Bug #22317: Also update lib/rubygems/vendor/resolv/lib/resolv.rb for CVE issue??

• Status: Closed
• Assignee: -
• Target version: -
• ruby -v: 4.0.7
• Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN

[mtasaka (Mamoru TASAKA)]

Recently two CVE security issues are reported against resolv gem, and
looks like fixed resolv 0.7.2 was pushed into ruby_4_0 branch:

https://github.com/ruby/ruby/commit/2da9a6ef3f423fb85acfd5c41150bb22cdeb14ef

which updates lib/resolv.rb in ruby tree, which is finally included in released ruby 4.0.7 tarball.

However, there is another "resolv.rb" under lib/rubygems/vendor/resolv/lib/ in ruby 4.0.7 "tarball"
and it says the version is still 0.7.0, so looks like this is still affected by CVE issue.

https://github.com/ruby/ruby/blob/v4.0.7/lib/rubygems/vendor/resolv/lib/resolv.rb#L38

So propably the above file also needs updating??

[hsbt (Hiroshi SHIBATA)]

• Status changed from Open to Closed

The vendored copy is not affected. RubyGems never used it as a resolver. The only reference was Resolv::IPv4::Regex and Resolv::IPv6::Regex in the vendored net/http, which decide whether an address may be sent as a Server Name Indication. Resolv::DNS was never instantiated, so the decoder paths that CVE-2026-80212 and CVE-2026-80213 fix were unreachable.

I removed it anyway in https://github.com/ruby/rubygems/pull/9877. It will be released in the RubyGems 4.0 series and merged into Ruby 4.0 in due course.