#22533 closed enhancement (fixed)
ruby-3.4.8
| Reported by: | Bruce Dubbs | Owned by: | Bruce Dubbs |
|---|---|---|---|
| Priority: | elevated | Milestone: | 13.0 |
| Component: | BOOK | Version: | git |
| Severity: | medium | Keywords: | |
| Cc: |
Description
New point version.
Change History (7)
comment:1 by , 9 months ago
| Owner: | changed from to |
|---|---|
| Status: | new → assigned |
comment:2 by , 9 months ago
follow-up: 5 comment:3 by , 9 months ago
There is a comment in the release notes about CVE-2025-58767 but checking that the comment is:
"REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities."
Since this is version 3.4.8 I do not think a security advisory is needed. Besides it's rated as 1.2 LOW.
comment:4 by , 9 months ago
| Resolution: | → fixed |
|---|---|
| Status: | assigned → closed |
Fixed at commits
b0f66fda09 Update to graphviz-14.1.1. 7387eda48a Update to ruby-3.4.8.
comment:5 by , 9 months ago
| Priority: | normal → elevated |
|---|
Replying to Bruce Dubbs:
There is a comment in the release notes about CVE-2025-58767 but checking that the comment is:
"REXML is an XML toolkit for Ruby. The REXML gems from 3.3.3 to 3.4.1 has a DoS vulnerability when parsing XML containing multiple XML declarations. If you need to parse untrusted XMLs, you may be impacted to these vulnerabilities. The REXML gem 3.4.2 or later include the patches to fix these vulnerabilities."
Since this is version 3.4.8 I do not think a security advisory is needed. Besides it's rated as 1.2 LOW.
It is rated as Low, however the version of the gem is separate from the version of Ruby. Gems are Ruby's equivalent of modules like Perl/Python/Node modules. I'll file an advisory for it for consistency
Release notes are at https://github.com/ruby/ruby/releases/tag/v3_4_8