Bug #20667: Backport REXML CVE fixes

• Status: Closed
• Assignee: -
• Target version: -
• ruby -v: ruby 3.3.4 (2024-07-09 revision be1089c8ec) [x86_64-linux]
• Backport: 3.1: DONE, 3.2: DONE, 3.3: DONE

[vo.x (Vit Ondruch)]

It would be nice to have the recent REXML CVE fixes backported everywhere.

BTW it is surprising that REXML was recently bumped in 3.1 / 3.2 branches, but 3.3 branch stays with older REXML 3.2.

[hsbt (Hiroshi SHIBATA)]

• Status changed from Open to Closed
• Backport changed from 3.1: UNKNOWN, 3.2: UNKNOWN, 3.3: UNKNOWN to 3.1: REQUIRED, 3.2: REQUIRED, 3.3: REQUIRED

[kou (Kouhei Sutou)]

• Subject changed from Backport ReXML CVE fixes to Backport REXML CVE fixes
• Description updated (diff)

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 3.1: REQUIRED, 3.2: REQUIRED, 3.3: REQUIRED to 3.1: REQUIRED, 3.2: DONE, 3.3: REQUIRED

ruby_3_2 0f2f6b31aa6433fd800f0621b5bedbaf0da12a6f merged revision(s) 2a7da0b6e76929c684cd948630a897c1d5b16c26.

[k0kubun (Takashi Kokubun)]

• Backport changed from 3.1: REQUIRED, 3.2: DONE, 3.3: REQUIRED to 3.1: REQUIRED, 3.2: DONE, 3.3: DONE

ruby_3_3 e0e23e7d5eb4da42c490b1d3408bd6e5047e8f83 merged revision(s) 29500e30346.

[k0kubun (Takashi Kokubun)]

Please consider filing a backport PR to stable branches next time.

[hsbt (Hiroshi SHIBATA)]

• Backport changed from 3.1: REQUIRED, 3.2: DONE, 3.3: DONE to 3.1: DONE, 3.2: DONE, 3.3: DONE

https://github.com/ruby/ruby/pull/11581