mirror/buildroot
1
0
Fork 0
mirror of https://gitlab.com/buildroot.org/buildroot.git synced 2026-09-27 04:20:38 -09:00
Code Issues Packages Projects Releases Wiki Activity

package/ruby: security bump to v3.4.9

Browse Source 
Read the announcements:

- https://www.ruby-lang.org/en/news/2025/10/07/ruby-3-4-7-released/
- https://www.ruby-lang.org/en/news/2025/12/17/ruby-3-4-8-released/
- https://www.ruby-lang.org/en/news/2026/03/11/ruby-3-4-9-released/

This fixes a few vulnerabilities in bundled gems (ruby libraires):

- CVE-2025-27221:
    In the URI gem before 1.0.3 for Ruby, the URI handling methods
    (URI.join, URI#merge, URI#+) have an inadvertent leakage of
    authentication credentials because userinfo is retained even after
    changing the host.
    https://www.cve.org/CVERecord?id=CVE-2025-27221

- CVE-2025-58767:
    REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1
    has a DoS vulnerability when parsing XML containing multiple XML
    declarations. If you need to parse untrusted XMLs, you may be impacted
    to these vulnerabilities. The REXML gem 3.4.2 or later include the
    patches to fix these vulnerabilities.
    https://www.cve.org/CVERecord?id=CVE-2025-58767

- CVE-2025-61594:
    URI is a module providing classes to handle Uniform Resource
    Identifiers. In versions prior to 0.12.5, 0.13.3, and 1.0.4, a bypass
    exists for the fix to CVE-2025-27221 that can expose user credentials.
    When using the `+` operator to combine URIs, sensitive information
    like passwords from the original URI can be leaked, violating RFC3986
    and making applications vulnerable to credential exposure. Versions
    0.12.5, 0.13.3, and 1.0.4 fix the issue.
    https://www.cve.org/CVERecord?id=CVE-2025-61594

- CVE-2026-27820:
	The zstream_buffer_ungets function prepends caller-provided bytes
	ahead of previously produced output but fails to guarantee the backing
	Ruby string has enough capacity before the memmove shifts the existing
	data. This can lead to memory corruption when the buffer length exceeds
	capacity.

Signed-off-by: Titouan Christophe <titouan.christophe@mind.be>
Signed-off-by: Thomas Perale <thomas.perale@mind.be>
This commit is contained in:
Titouan Christophe
2026-04-01 22:35:24 +02:00
committed by Thomas Perale
parent 317fa104f1
commit 6b208dd1d2
2 changed files with 3 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files

4
package/ruby/ruby.hash
View File

@@ -1,5 +1,5 @@
# https://www.ruby-lang.org/en/news/2025/09/16/ruby-3-4-6-released/
sha512 29000b3396ab95fc2dc13d2d78441ff5c34258e5421115181c54b1b4d55d5c0d4f3d0c3cec6b32b9a1bb8de5c51b383fcad4369ec3fb244fd0ce182afbe79ba4 ruby-3.4.6.tar.xz
# https://www.ruby-lang.org/en/news/2026/03/11/ruby-3-4-9-released/
sha512 356fb47cc56f2d25198cb95253fc20ff7d9a6fd1fa53bc475e5c440012aebe27562537c399d271357235114ade263fd625029b66cb0f9b526f9c04f169fb9580 ruby-3.4.9.tar.xz
# License files, Locally calculated
sha256 a2021e52d5d6adf7e3f45aab9d2b860ce03cdf6153776853e11d5668193eecfd LEGAL

2
package/ruby/ruby.mk
View File

@@ -5,7 +5,7 @@
################################################################################
RUBY_VERSION_MAJOR = 3.4
RUBY_VERSION = $(RUBY_VERSION_MAJOR).6
RUBY_VERSION = $(RUBY_VERSION_MAJOR).9
RUBY_VERSION_EXT = 3.4.0
RUBY_SITE = http://cache.ruby-lang.org/pub/ruby/$(RUBY_VERSION_MAJOR)
RUBY_SOURCE = ruby-$(RUBY_VERSION).tar.xz