diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000000000000000000000000000000000000..f087b429e2f81a9f37b28a8308e2210f84df6c9b --- /dev/null +++ b/.gitattributes @@ -0,0 +1 @@ +*.tar.gz filter=lfs diff=lfs merge=lfs -text diff --git a/.lfsconfig b/.lfsconfig new file mode 100644 index 0000000000000000000000000000000000000000..bd3362372de6ce49fe4edce7cb501cce94c26c73 --- /dev/null +++ b/.lfsconfig @@ -0,0 +1,2 @@ +[lfs] + url = https://artlfs.openeuler.openatom.cn/src-openeuler/passenger diff --git a/CVE-2025-26803.patch b/CVE-2025-26803.patch deleted file mode 100644 index fe39d0014b16d2cbdf60208cac8bcbeaa8da978f..0000000000000000000000000000000000000000 --- a/CVE-2025-26803.patch +++ /dev/null @@ -1,143 +0,0 @@ -From bb15591646687064ab2d578d5f9660b2a4168017 Mon Sep 17 00:00:00 2001 -From: Camden Narzt -Date: Tue, 18 Feb 2025 07:57:54 -0700 -Subject: [PATCH] Fix header parser - -Origin: https://github.com/phusion/passenger/commit/bb15591646687064ab2d578d5f9660b2a4168017 ---- - CHANGELOG | 2 +- - .../ServerKit/HttpHeaderParser.h | 40 +++++++++---------- - test/cxx/ServerKit/HttpServerTest.cpp | 27 ++++++++++++- - 3 files changed, 46 insertions(+), 23 deletions(-) - -diff --git a/src/cxx_supportlib/ServerKit/HttpHeaderParser.h b/src/cxx_supportlib/ServerKit/HttpHeaderParser.h -index d43d4fe31e..1b01860707 100644 ---- a/src/cxx_supportlib/ServerKit/HttpHeaderParser.h -+++ b/src/cxx_supportlib/ServerKit/HttpHeaderParser.h -@@ -119,31 +119,26 @@ class HttpHeaderParser { - } - - static size_t http_parser_execute_and_handle_pause(llhttp_t *parser, -- const char *data, size_t len, bool &paused) -+ const char *data, size_t len) - { - llhttp_errno_t rc = llhttp_get_errno(parser); - switch (rc) { - case HPE_PAUSED_UPGRADE: - llhttp_resume_after_upgrade(parser); -+ rc = llhttp_get_errno(parser); - goto happy_path; - case HPE_PAUSED: - llhttp_resume(parser); -+ rc = llhttp_get_errno(parser); - goto happy_path; - case HPE_OK: -+ rc = llhttp_execute(parser, data, len); - happy_path: -- switch (llhttp_execute(parser, data, len)) { -- case HPE_PAUSED_H2_UPGRADE: -- case HPE_PAUSED_UPGRADE: -- case HPE_PAUSED: -- paused = true; -- return (llhttp_get_error_pos(parser) - data); -- case HPE_OK: -+ if (rc == HPE_OK) { - return len; -- default: -- goto error_path; -- } -+ } -+ // deliberate fall through - default: -- error_path: - return (llhttp_get_error_pos(parser) - data); - } - } -@@ -488,20 +483,22 @@ class HttpHeaderParser { - TRACE_POINT(); - P_ASSERT_EQ(message->httpState, Message::PARSING_HEADERS); - -- size_t ret; -- bool paused; -- - state->parser.data = this; - currentBuffer = &buffer; -- ret = http_parser_execute_and_handle_pause(&state->parser, -- buffer.start, buffer.size(), paused); -+ size_t ret = http_parser_execute_and_handle_pause(&state->parser, -+ buffer.start, buffer.size()); - currentBuffer = NULL; - -- if (!llhttp_get_upgrade(&state->parser) && ret != buffer.size() && !paused || !paused && llhttp_get_errno(&state->parser) != HPE_OK) { -+ llhttp_errno_t llerrno = llhttp_get_errno(&state->parser); -+ -+ bool paused = (llerrno == HPE_PAUSED_H2_UPGRADE || llerrno == HPE_PAUSED_UPGRADE || llerrno == HPE_PAUSED); -+ -+ if ( (!llhttp_get_upgrade(&state->parser) && ret != buffer.size() && !paused) || -+ (llerrno != HPE_OK && !paused) ) { - UPDATE_TRACE_POINT(); - message->httpState = Message::ERROR; -- switch (llhttp_get_errno(&state->parser)) { -- case HPE_CB_HEADER_FIELD_COMPLETE://?? does this match was HPE_CB_header_field in old one -+ switch (llerrno) { -+ case HPE_CB_HEADER_FIELD_COMPLETE:// does this match? was HPE_CB_header_field in old impl - case HPE_CB_HEADERS_COMPLETE: - switch (state->state) { - case HttpHeaderParserState::ERROR_SECURITY_PASSWORD_MISMATCH: -@@ -526,9 +523,10 @@ class HttpHeaderParser { - break; - default: - default_error: -- message->aux.parseError = HTTP_PARSER_ERRNO_BEGIN - llhttp_get_errno(&state->parser); -+ message->aux.parseError = HTTP_PARSER_ERRNO_BEGIN - llerrno; - break; - } -+ llhttp_finish(&state->parser); - } else if (messageHttpStateIndicatesCompletion(MessageType())) { - UPDATE_TRACE_POINT(); - message->httpMajor = llhttp_get_http_major(&state->parser); -diff --git a/test/cxx/ServerKit/HttpServerTest.cpp b/test/cxx/ServerKit/HttpServerTest.cpp -index df87b5daaf..9fb0ad952f 100644 ---- a/test/cxx/ServerKit/HttpServerTest.cpp -+++ b/test/cxx/ServerKit/HttpServerTest.cpp -@@ -806,6 +806,32 @@ namespace tut { - "hello /"); - } - -+ TEST_METHOD(19) { -+ set_test_name("It responds with correct error if http method is not recognized"); -+ -+ // send invalid request -+ connectToServer(); -+ sendRequest("BAD_METHOD / HTTP/1.1\r\n" -+ "Connection: close\r\n" -+ "Host: foo\r\n\r\n"); -+ string response = readAll(fd, 1024).first; -+ -+ ensure("Response starts with error", -+ startsWith(response, -+ "HTTP/1.0 400 Bad Request\r\n" -+ "Status: 400 Bad Request\r\n" -+ "Content-Type: text/html; charset=UTF-8\r\n")); -+ -+ ensure("Response ends with error", -+ endsWith(response, -+ "Connection: close\r\n" -+ "Content-Length: 19\r\n" -+ "cache-control: no-cache, no-store, must-revalidate\r\n" -+ "\r\n" -+ "invalid HTTP method")); -+ ensure_equals("Response size is correct", response.size(), 242u); -+ } -+ - /***** Fixed body handling *****/ - - TEST_METHOD(20) { -@@ -1477,7 +1503,6 @@ namespace tut { - ensure("(1)", containsSubstring(response, "HTTP/1.1 400 Bad Request\r\n")); - } - -- - /***** Secure headers handling *****/ - - TEST_METHOD(60) { diff --git a/passenger.spec b/passenger.spec index 2d80154708f3a13a249436b46ce3080a73a8396f..afba72e3751f4bf647b6a958d55842266f7c3617 100644 --- a/passenger.spec +++ b/passenger.spec @@ -5,11 +5,12 @@ %{!?ruby_vendorlibdir: %global ruby_vendorlibdir %(ruby -rrbconfig -e 'puts RbConfig::CONFIG["vendorlibdir"]')} %{!?ruby_vendorarchdir: %global ruby_vendorarchdir %(ruby -rrbconfig -e 'puts RbConfig::CONFIG["vendorarchdir"]')} %global passenger_ruby_libdir %{ruby_vendorlibdir} +%global bundled_boost_version 1.83.0 Name:passenger Summary: Phusion Passenger application server -Version: 6.0.22 -Release: 2 +Version: 6.0.27 +Release: 1 License: Boost and BSD and MIT and zlib URL: https://www.phusionpassenger.com @@ -20,15 +21,13 @@ Source100: apache-passenger.conf.in Source101: apache-passenger-module.conf Source102: passenger.tmpfiles -Patch0: CVE-2025-26803.patch - Requires: rubygems rubygem(rack) rubygem(rake) ruby(release) BuildRequires: gcc, gcc-c++ httpd-devel ruby ruby-devel rubygems rubygems-devel -BuildRequires: rubygem(rake) >= 0.8.1 rubygem(rack) zlib-devel pcre-devel +BuildRequires: rubygem(rake) >= 0.8.1 rubygem(rack) zlib-devel pcre2-devel BuildRequires: openssl-devel libcurl-devel jsoncpp-devel perl -Provides: bundled(boost) = 1.83.0 +Provides: bundled(boost) = %{bundled_boost_version} Obsoletes: rubygem-passenger < %{version}-%{release} Provides: rubygem-passenger = %{version}-%{release} @@ -202,6 +201,18 @@ sed -i 's|^#!/usr/bin/env python$|#!/usr/bin/python3|' %{buildroot}%{_datadir}/p %{_mandir}/*/* %changelog +* Fri Aug 22 2025 yaoxin <1024769339@qq.com> - 6.0.27-1 +- Update to 6.0.27: + * Upgrade Boost from 1.86 → 1.87. + * Remove Passenger admin panel (Fuse). + * Fix compilation on FreeBSD. + * [Ruby] Fix compatibility with Rack 2 While maintaining compatibility with Rack 3. Closes GH-2595. + * [Ruby] Use non-deprecated functions in native extensions. + * Fix an issue where Passenger could freeze while connecting to application processes (event loop blocking). + * [Nginx] Upgrades preferred Nginx to 1.26.3 from 1.26.2. + * [Nginx] The preferred PCRE2 version is now 10.45 (previously 10.39). + * other changes please see bundled CHANGELOG + * Tue Feb 25 2025 yaoxin <1024769339@qq.com> - 6.0.22-2 - Fix CVE-2025-26803 diff --git a/release-6.0.22.tar.gz b/release-6.0.22.tar.gz deleted file mode 100644 index 9fab531bfac50906ea46e4e7a7d0f5acdddaf678..0000000000000000000000000000000000000000 Binary files a/release-6.0.22.tar.gz and /dev/null differ diff --git a/release-6.0.27.tar.gz b/release-6.0.27.tar.gz new file mode 100644 index 0000000000000000000000000000000000000000..1ce9696bd7f5b27956c56d23770f68ad60de68ec --- /dev/null +++ b/release-6.0.27.tar.gz @@ -0,0 +1,3 @@ +version https://git-lfs.github.com/spec/v1 +oid sha256:faae10d7ac10f644f8366c4c647f64a5d11666b41cdd1e4965ae08a3b63657a0 +size 7892481