There is an XML round-trip vulnerability in REXML gem bundled with Ruby. This vulnerability has been assigned the CVE identifier CVE-2021-28965. We strongly recommend upgrading the REXML gem. Details When parsing and serializing a crafted XML document, REXML gem (including the one bundled with Ruby) can create a wrong XML document whose structure is different from the original one. The impact of this issue highly depends on context, but it may lead to a vulnerability in some programs that are using REXML. Please update REXML gem to version 3.2.5 or later. Affected versions Ruby 2.5.8 or prior (You can NOT use gem upgrade rexml for this version.) Ruby 2.6.7 or prior Ruby 2.7.2 or prior Ruby 3.0.1 or prior REXML gem 3.2.4 or prior
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=bb6c6805ad382db0062aa3b51dbba9992309d8b4 commit bb6c6805ad382db0062aa3b51dbba9992309d8b4 Author: Hans de Graaff <graaff@gentoo.org> AuthorDate: 2021-04-06 06:14:46 +0000 Commit: Hans de Graaff <graaff@gentoo.org> CommitDate: 2021-04-06 06:14:53 +0000 dev-lang/ruby: add 2.5.7, 2.6.7, 2.7.3, 3.0.1 Bug: https://bugs.gentoo.org/780498 Package-Manager: Portage-3.0.17, Repoman-3.0.2 Signed-off-by: Hans de Graaff <graaff@gentoo.org> dev-lang/ruby/Manifest | 4 + dev-lang/ruby/ruby-2.5.9.ebuild | 246 +++++++++++++++++++++++++++++++++++++ dev-lang/ruby/ruby-2.6.7.ebuild | 259 +++++++++++++++++++++++++++++++++++++++ dev-lang/ruby/ruby-2.7.3.ebuild | 263 +++++++++++++++++++++++++++++++++++++++ dev-lang/ruby/ruby-3.0.1.ebuild | 264 ++++++++++++++++++++++++++++++++++++++++ 5 files changed, 1036 insertions(+)
dev-ruby/rexml-3.2.5 has also been added. I'd like to wait a couple days before starting stabling the dev-lang/ruby versions since we introduced some other changes in the previous revisions that still need some investigation.
(In reply to Hans de Graaff from comment #2) > dev-ruby/rexml-3.2.5 has also been added. > > I'd like to wait a couple days before starting stabling the dev-lang/ruby > versions since we introduced some other changes in the previous revisions > that still need some investigation. Thanks!
Ping
(In reply to Sam James from comment #4) > Ping ping
Unable to check for sanity: > no match for package: dev-lang/ruby-2.5.9
The fixed ruby versions contain unrelated changes that break json in various cases. That needs to be fixed first before we can stable these versions.
(In reply to Hans de Graaff from comment #7) > The fixed ruby versions contain unrelated changes that break json in various > cases. That needs to be fixed first before we can stable these versions. Fixed versions are now in the tree. Let's give them a few days before stabling them.
amd64 stable
ppc stable
sparc stable
x86 stable
hppa stable
ppc64 stable
arm64 done
Unable to check for sanity: > package masked: dev-lang/ruby-2.5.9-r1
All sanity-check issues have been resolved
arm done all arches done
Please cleanup, thanks!
The bug has been referenced in the following commit(s): https://gitweb.gentoo.org/repo/gentoo.git/commit/?id=915ad705bf194fb1a9ee62b699689fb83499a022 commit 915ad705bf194fb1a9ee62b699689fb83499a022 Author: Hans de Graaff <graaff@gentoo.org> AuthorDate: 2021-07-18 08:46:26 +0000 Commit: Hans de Graaff <graaff@gentoo.org> CommitDate: 2021-07-18 08:46:26 +0000 dev-lang/ruby: cleanup vulnerable versions Bug: https://bugs.gentoo.org/780498 Package-Manager: Portage-3.0.20, Repoman-3.0.2 Signed-off-by: Hans de Graaff <graaff@gentoo.org> dev-lang/ruby/Manifest | 3 - dev-lang/ruby/ruby-2.6.6-r4.ebuild | 258 ------------------------------------ dev-lang/ruby/ruby-2.7.2-r2.ebuild | 261 ------------------------------------ dev-lang/ruby/ruby-2.7.2-r3.ebuild | 263 ------------------------------------ dev-lang/ruby/ruby-3.0.0-r3.ebuild | 262 ------------------------------------ dev-lang/ruby/ruby-3.0.0-r4.ebuild | 262 ------------------------------------ dev-lang/ruby/ruby-3.0.0-r5.ebuild | 264 ------------------------------------- 7 files changed, 1573 deletions(-)
Missed 2.5.8?
(In reply to John Helmert III from comment #21) > Missed 2.5.8? Ruby 2.5 is already masked for removal.
Unable to check for sanity: > no match for package: dev-lang/ruby-2.6.7-r2
