[ubuntu/jammy-updates] ruby3.0 3.0.2-7ubuntu2.4 (Accepted)

[Ubuntu Archive Robot]

ruby3.0 (3.0.2-7ubuntu2.4) jammy-security; urgency=medium

  * SECURITY UPDATE: ReDoS
    - debian/patches/CVE-2023-28755.patch: adds '+' once or more in specific
      places of the  RFC3986 regex in order to avoid the increase in execution
      time for parsing strings to URI objects in lib/uri/rfc3986_parser.rb.
    - debian/patches/CVE-2023-28755-fix-test-uri-empty-host-again.patch:
      fix test uri in lib/net/http/generic_request.rb.
    - CVE-2023-28755
  * SECURITY UPDATE: ReDoS
    - debian/patches/CVE-2023-36617.patch: changes regex behaviour
      in lib/url/rfc2396_parser.rb, lib/uri/rfc3986_parser.rb.
    - CVE-2023-36617

Date: 2023-07-10 11:14:08.022725+00:00
Changed-By: leo.barbosa at canonical.com (Leonidas S. Barbosa)
Signed-By: Ubuntu Archive Robot <ubuntu-archive-robot at lists.canonical.com>
https://launchpad.net/ubuntu/+source/ruby3.0/3.0.2-7ubuntu2.4
-------------- next part --------------
Sorry, changesfile not available.