diff -Nru ruby-openid-2.1.8debian/debian/changelog ruby-openid-2.1.8debian/debian/changelog --- ruby-openid-2.1.8debian/debian/changelog 2012-06-26 19:32:35.000000000 +0700 +++ ruby-openid-2.1.8debian/debian/changelog 2013-06-12 16:37:30.000000000 +0700 @@ -1,3 +1,13 @@ +ruby-openid (2.1.8debian-5ubuntu0.1) quantal-security; urgency=low + + * SECURITY-UPDATE: XML denial of service attack (LP: #1190179) + - debian/patches/02_CVE_2013_1812.patch: lib/openid/fetchers.rb, + lib/openid/yadis/xrds.rb: limit fetching file size & disable XML entity + expansion. Based on upstream patch. + - CVE-2013-1812 + + -- Christian Kuersteiner Wed, 12 Jun 2013 16:37:06 +0700 + ruby-openid (2.1.8debian-5) unstable; urgency=low * Bump build dependency on gem2deb to >= 0.3.0~ diff -Nru ruby-openid-2.1.8debian/debian/control ruby-openid-2.1.8debian/debian/control --- ruby-openid-2.1.8debian/debian/control 2012-06-26 19:32:34.000000000 +0700 +++ ruby-openid-2.1.8debian/debian/control 2013-06-13 13:32:58.000000000 +0700 @@ -1,7 +1,8 @@ Source: ruby-openid Section: ruby Priority: optional -Maintainer: Debian Ruby Extras Maintainers +Maintainer: Ubuntu Developers +XSBC-Original-Maintainer: Debian Ruby Extras Maintainers Uploaders: Cédric Boutillier , Paul van Tilburg DM-Upload-Allowed: yes Build-Depends: debhelper (>= 7.0.50~), gem2deb (>= 0.3.0~) diff -Nru ruby-openid-2.1.8debian/debian/patches/02_CVE_2013_1812.patch ruby-openid-2.1.8debian/debian/patches/02_CVE_2013_1812.patch --- ruby-openid-2.1.8debian/debian/patches/02_CVE_2013_1812.patch 1970-01-01 07:00:00.000000000 +0700 +++ ruby-openid-2.1.8debian/debian/patches/02_CVE_2013_1812.patch 2013-06-12 16:33:48.000000000 +0700 @@ -0,0 +1,109 @@ +Description: limit fetching file size & disable XML entity expansion +Origin: upstream, https://github.com/openid/ruby-openid/commit/a3693cef06049563f5b4e4824f4d3211288508ed +Author: ckuerste@gmx.ch +Bug: https://github.com/openid/ruby-openid/pull/43 +Ubuntu-Bug: https://bugs.launchpad.net/ubuntu/+source/ruby-openid/+bug/1190179 +--- a/lib/openid/fetchers.rb ++++ b/lib/openid/fetchers.rb +@@ -10,7 +10,7 @@ + require 'net/http' + end + +-MAX_RESPONSE_KB = 1024 ++MAX_RESPONSE_KB = 10485760 # 10 MB (can be smaller, I guess) + + module Net + class HTTP +@@ -192,6 +192,16 @@ + conn = make_connection(url) + response = nil + ++ whole_body = '' ++ body_size_limitter = lambda do |r| ++ r.read_body do |partial| # read body now ++ whole_body << partial ++ if whole_body.length > MAX_RESPONSE_KB ++ raise FetchingError.new("Response Too Large") ++ end ++ end ++ whole_body ++ end + response = conn.start { + # Check the certificate against the URL's hostname + if supports_ssl?(conn) and conn.use_ssl? +@@ -199,13 +209,12 @@ + end + + if body.nil? +- conn.request_get(url.request_uri, headers) ++ conn.request_get(url.request_uri, headers, &body_size_limitter) + else + headers["Content-type"] ||= "application/x-www-form-urlencoded" +- conn.request_post(url.request_uri, body, headers) ++ conn.request_post(url.request_uri, body, headers, &body_size_limitter) + end + } +- setup_encoding(response) + rescue Timeout::Error => why + raise FetchingError, "Error fetching #{url}: #{why}" + rescue RuntimeError => why +@@ -232,7 +241,10 @@ + raise FetchingError, "Error encountered in redirect from #{url}: #{why}" + end + else +- return HTTPResponse._from_net_response(response, unparsed_url) ++ response = HTTPResponse._from_net_response(response, unparsed_url) ++ response.body = whole_body ++ setup_encoding(response) ++ return response + end + end + +--- a/lib/openid/yadis/xrds.rb ++++ b/lib/openid/yadis/xrds.rb +@@ -88,23 +88,33 @@ + end + + def Yadis::parseXRDS(text) +- if text.nil? +- raise XRDSError.new("Not an XRDS document.") +- end ++ disable_entity_expansion do ++ if text.nil? ++ raise XRDSError.new("Not an XRDS document.") ++ end + +- begin +- d = REXML::Document.new(text) +- rescue RuntimeError => why +- raise XRDSError.new("Not an XRDS document. Failed to parse XML.") +- end ++ begin ++ d = REXML::Document.new(text) ++ rescue RuntimeError => why ++ raise XRDSError.new("Not an XRDS document. Failed to parse XML.") ++ end + +- if is_xrds?(d) +- return d +- else +- raise XRDSError.new("Not an XRDS document.") ++ if is_xrds?(d) ++ return d ++ else ++ raise XRDSError.new("Not an XRDS document.") ++ end + end + end + ++ def Yadis::disable_entity_expansion ++ _previous_ = REXML::Document::entity_expansion_limit ++ REXML::Document::entity_expansion_limit = 0 ++ yield ++ ensure ++ REXML::Document::entity_expansion_limit = _previous_ ++ end ++ + def Yadis::is_xrds?(xrds_tree) + xrds_root = xrds_tree.root + return (!xrds_root.nil? and diff -Nru ruby-openid-2.1.8debian/debian/patches/series ruby-openid-2.1.8debian/debian/patches/series --- ruby-openid-2.1.8debian/debian/patches/series 2012-05-18 05:27:04.000000000 +0700 +++ ruby-openid-2.1.8debian/debian/patches/series 2013-06-12 14:30:01.000000000 +0700 @@ -1 +1,2 @@ 01_remove_rubygems_require.diff +02_CVE_2013_1812.patch