Core rev: 97d0237e254a0d90b58fe35a1b40d549991b3779) Signed-off-by: Mingli Yu <mingli.yu@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>	2021-09-17 21:31:37 +01:00
Yi Zhao	033ba67e53	ruby: Security fixes for CVE-2021-31810/CVE-2021-32066 ... CVE-2021-31810: A malicious FTP server can use the PASV response to trick Net::FTP into connecting back to a given IP address and port. This potentially makes Net::FTP extract information about services that are otherwise private and not disclosed (e.g., the attacker can conduct port scans and service banner extractions). CVE-2021-32066: Net::IMAP does not raise an exception when StartTLS fails with an unknown response, which might allow man-in-the-middle attackers to bypass the TLS protections by leveraging a network position between the client and the registry to block the StartTLS command, aka a “StartTLS stripping attack.” References: https://www.ruby-lang.org/en/news/2021/07/07/trusting-pasv-responses-in-net-ftp/ https://www.ruby-lang.org/en/news/2021/07/07/starttls-stripping-in-net-imap/ Patches from: https://github.com/ruby/ruby/commit/bf4d05173c7cf04d8892e4b64508ecf7902717cd https://github.com/ruby/ruby/commit/e2ac25d0eb66de99f098d6669cf4f06796aa6256 (From OE-Core rev: e14761916290c01683d72eb8e3de530f944fdfab) Signed-off-by: Yi Zhao <yi.zhao@windriver.com> Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>	2021-09-17 21:31:37 +01:00
zhengruoqin	81aabb718e	ruby: upgrade 3.0.0 -> 3.0.1 ... (From OE-Core rev: 9fde0b5121b6cda894ef761a526fa4feced02d5f) Signed-off-by: Zheng Ruoqin <zhengrq.fnst@fujitsu.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org> (cherry picked from commit b6949a028fd31bd04ed0478fb34a58b971f31e1f) Signed-off-by: Anuj Mittal <anuj.mittal@intel.com> Signed-off-by: Richard Purdie <richard.purdie@linuxfoundation.org>	2021-05-15 17:18:21 +01:00