Tuxcare Errata System 0.0.1 5.10 2026-08-10T09:06:17 Debian 12 * Security fixes - CVE-2023-28756: Fix ReDoS vulnerability in Time.rfc2822 parsing. Moderate TuxCare License Agreement CVE-2023-28756 Debian 12 * SECURITY UPDATE: REXML ReDoS via leading-zero hex character reference - debian/patches/CVE-2024-49761.patch: replace the /&#0*((?:\d+)|(?:x[a-fA-F0-9]+));/ regex in unnormalize() with /&#((?:\d+)|(?:x[a-fA-F0-9]+));/ so that &#0x...; is no longer accepted as a hex character reference, eliminating the catastrophic-backtracking ReDoS on inputs with many leading zeros. - CVE-2024-49761 * SECURITY UPDATE: REXML DoS via deep same-local-name attributes - debian/patches/CVE-2024-43398.patch: replace the per-attribute tree-walk in Element#[]= with an O(1) parse-time conflict check using a parser-level @namespaces hash and an expanded_names hash keyed on [uri, local_part]; seed @namespaces with the implicitly-bound xml prefix per upstream 78f8712 to avoid breaking XHTML documents that use both xml:lang and lang. - CVE-2024-43398 * SECURITY UPDATE: REXML DoS via entity expansion in SAX/pull parsers - debian/patches/CVE-2024-41946.patch: route the SAX2Parser :text handler through @parser.unnormalize (upstream prerequisite 4ebf21f), and add @entity_expansion_count + per-call sum/Security.entity_expansion_text_limit accounting in BaseParser so that billion-laughs-style XML triggers "entity expansion has grown too large" / "number of entity expansions exceeded" in SAX and pull mode, matching the existing DOM behaviour. - CVE-2024-41946 * SECURITY UPDATE: REXML DoS via slow processing-instruction parsing - debian/patches/CVE-2024-41123.patch: rewrite process_instruction to call parse_name and then match the content separately, avoiding the catastrophic-backtracking INSTRUCTION_PATTERN regex; grow the IOSource read buffer exponentially via min_bytes so that source.match() is O(log n) attempts rather than O(n) on inputs that never match the regex. - CVE-2024-41123 * Add debian/patches/rexml-cve-tests.patch with regression tests adapted from upstream for the four CVEs above; replaces assert_linear_performance (not available on 2.6) with Timeout-based guards and uses class+message form of assert_raise so the tests work under the bundled minitest-style Test::Unit. Important TuxCare License Agreement CVE-2024-49761 CVE-2024-43398 CVE-2024-41946 CVE-2024-41123 Debian 12 * SECURITY UPDATE: REXML ReDoS via leading-zero hex character reference - debian/patches/CVE-2024-49761.patch: replace the /&#0*((?:\d+)|(?:x[a-fA-F0-9]+));/ regex in unnormalize() with /&#((?:\d+)|(?:x[a-fA-F0-9]+));/ so that &#0x...; is no longer accepted as a hex character reference, eliminating the catastrophic-backtracking ReDoS on inputs with many leading zeros. - CVE-2024-49761 * SECURITY UPDATE: REXML DoS via deep same-local-name attributes - debian/patches/CVE-2024-43398.patch: replace the per-attribute tree-walk in Element#[]= with an O(1) parse-time conflict check using a parser-level @namespaces hash and an expanded_names hash keyed on [uri, local_part]; seed @namespaces with the implicitly-bound xml prefix per upstream 78f8712 to avoid breaking XHTML documents that use both xml:lang and lang. - CVE-2024-43398 * SECURITY UPDATE: REXML DoS via entity expansion in SAX/pull parsers - debian/patches/CVE-2024-41946.patch: route the SAX2Parser :text handler through @parser.unnormalize (upstream prerequisite 4ebf21f), and add @entity_expansion_count + per-call sum/Security.entity_expansion_text_limit accounting in BaseParser so that billion-laughs-style XML triggers "entity expansion has grown too large" / "number of entity expansions exceeded" in SAX and pull mode, matching the existing DOM behaviour. - CVE-2024-41946 * SECURITY UPDATE: REXML DoS via slow processing-instruction parsing - debian/patches/CVE-2024-41123.patch: rewrite process_instruction to call parse_name and then match the content separately, avoiding the catastrophic-backtracking INSTRUCTION_PATTERN regex; grow the IOSource read buffer exponentially via min_bytes so that source.match() is O(log n) attempts rather than O(n) on inputs that never match the regex. - CVE-2024-41123 Important TuxCare License Agreement CVE-2024-49761 CVE-2024-43398 CVE-2024-41946 CVE-2024-41123 Debian 12 * SECURITY UPDATE: Bundler argument injection via leading-dash Gemfile git URL - debian/patches/CVE-2021-43809.patch: insert "--" end-of-options separator before the URI in the clone and fetch commands built by lib/bundler/source/git/git_proxy.rb. - CVE-2021-43809 Important TuxCare License Agreement CVE-2021-43809 Debian 12 * SECURITY UPDATE: Bundler argument injection via leading-dash Gemfile git URL - debian/patches/CVE-2021-43809.patch: insert "--" end-of-options separator before configured_uri in the clone and fetch commands built by lib/bundler/source/git/git_proxy.rb (the override .txz ships Bundler 2.2.24, predating the fix in 2.2.33). The clone command also reorders args so all flags precede "--", matching the upstream PR #5142 idiom. - CVE-2021-43809 Important TuxCare License Agreement CVE-2021-43809 CVE-2024-49761 CVE-2024-43398 CVE-2024-41946 CVE-2024-41123 Debian 12 * SECURITY UPDATE: REXML DoS via attribute value with many '>' characters - debian/patches/CVE-2024-35176.patch: replace the per-'>'-chunk re-read loop in parse_attributes with a single-pass read of the attribute value up to the closing quote followed by a read up to the actual tag end, so that an attribute value containing N repeated '>' characters parses in O(N) time instead of O(N**2). Also fix the latent EOF handling in IOSource#match introduced with CVE-2024-41123 so the partially-filled buffer is matched against the pattern one last time before the source is declared exhausted, which is now exercised by the new value-rest read. - CVE-2024-35176 * SECURITY UPDATE: REXML ReDoS via repeated spaces in ATTLIST - debian/patches/CVE-2024-39908.patch: strip the matched ATTLIST contents before applying ATTDEF_RE so that trailing whitespace after a valid attdef does not trigger catastrophic backtracking in the per-attdef scan. Adapted byte-identically from upstream ruby/rexml@1f1e6e9; the other eight commits referenced by this CVE address O(N**2) source.match interactions that are already mitigated here by the min_bytes-doubling introduced in the CVE-2024-41123 backport (verified by microbench against all eight upstream test vectors at N=200000). - CVE-2024-39908 Moderate TuxCare License Agreement CVE-2024-35176 CVE-2024-39908 Debian 12 * SECURITY UPDATE: REXML DoS via many '<' or '>' characters in an attribute value - debian/patches/CVE-2024-35176.patch: in parse_attributes, when the outer @source.match stops at a '>' inside a quoted attribute value, read forward to the actual closing quote in a single chunk instead of looping one '>' at a time, so the per-attribute outer loop is O(1) iterations rather than O(n). Also extend IOSource#match to always re-try the regex after read() returns false at EOF so the final partially-filled buffer is still matched. - CVE-2024-35176 * SECURITY UPDATE: REXML ReDoS via repeated zeros in a character reference - debian/patches/CVE-2024-39908.patch: rewrite REXML::Text.check to iterate over '<' and '&' sentinels with String#index and validate each entity / character reference explicitly, instead of string.scan() with the NEEDS_A_SECOND_CHECK regex whose '&#0*' branch caused O(n^2) backtracking on inputs with many leading zeros. The remaining CVE-2024-39908 subvariants (repeated '>' inside <?xml, comments, CDATA, DOCTYPE forms) are already mitigated by the min_bytes-doubling IOSource#match introduced by CVE-2024-41123. - CVE-2024-39908 Moderate TuxCare License Agreement CVE-2024-35176 CVE-2024-39908 Debian 12 * SECURITY UPDATE: REXML DoS via an attribute value containing many '>' - debian/patches/CVE-2024-35176.patch: in parse_attributes (lib/rexml/parsers/baseparser.rb), resolve the missing-closing-quote case in a single pass -- read the value rest up to the closing quote and then up to the tag end with two source.match calls -- instead of consuming one '>'-chunk per iteration, which reset the scanner and re-ran ATTRIBUTE_PATTERN over the accumulating buffer, giving O(N^2) behaviour. Also make IOSource#match (lib/rexml/source.rb) retry the pattern after every read attempt so the partial buffer is matched once more before the source is declared exhausted, as required by the new value-rest read. Adapted from upstream ruby/rexml ba70cfef ("Read quoted attributes in chunks"); the read_until API added upstream has no callers here once parse_attributes is fixed in place. Adds a Timeout-based regression test (test/rexml/parse/test_attribute_gt_redos.rb) adapted from upstream. - CVE-2024-35176 * SECURITY UPDATE: REXML ReDoS via repeated spaces inside <!ATTLIST - debian/patches/CVE-2024-39908.patch: in the ATTLIST branch (lib/rexml/parsers/baseparser.rb) drop the leading "<!ATTLIST" literal and strip the result before scanning with ATTDEF_RE, so a long run of spaces between "<!ATTLIST" and the element name is no longer re-walked by the backtracking per-attdef scan (O(N^2) -> linear). Adapted from upstream ruby/rexml 1f1e6e9; a byte-identical md[0].strip is a no-op on 3.1.9.1 because here md[0] starts with the "<!ATTLIST" literal, so the space run is interior rather than leading. Adds a Timeout-based regression test (test/rexml/parse/test_attlist.rb) adapted from upstream. - CVE-2024-39908 * SECURITY UPDATE: Heap buffer overflow in bundled zlib gem via Zlib::GzipReader#ungetc - debian/patches/CVE-2026-27820.patch: make the output-buffer expansion in zstream_buffer_ungets() unconditional in ext/zlib/zlib.c, so a large ungetc payload can no longer be memmove'd/written past the allocation. Backport of ruby/zlib commit 608d2be6. Adds the upstream regression test test_ungetc_buffer_underflow to test/zlib/test_zlib.rb. - CVE-2026-27820 * Stabilise the in-build test suite on busy build nodes (no shipped-content change): - debian/rules: on debian>=12 also skip the net/http and net/smtp tests, which spawn TCP servers via tcp_server_sockets_port0 and flake with Errno::EADDRINUSE under concurrent builds (mirrors alt-ruby31). - debian/patches/fix-tests-mjit-fork.patch: backport upstream 7a859b6a (Ruby 2.7.0+) to fix the flaky TestJIT#test_fork_with_mjit_worker_thread stderr output race; never backported to the 2.6 series. Critical TuxCare License Agreement CVE-2026-27820 CVE-2024-35176 CVE-2024-39908 Debian 12 * SECURITY UPDATE: Heap buffer overflow in bundled zlib via Zlib::GzipReader#ungetc - debian/patches/CVE-2026-27820.patch: make the output-buffer expansion in zstream_buffer_ungets() unconditional via zstream_expand_buffer_into(z, len) instead of only growing when the buffer was already full. An ungetc payload larger than the remaining capacity previously made the memmove() calls write past the allocation, corrupting the heap. Adapted byte-identically from upstream ruby/zlib@608d2be6; the regression test test_ungetc_buffer_underflow is added to test/zlib/test_zlib.rb. - CVE-2026-27820 Critical TuxCare License Agreement CVE-2026-27820 Debian 12 * SECURITY UPDATE: rexml denial of service via multiple XML declarations - debian/patches/CVE-2025-58767.patch: validate XML declarations in bundled rexml-3.3.9 (require version, restrict to version/encoding/ standalone attributes, reject duplicates) and add Source#skip_spaces fast path; backport of upstream rexml commit 5859bdea (PR #282). - CVE-2025-58767 * SECURITY UPDATE: heap buffer overflow in Zlib::GzipReader#ungetc - debian/patches/CVE-2026-27820.patch: make the gzip output buffer expansion unconditional in zstream_buffer_ungets() so a large ungetc payload cannot memmove/write past the allocation (ext/zlib/zlib.c), plus regression test test_ungetc_buffer_underflow (test/zlib/test_zlib.rb). - CVE-2026-27820 Critical TuxCare License Agreement CVE-2026-27820 CVE-2025-58767 Debian 12 * SECURITY UPDATE: Heap buffer overflow in the bundled zlib extension via Zlib::GzipReader#ungetc - debian/patches/CVE-2026-27820.patch: in zstream_buffer_ungets() (ext/zlib/zlib.c) the output buffer was expanded only when it was already full (rb_str_capacity(z->buf) <= ZSTREAM_BUF_FILLED(z)), so a large ungetc payload memmove()'d and wrote past the allocation. Make the expansion unconditional via zstream_expand_buffer_into(z, len), which guarantees capacity for filled + len before the memmove. Also backports the upstream regression test test_ungetc_buffer_underflow. - CVE-2026-27820 Critical TuxCare License Agreement CVE-2026-27820 Debian 12 * SECURITY UPDATE: cgi and uri vulnerabilities in the bundled gems - debian/patches/CVE-2025-27219.patch: CGI::Cookie.parse merged repeated cookie names with an allocating array `+`, giving O(n^2) work and a DoS on crafted Cookie headers; merge in place with concat instead. - debian/patches/CVE-2025-27220.patch: CGI::Util#escapeElement and #unescapeElement used a lazy-backtracking regex vulnerable to ReDoS; replace with possessive/atomic forms that also handle unclosed tags. - debian/patches/CVE-2025-61594.patch: URI::Generic#merge / + leaked the base URI's password when only the host changed (bypass of CVE-2025-27221); clear userinfo atomically via authority accessors. - CVE-2025-27219 - CVE-2025-27220 - CVE-2025-61594 Important TuxCare License Agreement CVE-2025-61594 CVE-2025-27220 CVE-2025-27219 Debian 12 * SECURITY UPDATE: DoS in CGI::Cookie.parse via repeated cookie names - debian/patches/CVE-2025-27219.patch: merge repeated cookie values in place with cookies[name].concat(values) instead of the super-linear values = cookies[name].value + values, so a Cookie: header repeating one name parses in O(n) instead of O(n**2). Adapted byte-identically from upstream ruby/cgi@9907b76. - CVE-2025-27219 * SECURITY UPDATE: ReDoS in CGI::Util#escapeElement - debian/patches/CVE-2025-27220.patch: replace the lazy backtracking element matcher ((?:.|\n)*?>) in escapeElement and unescapeElement with possessive/atomic forms that cannot backtrack, so a crafted unterminated tag no longer triggers catastrophic backtracking. Adapted byte-identically from upstream ruby/cgi@c9d1311; the upstream unclosed-tag regression tests are added to test/cgi/test_cgi_util.rb. - CVE-2025-27220 * SECURITY UPDATE: URI password leak when combining URIs (CVE-2025-27221 bypass) - debian/patches/CVE-2025-61594.patch: clear userinfo fully in set_userinfo/set_user, clear it on host=/port=, add an authority reader and protected set_authority setter, and make merge replace the whole authority atomically so combining a base URI with a relative one no longer carries the base password to a new host. Backported from upstream ruby/uri d3116ca ("Clear user info totally..." fixing CVE-2025-27221, plus "Add authority accessor"); the merge() hunk is adapted to uri 0.10.0.2's layout. The test/uri/test_generic.rb#test_set_component expectations are updated and a test_merge_does_not_leak_credentials test is added. - CVE-2025-61594 Important TuxCare License Agreement CVE-2025-61594 CVE-2025-27220 CVE-2025-27219 Debian 12 * SECURITY UPDATE: cgi DoS via super-linear CGI::Cookie.parse - debian/patches/CVE-2025-27219.patch: in CGI::Cookie.parse (lib/cgi/cookie.rb), merge repeated cookie-name values in place with Array#concat instead of rebuilding the array with Array#+ on every repeat, which was O(N^2) for N repetitions of a name. Backport of upstream ruby/cgi 9907b76. - CVE-2025-27219 * SECURITY UPDATE: cgi ReDoS in CGI::Util#escapeElement - debian/patches/CVE-2025-27220.patch: replace the catastrophically backtracking "(?:.|\n)*?>" patterns in escapeElement and unescapeElement (lib/cgi/util.rb) with linear-time possessive/atomic patterns that also escape unclosed tags. Backport of upstream ruby/cgi cd1eb08. - CVE-2025-27220 * SECURITY UPDATE: uri credential leak combining URIs (CVE-2025-27221 bypass) - debian/patches/CVE-2025-61594.patch: in lib/uri/generic.rb, set_userinfo always assigns @password (so it can be cleared), set_user no longer re-attaches the old password, host=/port= clear the userinfo, initialize sets userinfo after host/port, and merge()/+ replace the authority wholesale through the new set_authority/authority accessors so the base URI's password is no longer leaked, e.g. (URI("http://user:pass@h") + "//new@h2/p") no longer keeps ":pass". Backport of upstream ruby/uri 2789182, 5cec76b and 6c6449e. - CVE-2025-61594 * SECURITY UPDATE: cgi HTTP response splitting via unvalidated header/cookie values - debian/patches/CVE-2021-33621.patch: add _no_crlf_check in lib/cgi/core.rb so every emitted status/header value (including Set-Cookie) is rejected if it contains CR or LF, and add TOKEN_RE/PATH_VALUE_RE/DOMAIN_VALUE_RE validation with validating name=/path=/domain= setters in lib/cgi/cookie.rb. Backport of upstream ruby/cgi 64c5045, 30107a4 and b46d41c, adapted to the pre-gemified 2.6.10 cgi layout. - CVE-2021-33621 Important TuxCare License Agreement CVE-2021-33621 CVE-2025-61594 CVE-2025-27220 CVE-2025-27219 Debian 12 * SECURITY UPDATE: credential leak in bundled uri when combining URIs - debian/patches/CVE-2025-61594.patch: clear stale userinfo when setting authority components and replace authority atomically on merge in the bundled uri 0.12.4 (lib/uri/generic.rb), so combining URIs with + / merge no longer re-attaches the base URI's password; backport of upstream uri 0.12.5 (commit d3116ca). Bypass of the CVE-2025-27221 fix. - CVE-2025-61594 Important TuxCare License Agreement CVE-2025-61594 Debian 12 * SECURITY UPDATE: uri ReDoS in the RFC3986 and RFC2396 parsers - debian/patches/CVE-2023-28755.patch: clamp the greedy quantifiers of RFC3986_URI and RFC3986_relative_ref in lib/uri/rfc3986_parser.rb to possessive ones (17 * -> *+, 9 + -> ++), so a crafted URI such as URI.parse('https://example.com/dir/' + 'a' * 80000 + '/##.jpg') no longer backtracks quadratically, and add the (?: ) group around IPv6address/IPvFuture that RFC3986_relative_ref was missing. Backport of upstream ruby/uri 37770c2 and 17861a5 (uri 0.10.0.1). The same patch also carries the CVE-2023-36617 follow-up, which upstream describes as existing "because of an incomplete fix for CVE-2023-28755": the two leading quantifiers the original fix left greedy, one in each parser. In lib/uri/rfc3986_parser.rb the whitespace run of the PORT component regexp of RFC3986_Parser#default_regexp is clamped to a possessive quantifier, and in lib/uri/rfc2396_parser.rb the leading '\A\s*' of the ABS_URI and REL_URI patterns built by RFC2396_Parser#initialize_regexp becomes '\A\s*+', so URI.parse('http://my.example.com').port = "\t" * 8000 + 'a' and URI::RFC2396_Parser.new.split(' ' * 8000 + "\0") no longer backtrack quadratically either. Backport of upstream ruby/uri 9010ee2 and 9d7bcef, folded into the same patch since upstream never ships one parser's fix without the other's and both are the same defect class; the patch header records the full provenance. This tree has a single uri copy (pre-gemified, no bundler-vendored copy) and it is now hardened in both parsers; no vendored version string is touched. - CVE-2023-28755 - CVE-2023-36617 * SECURITY UPDATE: stringio buffer overread in ungetc/ungetbyte - debian/patches/CVE-2024-27280.patch: in ext/stringio/stringio.c, strio_unget_bytes() computed the string growth as cl+rest when the position is at or past the end, so rb_str_set_len() declared cl+pos valid bytes while only cl were written and the tail of the returned String exposed stale heap contents. Grow by cl - (rest < 0 ? pos : len) instead. Backport of upstream ruby/stringio a35268a (stringio 3.0.1.1). - CVE-2024-27280 * SECURITY UPDATE: rdoc code execution via .rdoc_options and ri cache - debian/patches/CVE-2024-27281.patch: RDoc::RDoc#load_options read ./.rdoc_options with YAML.load_file and RDoc::Store loaded the ri cache with a bare Marshal.load, so a crafted project directory or ri cache instantiated arbitrary objects. Load the options file with YAML.safe_load(permitted_classes: [RDoc::Options, Symbol]) and pass a MarshalFilter proc to Marshal.load that only admits plain data types and RDoc's own classes. Backport of upstream ruby/rdoc 32ff6ba0, 60a6d74e and a5de13bf (rdoc 6.3.4 + 6.3.4.1), with safe_load_file expressed as safe_load(File.read(...)) because psych 3.1.0 has no safe_load_file. - CVE-2024-27281 * SECURITY UPDATE: regexp arbitrary heap read in Onigmo search - debian/patches/CVE-2024-27282.patch: onig_search() clamps reg->dmax to the end of the subject but not reg->dmin, so forward_search_range() (p += reg->dmin) and backward_search_range() (range += reg->dmin) could scan for the exact/map target past the end of the subject buffer. Reject the search when reg->dmin exceeds the subject length. Backport of upstream ruby/ruby 33e5b47c (Ruby 3.0.7). - CVE-2024-27282 Moderate TuxCare License Agreement CVE-2024-27281 CVE-2023-28755 CVE-2024-27280 CVE-2024-27282 Debian 12 * SECURITY UPDATE: ReDoS in the vendored Bundler::URI RFC3986 parser - debian/patches/CVE-2023-28755.patch: clamp the greedy quantifiers in Bundler::URI::RFC3986_Parser's RFC3986_URI and RFC3986_relative_ref to possessive form, so an invalid URI no longer backtracks quadratically before raising InvalidURIError. NOTE: the 2.7.8 tarball's own two RFC3986 uri copies are already fixed; the vulnerable parser comes from the ruby-rubygems-bundler-v2.2.24.txz override tree that replaces lib/bundler at build time, so this patch is applied from debian/rules after that substitution and is deliberately NOT listed in debian/patches/series. The vendored version.rb is left at 0.10.0 so the build-time bundler_uri_version assertion still holds. The same patch additionally carries the CVE-2023-36617 follow-up hardening of the leading whitespace quantifiers of both parsers that back URI.parse / URI.split, from upstream ruby/uri 9d7bcef ("Fix quadratic backtracking on invalid port number") and 9010ee2 ("Fix quadratic backtracking on invalid relative URI"), which always ship together: the rfc3986 PORT pattern and the rfc2396 ABS_URI / REL_URI patterns each go from greedy to possessive. No ELSLANG ticket exists for CVE-2023-36617, so it is documented here and in the patch header rather than listed as a tracked id. Applied to all four in-tree copies (lib/uri/rfc3986_parser.rb, lib/uri/rfc2396_parser.rb and both lib/bundler/vendor/uri equivalents), so no copy is left half-patched; the vendored pair carries the override tree's content at that point. Both changes are timing-only -- the accepted and rejected inputs are unchanged -- and upstream's test_rfc2822_parse_relative_uri and test_rfc3986_port_check regression tests are added verbatim to test/uri/test_parser.rb. - CVE-2023-28755 * SECURITY UPDATE: buffer over-read in StringIO#ungetc / #ungetbyte - debian/patches/CVE-2024-27280.patch: compute the expansion in strio_unget_bytes() as cl - (rest < 0 ? pos : len) instead of (rest < 0 ? cl-pos : cl+rest), so pushing back more bytes than the current position no longer over-extends the string and expose uninitialized heap memory through StringIO#string and a later #gets. Adapted byte-identically from upstream ruby/stringio a35268a; upstream's test_ungetc_fill / test_ungetbyte_fill are added to test/stringio/test_stringio.rb and equivalent examples to spec/ruby/library/stringio/ungetc_spec.rb and ungetbyte_spec.rb. STRINGIO_VERSION is deliberately not bumped because the default gemspec filename is derived from it. - CVE-2024-27280 * SECURITY UPDATE: code execution in RDoc via unrestricted deserialisation - debian/patches/CVE-2024-27281.patch: load .rdoc_options with YAML.safe_load and permitted_classes: [RDoc::Options, Symbol], and route all four RDoc::Store Marshal.load call sites through a new private marshal_load helper whose filter proc rejects any object that is not a plain scalar/container, Class, Encoding or an RDoc::-namespaced object. Backported from upstream ruby/rdoc 32ff6ba0 ("Filter marshaled objects"), 60a6d74e ("Use safe_load and safe_load_file for .rdoc_options") and the mandatory follow-up a5de13bf ("Fix NoMethodError for start_with"), i.e. rdoc 6.3.4.1. safe_load_file does not exist in psych 3.1.0, so the .rdoc_options call uses the earlier upstream form YAML.safe_load File.read(...). RDoc::VERSION is deliberately not bumped because the spec pins it. - CVE-2024-27281 * SECURITY UPDATE: arbitrary heap read in the regexp engine - debian/patches/CVE-2024-27282.patch: bail out of Onigmo's forward_search_range() and backward_search_range() when reg->dmin exceeds end - str, so a crafted pattern can no longer advance the search pointer past the end of the subject and match against out-of-bounds heap memory. Also record mem_start_stk[mem] before STACK_PUSH_MEM_END() in OP_MEMORY_END_PUSH_REC, fixing a use-after-free of the backtrack-stack pointer. Taken verbatim from the ruby_3_0 backports of upstream 33e5b47c and 989a2355 (ruby 3.0.7); ruby-2.7.8's regexec.c is identical to 3.0.6's at all three sites. - CVE-2024-27282 Moderate TuxCare License Agreement CVE-2024-27281 CVE-2023-28755 CVE-2024-27280 CVE-2024-27282 Debian 12 * SECURITY UPDATE: ReDoS in the bundler-vendored uri parsers - debian/patches/CVE-2023-28755.patch: clamp the unbounded quantifiers in RFC3986_URI and RFC3986_relative_ref to their possessive forms and group IPv6address inside the IP-literal alternation, in the bundler-vendored uri 0.10.1 (lib/bundler/vendor/uri/lib/uri/rfc3986_parser.rb), so a crafted URI no longer drives quadratic backtracking; backport of upstream ruby commit 14f025a7 (URI 0.10.0.2 for bundler). - CVE-2023-28755 * The same patch carries the two-part follow-up hardening that upstream ships together (both dated 2023-04-22, HackerOne #1958260), covering the per-component validation regexps the first fix left unclamped: - rfc3986_parser.rb: default_regexp's PORT entry gets a possessive leading whitespace run (upstream ruby/uri commit 9d7bcef1), so an attacker-supplied port assigned via Bundler::URI::Generic#port= (check_port) no longer drives quadratic backtracking. - rfc2396_parser.rb: the ABS_URI and REL_URI patterns get a possessive leading whitespace quantifier, '\A\s*' -> '\A\s*+' (upstream ruby/uri commit 9010ee25), so Bundler::URI::RFC2396_Parser#split / #parse -- reached through the public Bundler::URI::DEFAULT_PARSER and Bundler::URI::Parser constants -- no longer go quadratic on crafted input with a long run of leading whitespace. Both parsers of a uri copy are hardened together: patching only one would leave the copy half-fixed and still exploitable through the other. * The primary uri default gem is already hardened upstream (0.12.4) in both parsers and is not touched, and the vendored VERSION_CODE deliberately stays 001001 to keep the build-time bundler_uri_version assertion passing. Moderate TuxCare License Agreement CVE-2023-28755 alt-ruby26 alt-ruby26-default-gems alt-ruby26-devel alt-ruby26-devel-doc alt-ruby26-doc alt-ruby26-libs alt-ruby26-rubygem-bigdecimal alt-ruby26-rubygem-did-you-mean alt-ruby26-rubygem-io-console alt-ruby26-rubygem-json alt-ruby26-rubygem-minitest alt-ruby26-rubygem-net-telnet alt-ruby26-rubygem-openssl alt-ruby26-rubygem-power-assert alt-ruby26-rubygem-psych alt-ruby26-rubygem-rake alt-ruby26-rubygem-rdoc alt-ruby26-rubygem-test-unit alt-ruby26-rubygem-typeprof alt-ruby26-rubygem-xmlrpc alt-ruby26-rubygems alt-ruby26-rubygems-devel alt-ruby30 alt-ruby30-default-gems alt-ruby30-devel alt-ruby30-doc alt-ruby30-libs alt-ruby30-rubygem-bigdecimal alt-ruby30-rubygem-bundler alt-ruby30-rubygem-io-console alt-ruby30-rubygem-irb alt-ruby30-rubygem-json alt-ruby30-rubygem-minitest alt-ruby30-rubygem-power-assert alt-ruby30-rubygem-psych alt-ruby30-rubygem-rake alt-ruby30-rubygem-rbs alt-ruby30-rubygem-rdoc alt-ruby30-rubygem-rexml alt-ruby30-rubygem-rss alt-ruby30-rubygem-test-unit alt-ruby30-rubygem-typeprof alt-ruby30-rubygems alt-ruby30-rubygems-devel alt-ruby27 alt-ruby27-default-gems alt-ruby27-devel alt-ruby27-doc alt-ruby27-libs alt-ruby27-rubygem-bigdecimal alt-ruby27-rubygem-bundler alt-ruby27-rubygem-io-console alt-ruby27-rubygem-irb alt-ruby27-rubygem-json alt-ruby27-rubygem-minitest alt-ruby27-rubygem-net-telnet alt-ruby27-rubygem-power-assert alt-ruby27-rubygem-psych alt-ruby27-rubygem-rake alt-ruby27-rubygem-rdoc alt-ruby27-rubygem-test-unit alt-ruby27-rubygem-typeprof alt-ruby27-rubygem-xmlrpc alt-ruby27-rubygems alt-ruby27-rubygems-devel alt-ruby31 alt-ruby31-bundled-gems alt-ruby31-default-gems alt-ruby31-devel alt-ruby31-doc alt-ruby31-libs alt-ruby31-rubygem-bigdecimal alt-ruby31-rubygem-bundler alt-ruby31-rubygem-io-console alt-ruby31-rubygem-irb alt-ruby31-rubygem-json alt-ruby31-rubygem-minitest alt-ruby31-rubygem-power-assert alt-ruby31-rubygem-psych alt-ruby31-rubygem-rake alt-ruby31-rubygem-rbs alt-ruby31-rubygem-rdoc alt-ruby31-rubygem-rexml alt-ruby31-rubygem-rss alt-ruby31-rubygem-test-unit alt-ruby31-rubygem-typeprof alt-ruby31-rubygems alt-ruby31-rubygems-devel amd64 0:2.6.10-14 amd64 0:1.4.1-14 amd64 0:0.4.7-14 amd64 0:2.1.0-14 amd64 0:5.11.3-14 amd64 0:0.2.0-14 amd64 0:1.1.3-14 amd64 0:3.1.0-14 amd64 0:12.3.3-14 amd64 0:6.1.2.1-14 amd64 0:3.2.9-14 amd64 0:0.3.0-14 amd64 0:3.0.3.1-14 amd64|arm64 0:2.6.10-16 amd64|arm64 0:1.4.1-16 amd64|arm64 0:0.4.7-16 amd64|arm64 0:2.1.0-16 amd64|arm64 0:5.11.3-16 amd64|arm64 0:0.2.0-16 amd64|arm64 0:1.1.3-16 amd64|arm64 0:3.1.0-16 amd64|arm64 0:12.3.3-16 amd64|arm64 0:6.1.2.1-16 amd64|arm64 0:3.2.9-16 amd64|arm64 0:0.3.0-16 amd64|arm64 0:3.0.3.1-16 amd64|arm64 0:3.0.7-171 amd64|arm64 0:3.0.0-171 amd64|arm64 0:2.2.33-171 amd64|arm64 0:0.5.7-171 amd64|arm64 0:1.3.5-171 amd64|arm64 0:2.5.1-171 amd64|arm64 0:5.14.2-171 amd64|arm64 0:1.2.1-171 amd64|arm64 0:3.3.2-171 amd64|arm64 0:13.0.3-171 amd64|arm64 0:1.4.0-171 amd64|arm64 0:6.3.4.1-171 amd64|arm64 0:3.2.5-171 amd64|arm64 0:0.2.9-171 amd64|arm64 0:3.3.7-171 amd64|arm64 0:0.15.2-171 amd64|arm64 0:3.2.33-171 amd64|arm64 0:2.6.10-17 amd64|arm64 0:1.4.1-17 amd64|arm64 0:0.4.7-17 amd64|arm64 0:2.1.0-17 amd64|arm64 0:5.11.3-17 amd64|arm64 0:0.2.0-17 amd64|arm64 0:1.1.3-17 amd64|arm64 0:3.1.0-17 amd64|arm64 0:12.3.3-17 amd64|arm64 0:6.1.2.1-17 amd64|arm64 0:3.2.9-17 amd64|arm64 0:0.3.0-17 amd64|arm64 0:3.0.3.1-17 amd64|arm64 0:2.7.8-3 amd64|arm64 0:2.0.0-3 amd64|arm64 0:2.2.24-3 amd64|arm64 0:0.5.6-3 amd64|arm64 0:1.2.6-3 amd64|arm64 0:2.3.0-3 amd64|arm64 0:5.13.0-3 amd64|arm64 0:0.2.0-3 amd64|arm64 0:1.1.7-3 amd64|arm64 0:3.1.0-3 amd64|arm64 0:13.0.1-3 amd64|arm64 0:6.2.1.1-3 amd64|arm64 0:3.3.4-3 amd64|arm64 0:0.3.0-3 amd64|arm64 0:3.1.6-3 amd64|arm64 0:2.7.8-4 amd64|arm64 0:2.0.0-4 amd64|arm64 0:2.2.24-4 amd64|arm64 0:0.5.6-4 amd64|arm64 0:1.2.6-4 amd64|arm64 0:2.3.0-4 amd64|arm64 0:5.13.0-4 amd64|arm64 0:0.2.0-4 amd64|arm64 0:1.1.7-4 amd64|arm64 0:3.1.0-4 amd64|arm64 0:13.0.1-4 amd64|arm64 0:6.2.1.1-4 amd64|arm64 0:3.3.4-4 amd64|arm64 0:0.3.0-4 amd64|arm64 0:3.1.6-4 amd64|arm64 0:3.0.7-172 amd64|arm64 0:3.0.0-172 amd64|arm64 0:2.2.33-172 amd64|arm64 0:0.5.7-172 amd64|arm64 0:1.3.5-172 amd64|arm64 0:2.5.1-172 amd64|arm64 0:5.14.2-172 amd64|arm64 0:1.2.1-172 amd64|arm64 0:3.3.2-172 amd64|arm64 0:13.0.3-172 amd64|arm64 0:1.4.0-172 amd64|arm64 0:6.3.4.1-172 amd64|arm64 0:3.2.5-172 amd64|arm64 0:0.2.9-172 amd64|arm64 0:3.3.7-172 amd64|arm64 0:0.15.2-172 amd64|arm64 0:3.2.33-172 amd64|arm64 0:2.6.10-18 amd64|arm64 0:1.4.1-18 amd64|arm64 0:0.4.7-18 amd64|arm64 0:2.1.0-18 amd64|arm64 0:5.11.3-18 amd64|arm64 0:0.2.0-18 amd64|arm64 0:1.1.3-18 amd64|arm64 0:3.1.0-18 amd64|arm64 0:12.3.3-18 amd64|arm64 0:6.1.2.1-18 amd64|arm64 0:3.2.9-18 amd64|arm64 0:0.3.0-18 amd64|arm64 0:3.0.3.1-18 amd64|arm64 0:2.7.8-5 amd64|arm64 0:2.0.0-5 amd64|arm64 0:2.2.24-5 amd64|arm64 0:0.5.6-5 amd64|arm64 0:1.2.6-5 amd64|arm64 0:2.3.0-5 amd64|arm64 0:5.13.0-5 amd64|arm64 0:0.2.0-5 amd64|arm64 0:1.1.7-5 amd64|arm64 0:3.1.0-5 amd64|arm64 0:13.0.1-5 amd64|arm64 0:6.2.1.1-5 amd64|arm64 0:3.3.4-5 amd64|arm64 0:0.3.0-5 amd64|arm64 0:3.1.6-5 amd64|arm64 0:3.1.7-10 amd64|arm64 0:3.1.1-10 amd64|arm64 0:2.3.27-10 amd64|arm64 0:0.5.11-10 amd64|arm64 0:1.4.1-10 amd64|arm64 0:2.6.1-10 amd64|arm64 0:5.15.0-10 amd64|arm64 0:2.0.1-10 amd64|arm64 0:4.0.4-10 amd64|arm64 0:13.0.6-10 amd64|arm64 0:2.7.0-10 amd64|arm64 0:6.4.1.1-10 amd64|arm64 0:3.3.9-10 amd64|arm64 0:0.3.1-10 amd64|arm64 0:3.5.3-10 amd64|arm64 0:0.21.3-10 amd64|arm64 0:3.3.27-10 amd64|arm64 0:3.0.7-173 amd64|arm64 0:3.0.0-173 amd64|arm64 0:2.2.33-173 amd64|arm64 0:0.5.7-173 amd64|arm64 0:1.3.5-173 amd64|arm64 0:2.5.1-173 amd64|arm64 0:5.14.2-173 amd64|arm64 0:1.2.1-173 amd64|arm64 0:3.3.2-173 amd64|arm64 0:13.0.3-173 amd64|arm64 0:1.4.0-173 amd64|arm64 0:6.3.4.1-173 amd64|arm64 0:3.2.5-173 amd64|arm64 0:0.2.9-173 amd64|arm64 0:3.3.7-173 amd64|arm64 0:0.15.2-173 amd64|arm64 0:3.2.33-173 amd64|arm64 0:3.0.7-174 amd64|arm64 0:3.0.0-174 amd64|arm64 0:2.2.33-174 amd64|arm64 0:0.5.7-174 amd64|arm64 0:1.3.5-174 amd64|arm64 0:2.5.1-174 amd64|arm64 0:5.14.2-174 amd64|arm64 0:1.2.1-174 amd64|arm64 0:3.3.2-174 amd64|arm64 0:13.0.3-174 amd64|arm64 0:1.4.0-174 amd64|arm64 0:6.3.4.1-174 amd64|arm64 0:3.2.5-174 amd64|arm64 0:0.2.9-174 amd64|arm64 0:3.3.7-174 amd64|arm64 0:0.15.2-174 amd64|arm64 0:3.2.33-174 amd64|arm64 0:2.7.8-6 amd64|arm64 0:2.0.0-6 amd64|arm64 0:2.2.24-6 amd64|arm64 0:0.5.6-6 amd64|arm64 0:1.2.6-6 amd64|arm64 0:2.3.0-6 amd64|arm64 0:5.13.0-6 amd64|arm64 0:0.2.0-6 amd64|arm64 0:1.1.7-6 amd64|arm64 0:3.1.0-6 amd64|arm64 0:13.0.1-6 amd64|arm64 0:6.2.1.1-6 amd64|arm64 0:3.3.4-6 amd64|arm64 0:0.3.0-6 amd64|arm64 0:3.1.6-6 amd64|arm64 0:2.6.10-19 amd64|arm64 0:1.4.1-19 amd64|arm64 0:0.4.7-19 amd64|arm64 0:2.1.0-19 amd64|arm64 0:5.11.3-19 amd64|arm64 0:0.2.0-19 amd64|arm64 0:1.1.3-19 amd64|arm64 0:3.1.0-19 amd64|arm64 0:12.3.3-19 amd64|arm64 0:6.1.2.1-19 amd64|arm64 0:3.2.9-19 amd64|arm64 0:0.3.0-19 amd64|arm64 0:3.0.3.1-19 amd64|arm64 0:3.1.7-11 amd64|arm64 0:3.1.1-11 amd64|arm64 0:2.3.27-11 amd64|arm64 0:0.5.11-11 amd64|arm64 0:1.4.1-11 amd64|arm64 0:2.6.1-11 amd64|arm64 0:5.15.0-11 amd64|arm64 0:2.0.1-11 amd64|arm64 0:4.0.4-11 amd64|arm64 0:13.0.6-11 amd64|arm64 0:2.7.0-11 amd64|arm64 0:6.4.1.1-11 amd64|arm64 0:3.3.9-11 amd64|arm64 0:0.3.1-11 amd64|arm64 0:3.5.3-11 amd64|arm64 0:0.21.3-11 amd64|arm64 0:3.3.27-11 amd64|arm64 0:2.6.10-20 amd64|arm64 0:1.4.1-20 amd64|arm64 0:0.4.7-20 amd64|arm64 0:2.1.0-20 amd64|arm64 0:5.11.3-20 amd64|arm64 0:0.2.0-20 amd64|arm64 0:1.1.3-20 amd64|arm64 0:3.1.0-20 amd64|arm64 0:12.3.3-20 amd64|arm64 0:6.1.2.1-20 amd64|arm64 0:3.2.9-20 amd64|arm64 0:0.3.0-20 amd64|arm64 0:3.0.3.1-20 amd64|arm64 0:2.7.8-7 amd64|arm64 0:2.0.0-7 amd64|arm64 0:2.2.24-7 amd64|arm64 0:0.5.6-7 amd64|arm64 0:1.2.6-7 amd64|arm64 0:2.3.0-7 amd64|arm64 0:5.13.0-7 amd64|arm64 0:0.2.0-7 amd64|arm64 0:1.1.7-7 amd64|arm64 0:3.1.0-7 amd64|arm64 0:13.0.1-7 amd64|arm64 0:6.2.1.1-7 amd64|arm64 0:3.3.4-7 amd64|arm64 0:0.3.0-7 amd64|arm64 0:3.1.6-7 amd64|arm64 0:3.1.7-12 amd64|arm64 0:3.1.1-12 amd64|arm64 0:2.3.27-12 amd64|arm64 0:0.5.11-12 amd64|arm64 0:1.4.1-12 amd64|arm64 0:2.6.1-12 amd64|arm64 0:5.15.0-12 amd64|arm64 0:2.0.1-12 amd64|arm64 0:4.0.4-12 amd64|arm64 0:13.0.6-12 amd64|arm64 0:2.7.0-12 amd64|arm64 0:6.4.1.1-12 amd64|arm64 0:3.3.9-12 amd64|arm64 0:0.3.1-12 amd64|arm64 0:3.5.3-12 amd64|arm64 0:0.21.3-12 amd64|arm64 0:3.3.27-12