Skip to contentSkip to conversation

ruby: security bump to version 2.1.4

PATCH New Gustavo Zacarias 2 participants 3 messages Oct 27, 2014 – Nov 4, 2014

lore
Share & tools
lore

Gustavo Zacarias

author
#0 lore raw

PATCH 1/1 ruby: security bump to version 2.1.4

Fixes:
CVE-2014-8080 - Denial of service XML expansion

And change default ext/openssl settings WRT CVE-2014-3566.

Signed-off-by Gustavo Zacarias <[email protected]>
---
 package/ruby/ruby.hash | 4 ++--
 package/ruby/ruby.mk   | 2 +-
 2 files changed, 3 insertions(+), 3 deletions(-)
package/ruby/ruby.hash +2 -2
index 3d17e8c..8d5d133 100644
@@ -1,2 +1,2 @@
-# From https://www.ruby-lang.org/en/downloads/
-md5	74a37b9ad90e4ea63c0eed32b9d5b18f	ruby-2.1.3.tar.gz
+# From https://www.ruby-lang.org/en/news/2014/10/27/ruby-2-1-4-released/
+sha256	bf9952cdeb3a0c6a5a27745c9b4c0e5e264e92b669b2b08efb363f5156549204	ruby-2.1.4.tar.gz
package/ruby/ruby.mk +1 -1
index e633ee4..36f6d3f 100644
@@ -5,7 +5,7 @@
 ################################################################################
 
 RUBY_VERSION_MAJOR = 2.1
-RUBY_VERSION = $(RUBY_VERSION_MAJOR).3
+RUBY_VERSION = $(RUBY_VERSION_MAJOR).4
 RUBY_VERSION_EXT = 2.1.0
 RUBY_SITE = http://cache.ruby-lang.org/pub/ruby/$(RUBY_VERSION_MAJOR)
 RUBY_DEPENDENCIES = host-pkgconf host-ruby
Signature · 1 line
2.0.4
#1 lore raw

PATCH 1/1 ruby: security bump to version 2.1.4

Quoted 6 lines
Quoted 1 line
Quoted 1 line
Quoted 1 line
Quoted 1 line

"Gustavo" == Gustavo Zacarias <[email protected]> writes:

Fixes:
CVE-2014-8080 - Denial of service XML expansion

And change default ext/openssl settings WRT CVE-2014-3566.

I know it wasn't caused by this bump, but we have a number of autobuild issues related to RUBY_EXEC_PREFIX. Could you perhaps take a look (ignore the bfin ones)?

http://autobuild.buildroot.net/?reason=ruby-2.1.4
http://autobuild.buildroot.net/?reason=ruby-2.1.3

Thanks!

Signature · 1 line
Bye, Peter Korsgaard
author
#2 lore raw

PATCH 1/1 ruby: security bump to version 2.1.4

Quoted 6 lines · Peter Korsgaard

I know it wasn't caused by this bump, but we have a number of autobuild issues related to RUBY_EXEC_PREFIX. Could you perhaps take a look (ignore the bfin ones)?

http://autobuild.buildroot.net/?reason=ruby-2.1.4
http://autobuild.buildroot.net/?reason=ruby-2.1.3

Hi.
I'm unable to reproduce it.
And it seems to be limited to failures on gcc16 (the 2.1.3 bfin failures are a different issue).
So i think it's something there since i've tested on a very old/bare debian chroot here. Possibly a candidate for blacklisting. Regards.