GNU bug report logs - #62559
[PATCH] gnu: ruby-3.1: Upgrade to 3.1.4 [fixes CVE-2023-{28755, 28756}].

Previous Next

Package: guix-patches;

Reported by: Remco van 't Veer <remco <at> remworks.net>

Date: Fri, 31 Mar 2023 05:38:02 UTC

Severity: normal

Tags: patch

Done: Andreas Enge <andreas <at> enge.fr>

Bug is archived. No further changes may be made.

To add a comment to this bug, you must first unarchive it, by sending
a message to control AT debbugs.gnu.org, with unarchive 62559 in the body.
You can then email your comments to 62559 AT debbugs.gnu.org in the normal way.

Toggle the display of automated, internal messages from the tracker.

View this report as an mbox folder, status mbox, maintainer mbox

Report forwarded to guix-patches <at> gnu.org:
bug#62559; Package guix-patches. (Fri, 31 Mar 2023 05:38:02 GMT) Full text and rfc822 format available.
Acknowledgement sent to Remco van 't Veer <remco <at> remworks.net>:
New bug report received and forwarded. Copy sent to guix-patches <at> gnu.org. (Fri, 31 Mar 2023 05:38:02 GMT) Full text and rfc822 format available.

Message #5 received at submit <at> debbugs.gnu.org (full text, mbox):

From: Remco van 't Veer <remco <at> remworks.net>
To: guix-patches <at> gnu.org
Cc: Remco van 't Veer <remco <at> remworks.net>
Subject: [PATCH] gnu: ruby-3.1: Upgrade to 3.1.4 [fixes CVE-2023-{28755,
 28756}].
Date: Fri, 31 Mar 2023 07:37:08 +0200

Fixes: CVE-2023-28755 (ReDoS vulnerability in URI), and
CVE-2023-28756 (ReDoS vulnerability in Time).

* gnu/packages/ruby.scm (ruby-3.1): Update to 3.1.4.
---
 gnu/packages/ruby.scm | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/gnu/packages/ruby.scm b/gnu/packages/ruby.scm
index 3bf0f0f534..237430e6e2 100644
--- a/gnu/packages/ruby.scm
+++ b/gnu/packages/ruby.scm
@@ -29,7 +29,7 @@
 ;;; Copyright © 2020 Tomás Ortín Fernández <tomasortin <at> mailbox.org>
 ;;; Copyright © 2021 Giovanni Biscuolo <g <at> xelera.eu>
 ;;; Copyright © 2022 Philip McGrath <philip <at> philipmcgrath.com>
-;;; Copyright © 2022 Remco van 't Veer <remco <at> remworks.net>
+;;; Copyright © 2022, 2023 Remco van 't Veer <remco <at> remworks.net>
 ;;; Copyright © 2022 Taiju HIGASHI <higashi <at> taiju.info>
 ;;; Copyright © 2023 Yovan Naumovski <yovan <at> gorski.stream>
 ;;;
@@ -232,7 +232,7 @@ (define-public ruby-3.0
 (define-public ruby-3.1
   (package
     (inherit ruby-3.0)
-    (version "3.1.3")
+    (version "3.1.4")
     (source
      (origin
        (method url-fetch)
@@ -241,7 +241,7 @@ (define-public ruby-3.1
                            "/ruby-" version ".tar.xz"))
        (sha256
         (base32
-         "06ipqz45qcs0y1273gk2gwslxwd7jgighz3mzbddzg16k29n3qaf"))))))
+         "0kzr792rk9n9yrqlyrkc1a0cmbk5y194f7v7p4vwjdk0ww860v8v"))))))
 
 (define-public ruby-3.2
   (package
-- 
2.39.2
Reply sent to Andreas Enge <andreas <at> enge.fr>:
You have taken responsibility. (Fri, 19 May 2023 09:21:03 GMT) Full text and rfc822 format available.
Notification sent to Remco van 't Veer <remco <at> remworks.net>:
bug acknowledged by developer. (Fri, 19 May 2023 09:21:03 GMT) Full text and rfc822 format available.

Message #10 received at 62559-done <at> debbugs.gnu.org (full text, mbox):

From: Andreas Enge <andreas <at> enge.fr>
To: 62558-done <at> debbugs.gnu.org, 62559-done <at> debbugs.gnu.org,
 62561-done <at> debbugs.gnu.org
Subject: Close
Date: Fri, 19 May 2023 11:20:00 +0200

Applied, thanks!

Andreas
bug archived. Request was from Debbugs Internal Request <help-debbugs <at> gnu.org> to internal_control <at> debbugs.gnu.org. (Fri, 16 Jun 2023 11:24:10 GMT) Full text and rfc822 format available.
This bug report was last modified 1 year and 330 days ago.

Previous Next

GNU bug tracking system
Copyright (C) 1999 Darren O. Benham, 1997,2003 nCipher Corporation Ltd, 1994-97 Ian Jackson.