Groups > linux.debian.bugs.dist > #1148955

Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload

From	Lucas Kanashiro <kanashiro.duarte@gmail.com>
Newsgroups	linux.debian.bugs.dist
Subject	Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload
Date	2023-06-07 13:30 +0200
Message-ID	<GDZwt-egYF-5@gated-at.bofh.it> (permalink)
References	(2 earlier) <GDWyB-efgZ-1@gated-at.bofh.it> <GDXuF-efOX-1@gated-at.bofh.it> <GDZ3r-egzY-1@gated-at.bofh.it> <GDV9v-eeio-1@gated-at.bofh.it> <GDZ3r-egzY-1@gated-at.bofh.it>
Organization	linux.* mail to news gateway

Show all headers | View raw

[Multipart message — attachments visible in raw view] - view raw

FWIW, in Ubuntu, we had a similar issue trying to fix this CVE in ruby2.7,
and in the end we reverted the fix:

https://launchpad.net/ubuntu/+source/ruby2.7/2.7.0-5ubuntu1.10

Lucas Kanashiro.

Em qua., 7 de jun. de 2023 07:47, Utkarsh Gupta <guptautkarsh2102@gmail.com>
escreveu:

> Hiya,
>
> On Wed, Jun 7, 2023 at 2:39 PM Moritz Muehlenhoff <jmm@inutil.org> wrote:
> > Specifically
> https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/
> > states:
> >
> > | For Ruby 2.7: Update to uri 0.10.0.1
> > | For Ruby 3.0: Update to uri 0.10.2
> > | For Ruby 3.1: Update to uri 0.11.1
> > | For Ruby 3.2: Update to uri 0.12.1
> >
> > And the 0.10 change (
> https://github.com/ruby/uri/commit/17861a53e499a2eabf7ba83d63914d0f01921d70
> )
> > is different from the 0.12 one (
> https://github.com/ruby/uri/commit/eaf89cc31619d49e67c64d0b58ea9dc38892d175
> )
> >
> > There might be other changes needed for 2.5, not sure.
>
> Yep, I'm taking a look to prep something for 2.5.
>
>
> - u
>
>

Thread

Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload Bernhard Schmidt <berni@debian.org> - 2023-06-07 08:50 +0200
  Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload Salvatore Bonaccorso <carnil@debian.org> - 2023-06-07 09:40 +0200
    Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload Utkarsh Gupta <guptautkarsh2102@gmail.com> - 2023-06-07 10:20 +0200
  Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload Lucas Kanashiro <kanashiro.duarte@gmail.com> - 2023-06-07 13:30 +0200
  Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload Kees Meijs | Nefos <keesm@nefos.nl> - 2023-06-07 15:30 +0200
  Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload Utkarsh Gupta <guptautkarsh2102@gmail.com> - 2023-06-07 15:30 +0200
    Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload Jérôme Charaoui <jerome@riseup.net> - 2023-06-07 18:40 +0200
  Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload "Chris Lamb" <lamby@debian.org> - 2023-06-07 17:40 +0200
  Bug#1037178: puppet does not sync files anymore after recent ruby2.5 security upload Utkarsh Gupta <guptautkarsh2102@gmail.com> - 2023-06-07 23:30 +0200
  Bug#1037178: puppet does not sync files anymore after recent ruby2.5  security upload Zubrick <zubrick@number6.ch> - 2023-06-09 07:00 +0200

csiph-web