Bug #20698: Please backport fix for CVE-2024-43398

• Status: Closed
• Assignee: -
• Target version: -
• ruby -v: ruby 3.3.4 (2024-07-09 revision be1089c8ec) [x86_64-linux]
• Backport: 3.1: DONE, 3.2: DONE, 3.3: DONE

[vo.x (Vit Ondruch)]

This is similar request to #20667, but since that was already partially done, I have decided to open new ticket

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 3.1: UNKNOWN, 3.2: UNKNOWN, 3.3: UNKNOWN to 3.1: REQUIRED, 3.2: REQUIRED, 3.3: REQUIRED

[nagachika (Tomoyuki Chikanaga)]

• Status changed from Open to Closed

[nagachika (Tomoyuki Chikanaga)]

• Backport changed from 3.1: REQUIRED, 3.2: REQUIRED, 3.3: REQUIRED to 3.1: REQUIRED, 3.2: DONE, 3.3: REQUIRED

ruby_3_2 3a3784a197383046537e66a9c567b96a52f0f86f merged revision(s) 29500e3034681a30045dea462d6bb653e8600738.

[k0kubun (Takashi Kokubun)]

• Backport changed from 3.1: REQUIRED, 3.2: DONE, 3.3: REQUIRED to 3.1: REQUIRED, 3.2: DONE, 3.3: DONE

ruby_3_3 e0e23e7d5e.

[k0kubun (Takashi Kokubun)]

Please consider filing PRs to branches like ruby_3_3 next time.

[hsbt (Hiroshi SHIBATA)]

• Backport changed from 3.1: REQUIRED, 3.2: DONE, 3.3: DONE to 3.1: DONE, 3.2: DONE, 3.3: DONE

REXML-3.3.9 has been merged at https://github.com/ruby/ruby/commit/3713db9a24c4f4b69c59a0b28c41f861b5a14c97 on ruby_3_1.