Commit Graph

2 Commits

Author SHA1 Message Date
Jun Aruga
3cd2ea3699 Upgrade to Ruby 3.0.7.
* Upgrade to Ruby 3.0.7.
  Resolves: RHEL-35740

The released Ruby 3.0.5 includes the following fix.

* Fix HTTP response splitting in CGI.
  Resolves: RHEL-35741

The released Ruby 3.0.6 includes the following fixes.

* Fix ReDoS vulnerability in URI.
  Resolves: RHEL-35742
* Fix ReDoS vulnerability in Time.
  Resolves: RHEL-35743

The released Ruby 3.0.7 includes the following fixes.

* Fix buffer overread vulnerability in StringIO.
  Resolves: RHEL-35744
* Fix RCE vulnerability with .rdoc_options in RDoc.
  Resolves: RHEL-35746
* Fix arbitrary memory address read vulnerability with Regex search.
  Resolves: RHEL-35747

Replaced the patch ruby-3.0.3-ext-openssl-extconf.rb-require-OpenSSL-version-1.0.1.patch
with the tiny patch ruby-ext-openssl-extconf.rb-ignore-OpenSSL-version-check.patch
not using the reverse logic. Because it was hard to maintain the patch file,
when the included file was updated on the upstream.

Added the following patches.
* Fix net-http test errors due to expired certificate.
  The patch ruby-3.4.0-ruby-net-http-Renew-test-certificates.patch was copied
  from the part on the Fedora rawhide
  <05a6c9c8f3>.
* Fix `TestNetHTTPS#test_session_reuse_but_expire` test failure cause.
  The patch ruby-3.3.1-Fix-test-session-reuse-but-expire.patch was copied from
  the part on Fedora rawhide
  <a34f33bc50>.
  As a reference, the part comes from Fedora ruby-3.3 branch
  <99d21ecc4c>.
2024-05-13 14:23:34 +02:00
Vít Ondruch
9b1bf40828 Update OpenSSL 3 compatibility patches.
This is based on origina PR with official patches which landed in
[ruby/openssl](https://github.com/ruby/openssl) repository and should
reflect the state of OpenSSL 3 support in Ruby 3.1.

Resolves: rhbz#1952925
2022-02-11 13:52:42 +01:00