Index: NEWS =================================================================== --- NEWS (revision 43039) +++ NEWS (working copy) @@ -461,9 +461,11 @@ with all sufficient information, see the XML declaration is used for XML document encoding. * RubyGems - * Updated to 2.0.9. + * Updated to 2.0.10. This fixes CVE_2013-4363: - http://rubygems.rubyforge.org/rubygems-update/History_txt.html#label-2.0.9+%2F+2013-09-13 + http://rubygems.rubyforge.org/rubygems-update/CVE-2013-4363_txt.html + + See http://rubygems.rubyforge.org/rubygems-update/History_txt.html#label-2.0.10+%2F+2013-09-24 for release notes. * Updated to 2.0.8. This fixes CVE-2013-4287: Index: lib/rubygems/version.rb =================================================================== --- lib/rubygems/version.rb (revision 43039) +++ lib/rubygems/version.rb (working copy) @@ -148,7 +148,7 @@ class Gem::Version # FIX: These are only used once, in .correct?. Do they deserve to be # constants? VERSION_PATTERN = '[0-9]+(?>\.[0-9a-zA-Z]+)*' # :nodoc: - ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})*\s*\z/ # :nodoc: + ANCHORED_VERSION_PATTERN = /\A\s*(#{VERSION_PATTERN})?\s*\z/ # :nodoc: ## # A string representation of this Version. Index: lib/rubygems.rb =================================================================== --- lib/rubygems.rb (revision 43039) +++ lib/rubygems.rb (working copy) @@ -8,7 +8,7 @@ require 'rbconfig' module Gem - VERSION = '2.0.9' + VERSION = '2.0.10' end # Must be first since it unloads the prelude from 1.9.2 Index: test/rubygems/test_gem_requirement.rb =================================================================== --- test/rubygems/test_gem_requirement.rb (revision 43039) +++ test/rubygems/test_gem_requirement.rb (working copy) @@ -47,18 +47,20 @@ class TestGemRequirement < Gem::TestCase end def test_parse_bad - e = assert_raises Gem::Requirement::BadRequirementError do - Gem::Requirement.parse nil - end - - assert_equal 'Illformed requirement [nil]', e.message + [ + nil, + '', + '! 1', + '= junk', + '1..2', + ].each do |bad| + e = assert_raises Gem::Requirement::BadRequirementError do + Gem::Requirement.parse bad + end - e = assert_raises Gem::Requirement::BadRequirementError do - Gem::Requirement.parse "" + assert_equal "Illformed requirement [#{bad.inspect}]", e.message end - assert_equal 'Illformed requirement [""]', e.message - assert_equal Gem::Requirement::BadRequirementError.superclass, ArgumentError end Index: test/rubygems/test_gem_version.rb =================================================================== --- test/rubygems/test_gem_version.rb (revision 43039) +++ test/rubygems/test_gem_version.rb (working copy) @@ -67,12 +67,18 @@ class TestGemVersion < Gem::TestCase end def test_initialize_bad - ["junk", "1.0\n2.0"].each do |bad| - e = assert_raises ArgumentError do + %W[ + junk + 1.0\n2.0 + 1..2 + 1.2\ 3.4 + 1-2-3 + ].each do |bad| + e = assert_raises ArgumentError, bad do Gem::Version.new bad end - assert_equal "Malformed version number string #{bad}", e.message + assert_equal "Malformed version number string #{bad}", e.message, bad end end