Bug #20386: Backport CVE-2024-27281

• Status: Closed
• Assignee: -
• Target version: -
• Backport: 3.0: REQUIRED, 3.1: REQUIRED, 3.2: DONE, 3.3: DONE

[hsbt (Hiroshi SHIBATA)]

I disclosed https://www.ruby-lang.org/en/news/2024/03/21/rce-rdoc-cve-2024-27281/ today.

We should backport fixed RDoc to all stable version.

• For 3.0: https://github.com/ruby/ruby/pull/10319
• For 3.1: https://github.com/ruby/ruby/pull/10318
• For 3.2: https://github.com/ruby/ruby/pull/10317
• For 3.3: https://github.com/ruby/ruby/pull/10316

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 3.0: REQUIRED, 3.1: REQUIRED, 3.2: REQUIRED, 3.3: REQUIRED to 3.0: REQUIRED, 3.1: REQUIRED, 3.2: DONE, 3.3: REQUIRED

Merged https://github.com/ruby/ruby/pull/10317

[hsbt (Hiroshi SHIBATA)]

• Backport changed from 3.0: REQUIRED, 3.1: REQUIRED, 3.2: DONE, 3.3: REQUIRED to 3.0: REQUIRED, 3.1: REQUIRED, 3.2: DONE, 3.3: DONE