#1009958 ruby3.0: CVE-2022-28738

Package:
src:ruby3.0
Source:
ruby3.0
Submitter:
Salvatore Bonaccorso
Date:
2022-04-21 21:27:07 UTC
Severity:
important
Tags:
#1009958#5
Date:
2022-04-21 08:51:16 UTC
From:
To:
Hi,

The following vulnerability was published for ruby3.0.

CVE-2022-28738[0]:
| Double free in Regexp compilation

If you fix the vulnerability please also make sure to include the
CVE (Common Vulnerabilities & Exposures) id in your changelog entry.

For further information see:

[0] https://security-tracker.debian.org/tracker/CVE-2022-28738
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-28738
[1] https://www.ruby-lang.org/en/news/2022/04/12/double-free-in-regexp-compilation-cve-2022-28738/

Regards,
Salvatore
#1009958#10
Date:
2022-04-21 21:22:34 UTC
From:
To:
We believe that the bug you reported is fixed in the latest version of
ruby3.0, which is due to be installed in the Debian FTP archive.

A summary of the changes between this version and the previous one is
attached.

Thank you for reporting the bug, which will now be closed.  If you
have further comments please address them to 1009958@bugs.debian.org,
and the maintainer will reopen the bug report if appropriate.

Debian distribution maintenance software
pp.
Antonio Terceiro <terceiro@debian.org> (supplier of updated ruby3.0 package)

(This message was generated automatically at their request; if you
believe that there is a problem with it please contact the archive
administrators by mailing ftpmaster@ftp-master.debian.org)
Format: 1.8
Date: Thu, 21 Apr 2022 13:52:50 -0300
Source: ruby3.0
Architecture: source
Version: 3.0.4-1
Distribution: unstable
Urgency: medium
Maintainer: Debian Ruby Team <pkg-ruby-extras-maintainers@lists.alioth.debian.org>
Changed-By: Antonio Terceiro <terceiro@debian.org>
Closes: 999349 999444 1007925 1009956 1009958
Changes:
 ruby3.0 (3.0.4-1) unstable; urgency=medium
 .
   [ John Paul Adrian Glaubitz ]
   * Disable some tests on powerpc (Closes: #999349)
   * Disable some tests on alpha (Closes: #999444)
   * Fix filenames for glibc SO files on alpha and ia64
     (Closes: #1007925)
 .
   [ Antonio Terceiro ]
   * New upstream version 3.0.4
   * Includes fixes for the following security issues:
     - CVE-2022-28739: Buffer overrun in String-to-Float conversion
       (Closes: #1009956)
     - CVE-2022-28738: Double free in Regexp compilation
       (Closes: #1009958)
   * Refresh patches.
     The fix in rand_init-fix-off-by-one-error.patch has been done upstream
     differently; drop the patch.
   * TestZlibGzipFile: skip test unsupported on overlay filesystems
Checksums-Sha1:
 d91bb886f9902c790afa3bf83387e96b61bb1d61 2477 ruby3.0_3.0.4-1.dsc
 103838fc00ba7dd429b1c8a57aa2c897a067cfa7 13647244 ruby3.0_3.0.4.orig.tar.xz
 77ad1f8003c68a15c27ae2a6258e3246d5250865 159064 ruby3.0_3.0.4-1.debian.tar.xz
 c3434725673664b58f2cfc10c59a664277d705c1 8248 ruby3.0_3.0.4-1_amd64.buildinfo
Checksums-Sha256:
 328d6884c92c3c725ec74616d13d0d33c6d9f52ed70e855c5a2f6918011cfa3d 2477 ruby3.0_3.0.4-1.dsc
 876b5becac51e15d805e69c7e3c85276d40d63237071a58ee6266410850fda2e 13647244 ruby3.0_3.0.4.orig.tar.xz
 8fbfb1705570a8442e52dfe5f65fe731c3adf5a2af4fd9d4264eb8e1a0ae85f2 159064 ruby3.0_3.0.4-1.debian.tar.xz
 587f938e6982d6226bde24913fadd9fdf4839fed3fe4f407193f1ad89e9f3f30 8248 ruby3.0_3.0.4-1_amd64.buildinfo
Files:
 b481cd76510a64ae59a444448877166b 2477 ruby optional ruby3.0_3.0.4-1.dsc
 3f4fc1ebe8b758ba5ea727cb2dd4edc2 13647244 ruby optional ruby3.0_3.0.4.orig.tar.xz
 4137e44b8f9eeedba7cdde8df4d3c9f5 159064 ruby optional ruby3.0_3.0.4-1.debian.tar.xz
 95b3df82c7a34439df132de555ac83c4 8248 ruby optional ruby3.0_3.0.4-1_amd64.buildinfo
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEst7mYDbECCn80PEM/A2xu81GC94FAmJhxkQACgkQ/A2xu81G
C97+8Q//VGYTbeq9bCte594UHQV50d6t4qJUeae/GSMwKG2AuUbomqJO7K7b+hed
Qb4OiPo2XAdMqaBqX8Daj50FDCqdbxS22B0M5bFVa4F/hfPx200uZM9K3MFxAaR2
GTTLyRu5D8tvIz84RYbcAjfCngaMrEZi8rpiOoQ2yWCbVtYArzTjHg04L4VST3J3
dJq4YgLf+pyiKpJxm/m7xQFCcK4AQxA0ZaMK7ej9hqQHHxxZk000NT3G+0edRAQ/
4Yhjxm8FGlP/FGhic90I8OR9VsnlTM/cpOcnUEITi/92E7YoAOQmZHOZInYFIDOC
VE3TH30UMoO6uc+fxMWFE5KooTLx/S28RF9RrJvWst3o8IR9Wa4+5aE1De+GgNFV
HS7Labjy6uQKS/K2LcJUiKdyAhkSr1w/pyg1E/WsJ3ZvchhJDaOxsRjTt9XZPBxl
pelyboMOL3iZHsUFpEia0eczmHIY0U2Oq9F2yEIQCDQUoZlkWBv2gAxThgkJ26b4
mCUWZDVBffl6ory07zmOUW+PNjdkDZEkZG5beC8IH5jyQUPk5cub6LSHXa8rX94S
1yE0kACwuc+5P5MQX723IbBJdGsAs1jjUBFFIlm7Yk/hJfZwrOjTatsagAMqgsCc
DaFX1Mho4J0+fDxNDm7zibMiy1mvxxUjOCDPVcsipDWUQ6e/J9k=
=5cbE
-----END PGP SIGNATURE-----