mirrors/poky
1
0
Fork 0
mirror of https://git.yoctoproject.org/poky synced 2026-09-19 00:49:33 +02:00
Code Issues Packages Projects Releases Wiki Activity

ruby: fix CVE-2024-39908

Browse Source 
REXML is an XML toolkit for Ruby. The REXML gem before 3.3.1 has some
DoS vulnerabilities when it parses an XML that has many specific characters
such as `<`, `0` and `%>`. If you need to parse untrusted XMLs, you many be
impacted to these vulnerabilities. The REXML gem 3.3.2 or later include the
patches to fix these vulnerabilities. Users are advised to upgrade. Users
unable to upgrade should avoid parsing untrusted XML strings.

Reference:
https://security-tracker.debian.org/tracker/CVE-2024-39908

Upstream-patches:
f1df7d13b3
d146162e9a
b5bf109a59
b8a5f4cd5c
0af55fa49d
c1b64c174e
9f1415a261
c33ea49810
a79ac8b4b4
67efb5951e
1f1e6e9b40
910e5a2b48

(From OE-Core rev: 6e0b70843422cd7cdb25a9e1520dd64bf701fea6)

Signed-off-by: Divya Chellam <divya.chellam@windriver.com>
Signed-off-by: Steve Sakoman <steve@sakoman.com>
This commit is contained in:
Divya Chellam
2025-11-20 15:07:21 +05:30
committed by Steve Sakoman
parent f58483837c
commit 7c4bd642e4
13 changed files with 689 additions and 0 deletions
Download Patch File Download Diff File Expand all files Collapse all files

12
meta/recipes-devtools/ruby/ruby_3.1.3.bb
View File

@@ -54,6 +54,18 @@ SRC_URI = "http://cache.ruby-lang.org/pub/ruby/${SHRT_VER}/ruby-${PV}.tar.gz \
file://CVE-2025-27221-0001.patch \
file://CVE-2025-27221-0002.patch \
file://CVE-2024-35176.patch \
file://CVE-2024-39908-0001.patch \
file://CVE-2024-39908-0002.patch \
file://CVE-2024-39908-0003.patch \
file://CVE-2024-39908-0004.patch \
file://CVE-2024-39908-0005.patch \
file://CVE-2024-39908-0006.patch \
file://CVE-2024-39908-0007.patch \
file://CVE-2024-39908-0008.patch \
file://CVE-2024-39908-0009.patch \
file://CVE-2024-39908-0010.patch \
file://CVE-2024-39908-0011.patch \
file://CVE-2024-39908-0012.patch \
"
UPSTREAM_CHECK_URI = "https://www.ruby-lang.org/en/downloads/"