* Upgrade to Ruby 3.0.7.
Resolves: RHEL-35740
The released Ruby 3.0.5 includes the following fix.
* Fix HTTP response splitting in CGI.
Resolves: RHEL-35741
The released Ruby 3.0.6 includes the following fixes.
* Fix ReDoS vulnerability in URI.
Resolves: RHEL-35742
* Fix ReDoS vulnerability in Time.
Resolves: RHEL-35743
The released Ruby 3.0.7 includes the following fixes.
* Fix buffer overread vulnerability in StringIO.
Resolves: RHEL-35744
* Fix RCE vulnerability with .rdoc_options in RDoc.
Resolves: RHEL-35746
* Fix arbitrary memory address read vulnerability with Regex search.
Resolves: RHEL-35747
Replaced the patch ruby-3.0.3-ext-openssl-extconf.rb-require-OpenSSL-version-1.0.1.patch
with the tiny patch ruby-ext-openssl-extconf.rb-ignore-OpenSSL-version-check.patch
not using the reverse logic. Because it was hard to maintain the patch file,
when the included file was updated on the upstream.
Added the following patches.
* Fix net-http test errors due to expired certificate.
The patch ruby-3.4.0-ruby-net-http-Renew-test-certificates.patch was copied
from the part on the Fedora rawhide
<05a6c9c8f3>.
* Fix `TestNetHTTPS#test_session_reuse_but_expire` test failure cause.
The patch ruby-3.3.1-Fix-test-session-reuse-but-expire.patch was copied from
the part on Fedora rawhide
<a34f33bc50>.
As a reference, the part comes from Fedora ruby-3.3 branch
<99d21ecc4c>.
Backport OpenSSL test suite fixes from the C9S branch stream-ruby-3.1-rhel-9.1.0
Patches were backported from commit: 20188a8a3f .
Changes:
Firstly, replace SHA1 with SHA256 and higher in tests.
SHA1 is disabled by default on C9S and RHEL 9.
Secondly, apply ossl_ocsp-use-null patch.
C9S/RHEL9 have SHA1 disabled by default, so using the OCSP with
default arguments on a default C9S/RHEL9 installation will result in an
OpenSSL error. This patch, when OCSP does not receive a digest explicitly, will
let OpenSSL decide which digest to use instead of using a default, thus
preventing usage of disabled digests.
See <https://github.com/ruby/openssl/pull/507>.
OPENSSL_ENABLE_SHA1_SIGNATURES=1 enables SHA1 for
OpenSSL in order to enable tests using SHA1 certificates, at least running
the tests is preferable to not running them at all.
Resolves: rbhz#2107696
