Skip to content

Commit e4abd05

Browse files
[Medium] Upgrade ruby to 3.1.7 to fix CVE-2024-39908 (#13764)
1 parent 483f02b commit e4abd05

13 files changed

+10
-796
lines changed

SPECS/ruby/CVE-2023-36617.patch

Lines changed: 1 addition & 44 deletions
Original file line numberDiff line numberDiff line change
@@ -9,9 +9,6 @@ Remove once ruby gets updated to a version that comes with both lib/uri/version.
99
lib/bundler/vendor/uri/lib/uri/rfc2396_parser.rb | 4 ++--
1010
lib/bundler/vendor/uri/lib/uri/rfc3986_parser.rb | 2 +-
1111
lib/bundler/vendor/uri/lib/uri/version.rb | 2 +-
12-
lib/uri/rfc2396_parser.rb | 4 ++--
13-
lib/uri/rfc3986_parser.rb | 2 +-
14-
lib/uri/version.rb | 2 +-
1512
6 files changed, 8 insertions(+), 8 deletions(-)
1613

1714
diff --git a/lib/bundler/vendor/uri/lib/uri/rfc2396_parser.rb b/lib/bundler/vendor/uri/lib/uri/rfc2396_parser.rb
@@ -49,51 +46,11 @@ index 3895df0..d65b7e5 100644
4946
@@ -1,6 +1,6 @@
5047
module Bundler::URI
5148
# :stopdoc:
52-
- VERSION_CODE = '001002'.freeze
49+
- VERSION_CODE = '001001'.freeze
5350
+ VERSION_CODE = '001003'.freeze
5451
VERSION = VERSION_CODE.scan(/../).collect{|n| n.to_i}.join('.').freeze
5552
# :startdoc:
5653
end
57-
diff --git a/lib/uri/rfc2396_parser.rb b/lib/uri/rfc2396_parser.rb
58-
index 76a8f99..00c66cf 100644
59-
--- a/lib/uri/rfc2396_parser.rb
60-
+++ b/lib/uri/rfc2396_parser.rb
61-
@@ -497,8 +497,8 @@ def initialize_regexp(pattern)
62-
ret = {}
63-
64-
# for URI::split
65-
- ret[:ABS_URI] = Regexp.new('\A\s*' + pattern[:X_ABS_URI] + '\s*\z', Regexp::EXTENDED)
66-
- ret[:REL_URI] = Regexp.new('\A\s*' + pattern[:X_REL_URI] + '\s*\z', Regexp::EXTENDED)
67-
+ ret[:ABS_URI] = Regexp.new('\A\s*+' + pattern[:X_ABS_URI] + '\s*\z', Regexp::EXTENDED)
68-
+ ret[:REL_URI] = Regexp.new('\A\s*+' + pattern[:X_REL_URI] + '\s*\z', Regexp::EXTENDED)
69-
70-
# for URI::extract
71-
ret[:URI_REF] = Regexp.new(pattern[:URI_REF])
72-
diff --git a/lib/uri/rfc3986_parser.rb b/lib/uri/rfc3986_parser.rb
73-
index dd24a40..9b1663d 100644
74-
--- a/lib/uri/rfc3986_parser.rb
75-
+++ b/lib/uri/rfc3986_parser.rb
76-
@@ -100,7 +100,7 @@ def default_regexp # :nodoc:
77-
QUERY: /\A(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*\z/,
78-
FRAGMENT: /\A(?:%\h\h|[!$&-.0-;=@-Z_a-z~\/?])*\z/,
79-
OPAQUE: /\A(?:[^\/].*)?\z/,
80-
- PORT: /\A[\x09\x0a\x0c\x0d ]*\d*[\x09\x0a\x0c\x0d ]*\z/,
81-
+ PORT: /\A[\x09\x0a\x0c\x0d ]*+\d*[\x09\x0a\x0c\x0d ]*\z/,
82-
}
83-
end
84-
85-
diff --git a/lib/uri/version.rb b/lib/uri/version.rb
86-
index 7497a7d..f0aca58 100644
87-
--- a/lib/uri/version.rb
88-
+++ b/lib/uri/version.rb
89-
@@ -1,6 +1,6 @@
90-
module URI
91-
# :stopdoc:
92-
- VERSION_CODE = '001201'.freeze
93-
+ VERSION_CODE = '001202'.freeze
94-
VERSION = VERSION_CODE.scan(/../).collect{|n| n.to_i}.join('.').freeze
95-
# :startdoc:
96-
end
9754
--
9855
2.25.1
9956

SPECS/ruby/CVE-2024-27280.patch

Lines changed: 0 additions & 90 deletions
This file was deleted.

SPECS/ruby/CVE-2024-27281.patch

Lines changed: 0 additions & 104 deletions
This file was deleted.

SPECS/ruby/CVE-2024-27282.patch

Lines changed: 0 additions & 24 deletions
This file was deleted.

0 commit comments

Comments
 (0)