Git-Url: http://git.frugalware.org/gitweb/gitweb.cgi?p=frugalware-1.9.git;a=commitdiff;h=ef8e96cc474c397aa7fa51704cb43326e1fd96b3
commit ef8e96cc474c397aa7fa51704cb43326e1fd96b3 Author: kikadf <[email protected]> Date: Mon Apr 14 09:29:07 2014 +0200 actionmailer-3.2.6-2arcturus1-x86_64 * Fix CVE-2013-4389 diff --git a/source/devel-extra/actionmailer/CVE-2013-4389.patch b/source/devel-extra/actionmailer/CVE-2013-4389.patch new file mode 100644 index 0000000..f802e0b --- /dev/null +++ b/source/devel-extra/actionmailer/CVE-2013-4389.patch @@ -0,0 +1,33 @@ +From 5aee516b5edb49d7206cd9815c13a78b6b16c5d9 Mon Sep 17 00:00:00 2001 +From: Michael Koziarski <[email protected]> +Date: Mon, 23 Sep 2013 10:17:58 +1200 +Subject: [PATCH] Remove the use of String#% when formatting durations in log + messages + +This avoids potential format string vulnerabilities where user-provided +data is interpolated into the log message before String#% is called. + +--- ruby-actionmailer-3.2.orig/lib/action_mailer/log_subscriber.rb ++++ ruby-actionmailer-3.2/lib/action_mailer/log_subscriber.rb +@@ -4,12 +4,12 @@ module ActionMailer + class LogSubscriber < ActiveSupport::LogSubscriber + def deliver(event) + recipients = Array.wrap(event.payload[:to]).join(', ') +- info("\nSent mail to #{recipients} (%1.fms)" % event.duration) ++ info("\nSent mail to #{recipients} (#{format_duration(event.duration)})") + debug(event.payload[:mail]) + end + + def receive(event) +- info("\nReceived mail (%.1fms)" % event.duration) ++ info("\nReceived mail (#{format_duration(event.duration)})") + debug(event.payload[:mail]) + end + +@@ -19,4 +19,4 @@ module ActionMailer + end + end + +-ActionMailer::LogSubscriber.attach_to :action_mailer +\ No newline at end of file ++ActionMailer::LogSubscriber.attach_to :action_mailer diff --git a/source/devel-extra/actionmailer/FrugalBuild b/source/devel-extra/actionmailer/FrugalBuild index 7deef7a..8576d85 100644 --- a/source/devel-extra/actionmailer/FrugalBuild +++ b/source/devel-extra/actionmailer/FrugalBuild @@ -1,13 +1,20 @@ # Compiling Time: 0.08 SBU +# Contributor: kikadf <[email protected]> # Maintainer: jercel <[email protected]> pkgname=actionmailer pkgver=3.2.6 -pkgrel=1 +pkgrel=2arcturus1 pkgdesc="Framework for designing email-service layers" url="http://rubyforge.org/projects/actionmailer/"; -depends=('actionpack>=3.2.6') +depends=('actionpack>=3.2.6-2arcturus1') groups=('devel-extra') archs=('i686' 'x86_64') Finclude gem sha1sums=('e90791862b8c4ce3c789180e8d39268f442b73cd') + +# FSA fix *** +source=(${source[@]} CVE-2013-4389.patch) +sha1sums=(${sha1sums[@]} 'f97ece2a3f56a59cf724d945dde2211151a08587') +# *********** + _______________________________________________ Frugalware-git mailing list [email protected] http://frugalware.org/mailman/listinfo/frugalware-git
