about summary refs log tree commit homepage
diff options
context:
space:
mode:
authorevanweaver <evanweaver@19e92222-5c0b-0410-8929-a290d50e31e9>2007-08-22 10:38:43 +0000
committerevanweaver <evanweaver@19e92222-5c0b-0410-8929-a290d50e31e9>2007-08-22 10:38:43 +0000
commita6142a11b49aadba4fd4fe473dcb7593a4f9b7f7 (patch)
treeeb39d0a7bbb1f250931440f3c32264aba73002a3
parent30da2d29a364eb0400f1bc40ff64758bfe1d3009 (diff)
downloadunicorn-a6142a11b49aadba4fd4fe473dcb7593a4f9b7f7.tar.gz
git-svn-id: svn+ssh://rubyforge.org/var/svn/mongrel/trunk@576 19e92222-5c0b-0410-8929-a290d50e31e9
-rw-r--r--projects/cgi_multipart_eof_fix/README15
1 files changed, 5 insertions, 10 deletions
diff --git a/projects/cgi_multipart_eof_fix/README b/projects/cgi_multipart_eof_fix/README
index ff4ee4c..a70f21b 100644
--- a/projects/cgi_multipart_eof_fix/README
+++ b/projects/cgi_multipart_eof_fix/README
@@ -11,22 +11,17 @@ Copyright 2006, 2007 Cloudburst, LLC. Portions copyright 2006 Jeremy Kemper, Jam
 
 Fixes an exploitable bug in CGI multipart parsing which affects Ruby <= 1.8.5. When multipart boundary attributes contain non-halting regular expression strings, the boundary searcher in the CGI module does not properly escape the parameter and will execute arbitrary regular expressions. This fix adds escaping for the user data.
 
-This is fix is cumulative with previous CGI multipart vulnerability fixes; see version 1.0.0 of the gem by Jamis Buck et. al.
-
-== Installation
-
-  sudo gem install cgi_multipart_eof_fix
-
-== Scope
-
-* Affected: standalone CGI, Mongrel, WEBrick
+* Affected application servers: standalone CGI, Mongrel, WEBrick
 * Unaffected: FastCGI, Ruby 1.8.6 (all servers)
 * Unknown: mod_ruby
 
-This library will not modify versions of Ruby greater than 1.8.5.
+This fix will not modify versions of Ruby greater than 1.8.5, and is cumulative with previous CGI multipart vulnerability fixes.
 
 == Usage
 
+Install the gem:
+  sudo gem install cgi_multipart_eof_fix
+
 Run the included test to verify that the patch works as intended. Then, <tt>require</tt> the gem in every affected application, as follows:
 
   require 'rubygems'