fix CVE-2024-26141 CVE-2024-26146 CVE-2024-25126

CVE-2024-25126.patch

@@ -0,0 +1,51 @@
+From d9c163a443b8cadf4711d84bd2c58cb9ef89cf49 Mon Sep 17 00:00:00 2001
+From: Jean Boussier <jean.boussier@gmail.com>
+Date: Wed, 6 Dec 2023 18:32:19 +0100
+Subject: [PATCH] Avoid 2nd degree polynomial regexp in MediaType
+
+---
+ lib/rack/media_type.rb | 13 +++++++++----
+ 1 file changed, 9 insertions(+), 4 deletions(-)
+
+diff --git a/lib/rack/media_type.rb b/lib/rack/media_type.rb
+index 41937c99..7fc1e39d 100644
+--- a/lib/rack/media_type.rb
++++ b/lib/rack/media_type.rb
+@@ -4,7 +4,7 @@ module Rack
+   # Rack::MediaType parse media type and parameters out of content_type string
+ 
+   class MediaType
+-    SPLIT_PATTERN = %r{\s*[;,]\s*}
++    SPLIT_PATTERN = /[;,]/
+ 
+     class << self
+       # The media type (type/subtype) portion of the CONTENT_TYPE header
+@@ -15,7 +15,11 @@ module Rack
+       # http://www.w3.org/Protocols/rfc2616/rfc2616-sec3.html#sec3.7
+       def type(content_type)
+         return nil unless content_type
+-        content_type.split(SPLIT_PATTERN, 2).first.tap &:downcase!
++        if type = content_type.split(SPLIT_PATTERN, 2).first
++          type.rstrip!
++          type.downcase!
++          type
++        end
+       end
+ 
+       # The media type parameters provided in CONTENT_TYPE as a Hash, or
+@@ -27,9 +31,10 @@ module Rack
+         return {} if content_type.nil?
+ 
+         content_type.split(SPLIT_PATTERN)[1..-1].each_with_object({}) do |s, hsh|
++          s.strip!
+           k, v = s.split('=', 2)
+-
+-          hsh[k.tap(&:downcase!)] = strip_doublequotes(v)
++          k.downcase!
++          hsh[k] = strip_doublequotes(v)
+         end
+       end
+ 
+-- 
+2.25.1
+

CVE-2024-26141.patch

@@ -0,0 +1,30 @@
+From 72ecb3f4e05b2fc0a5073d23fd178686818eb958 Mon Sep 17 00:00:00 2001
+From: Aaron Patterson <tenderlove@ruby-lang.org>
+Date: Tue, 13 Feb 2024 13:34:34 -0800
+Subject: [PATCH] Return an empty array when ranges are too large
+
+If the sum of the requested ranges is larger than the file itself,
+return an empty array. In other words, refuse to respond with any bytes.
+
+[CVE-2024-26141]
+---
+ lib/rack/utils.rb | 3 +++
+ 1 file changed, 3 insertions(+)
+
+diff --git a/lib/rack/utils.rb b/lib/rack/utils.rb
+index ca6182c..199312f 100644
+--- a/lib/rack/utils.rb
++++ b/lib/rack/utils.rb
+@@ -379,6 +379,9 @@ module Rack
+         end
+         ranges << (r0..r1)  if r0 <= r1
+       end
++
++      return [] if ranges.map(&:size).sum > size
++
+       ranges
+     end
+ 
+-- 
+2.43.0
+

CVE-2024-26146.patch

@@ -0,0 +1,30 @@
+From e4c117749ba24a66f8ec5a08eddf68deeb425ccd Mon Sep 17 00:00:00 2001
+From: Aaron Patterson <tenderlove@ruby-lang.org>
+Date: Wed, 21 Feb 2024 11:05:06 -0800
+Subject: [PATCH] Fixing ReDoS in header parsing
+
+Thanks svalkanov
+
+[CVE-2024-26146]
+---
+ lib/rack/utils.rb | 4 ++--
+ 1 file changed, 2 insertions(+), 2 deletions(-)
+
+diff --git a/lib/rack/utils.rb b/lib/rack/utils.rb
+index c8e61ea1..0ed64b7a 100644
+--- a/lib/rack/utils.rb
++++ b/lib/rack/utils.rb
+@@ -142,8 +142,8 @@ module Rack
+     end
+ 
+     def q_values(q_value_header)
+-      q_value_header.to_s.split(/\s*,\s*/).map do |part|
+-        value, parameters = part.split(/\s*;\s*/, 2)
++      q_value_header.to_s.split(',').map do |part|
++        value, parameters = part.split(';', 2).map(&:strip)
+         quality = 1.0
+         if parameters && (md = /\Aq=([\d.]+)/.match(parameters))
+           quality = md[1].to_f
+-- 
+2.25.1
+

rubygem-rack.spec

@@ -4,13 +4,16 @@
 Name:    rubygem-%{gem_name}
 Version: 2.2.3.1
 Epoch:   1
-Release: 3
+Release: 4
 Summary: A modular Ruby webserver interface
 License: MIT and BSD
 URL:     https://rack.github.io/
 Source0: https://rubygems.org/downloads/%{gem_name}-%{version}.gem
 
 Patch0: CVE-2024-39316.patch
+Patch1: CVE-2024-26141.patch
+Patch2: CVE-2024-26146.patch
+Patch3: CVE-2024-25126.patch
 
 BuildRequires: ruby(release) rubygems-devel ruby >= 2.2.2 rubygem(concurrent-ruby)
 BuildRequires: memcached rubygem(memcache-client) rubygem(minitest)
@@ -42,7 +45,7 @@ BuildArch: noarch
 Documentation for %{name}.
 
 %prep
-%autosetup -n %{gem_name}-%{version} -p1 -S git
+%autosetup -n %{gem_name}-%{version} -p1
 
 %build
 gem build ../%{gem_name}-%{version}.gemspec
@@ -100,6 +103,12 @@ popd
 %doc %{gem_instdir}/contrib
 
 %changelog
+* Fri Jul 05 2024 zouzhimin <zouzhimin@kylinos.cn> - 1:2.2.3.1-4
+- Type:CVES
+- ID:CVE-2024-26141 CVE-2024-26146 CVE-2024-25126
+- SUG:NA
+- DESC:CVE-2024-26141 CVE-2024-26146 CVE-2024-25126
+
 * Wed Jul 3 2024 liningjie <liningjie@xfusion.com> - 1:2.2.3.1-3
 - Fix CVE-2024-39316