ruby: update to 3.3.5 to resolve CVE-2024-39908

SPECS/ruby/CVE-2024-49761.patch

@@ -0,0 +1,46 @@
+From 51474a44f41e1e26cac2168922034f675851855d Mon Sep 17 00:00:00 2001
+From: Saul Paredes <[email protected]>
+Date: Tue, 12 Nov 2024 12:30:10 -0800
+Subject: [PATCH] ruby: patch CVE-2024-49761 Patch adapted from
+ https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f
+ which fixes CVE-2024-49761 per
+ https://nvd.nist.gov/vuln/detail/CVE-2024-49761
+
+Needed for rubygem-rexml versions < 3.3.9
+
+Signed-off-by: Saul Paredes <[email protected]>
+---
+ .../gems/rexml-3.3.6/lib/rexml/parsers/baseparser.rb   | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/.bundle/gems/rexml-3.3.6/lib/rexml/parsers/baseparser.rb b/.bundle/gems/rexml-3.3.6/lib/rexml/parsers/baseparser.rb
+index d11c276..e9ab0ee 100644
+--- a/.bundle/gems/rexml-3.3.6/lib/rexml/parsers/baseparser.rb
++++ b/.bundle/gems/rexml-3.3.6/lib/rexml/parsers/baseparser.rb
+@@ -150,7 +150,7 @@ module REXML
+         PEDECL_PATTERN = "\\s+(%)\\s+#{NAME}\\s+#{PEDEF}\\s*>"
+         ENTITYDECL_PATTERN = /(?:#{GEDECL_PATTERN})|(?:#{PEDECL_PATTERN})/um
+         CARRIAGE_RETURN_NEWLINE_PATTERN = /\r\n?/
+-        CHARACTER_REFERENCES = /&#0*((?:\d+)|(?:x[a-fA-F0-9]+));/
++        CHARACTER_REFERENCES = /&#((?:\d+)|(?:x[a-fA-F0-9]+));/
+         DEFAULT_ENTITIES_PATTERNS = {}
+         default_entities = ['gt', 'lt', 'quot', 'apos', 'amp']
+         default_entities.each do |term|
+@@ -564,8 +564,12 @@ module REXML
+         return rv if matches.size == 0
+         rv.gsub!( Private::CHARACTER_REFERENCES ) {
+           m=$1
+-          m = "0#{m}" if m[0] == ?x
+-          [Integer(m)].pack('U*')
++          if m.start_with?("x")
++            code_point = Integer(m[1..-1], 16)
++          else
++            code_point = Integer(m, 10)
++          end
++          [code_point].pack('U*')
+         }
+         matches.collect!{|x|x[0]}.compact!
+         if filter
+-- 
+2.25.1
+

SPECS/ruby/ruby.signatures.json

@@ -7,6 +7,6 @@
     "rubygems.con": "eb804c6b50eeafdb2172285265bc487a80acaa9846233cd5f1d20a25f1dac2ea",
     "rubygems.prov": "b79c1f5873dd20d251e100b276a5e584c1fb677f3e1b92534fc09130fabe8ee5",
     "rubygems.req": "e85681d8fa45d214055f3b26a8c1829b3a4bd67b26a5ef3c1f6426e7eff83ad0",
-    "ruby-3.3.3.tar.gz": "83c05b2177ee9c335b631b29b8c077b4770166d02fa527f3a9f6a40d13f3cce2"
+    "ruby-3.3.5.tar.gz": "3781a3504222c2f26cb4b9eb9c1a12dbf4944d366ce24a9ff8cf99ecbce75196"
   }
 }

SPECS/ruby/ruby.spec

@@ -4,17 +4,17 @@
 %global gem_dir %{_datadir}/ruby/gems
 
 # Default package version defined separately, because the %%version macro gets overwritten by 'Version' tags of the subpackages.
-%global ruby_version            3.3.3
+%global ruby_version            3.3.5
 %define ruby_version_majmin     %(echo %{ruby_version} | cut -d. -f1-2)
 
-%global rubygems_version        3.5.3
+%global rubygems_version        3.5.22
 # Add version for default gems from https://stdgems.org/
 # A helpful one-liner script to check the current default versions is available via RUBY_VER=%%{ruby_version_majmin} ./get_gem_versions.sh
 %global abbrev_version          0.1.2
 %global base64_version          0.2.0
 %global benchmark_version       0.3.0
 %global bigdecimal_version      3.1.5
-%global bundler_version         2.5.3
+%global bundler_version         2.5.22
 %global cgi_version             0.4.1
 %global csv_version             3.2.8
 %global date_version            3.3.4
@@ -32,15 +32,14 @@
 %global find_version            0.2.0
 %global forwardable_version     1.3.3
 %global getoptlong_version      0.2.1
-%global io_console_version      0.7.1
+%global io_console_version      0.7.2
 %global io_nonblock_version     0.3.0
 %global io_wait_version         0.3.1
 %global ipaddr_version          1.2.6
-%global irb_version             1.11.0
-%global json_version            2.7.1
+%global irb_version             1.13.1
 %global logger_version          1.6.0
 %global mutex_m_version         0.2.0
-%global net_http_version        0.4.0
+%global net_http_version        0.4.1
 %global net_protocol_version    0.2.2
 %global nkf_version             0.1.3
 %global observer_version        0.1.2
@@ -55,9 +54,9 @@
 %global prettyprint_version     0.2.0
 %global pstore_version          0.1.3
 %global psych_version           5.1.2
-%global rdoc_version            6.6.2
+%global rdoc_version            6.6.3.1
 %global readline_version        0.0.4
-%global reline_version          0.4.1
+%global reline_version          0.5.10
 %global resolv_version          0.3.0
 %global resolv_replace_version  0.1.1
 %global rinda_version           0.2.0
@@ -66,29 +65,29 @@
 %global set_version             1.1.0
 %global shellwords_version      0.2.0
 %global singleton_version       0.2.0
-%global stringio_version        3.1.0
-%global strscan_version         3.0.7
+%global stringio_version        3.1.1
+%global strscan_version         3.0.9
 %global syslog_version          0.1.2
-%global syntax_suggest_version  2.0.0
+%global syntax_suggest_version  2.0.1
 %global tempfile_version        0.2.1
 %global time_version            0.3.0
 %global timeout_version         0.4.1
 %global tmpdir_version          0.2.0
 %global tsort_version           0.2.0
 %global un_version              0.3.0
-%global uri_version             0.13.0
+%global uri_version             0.13.1
 %global weakref_version         0.1.3
 %global win32ole_version        1.8.10
 %global yaml_version            0.3.0
-%global zlib_version            3.1.0
+%global zlib_version            3.1.1
 
 Summary:        Ruby
 Name:           ruby
 # TODO: When changing ruby version, these gemified stdlib
 # provides should be versioned according to the ruby version.
 # More info: https://stdgems.org/
 Version:        %{ruby_version}
-Release:        2%{?dist}
+Release:        1%{?dist}
 License:        (Ruby OR BSD) AND Public Domain AND MIT AND CC0 AND zlib AND UCD
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -102,7 +101,7 @@ Source4:        rubygems.con
 Source5:        rubygems.prov
 Source6:        rubygems.req
 Source7:        macros.rubygems
-Patch0:         CVE-2024-41946.patch
+Patch0:         CVE-2024-49761.patch
 # Updates default ruby-uri to 0.12.2 and vendored one to 0.10.3. Remove once ruby gets updated to a version that comes with both lib/uri/version.rb and lib/bundler/vendor/uri/lib/uri/version.rb versions >= 0.12.2 or == 0.10.3
 BuildRequires:  openssl-devel
 # Pkgconfig(yaml-0.1) is needed to build the 'psych' gem.
@@ -408,6 +407,11 @@ sudo -u test make test TESTS="-v"
 %{_rpmconfigdir}/rubygems.con
 
 %changelog
+* Fri Nov 08 2024 Saul Paredes <[email protected]> - 3.3.5-1
+- Upgrade ruby to 3.3.5 to resolve CVE-2024-39908
+- Remove CVE-2024-41946.patch as it no longer applies as ruby 3.3.5 containers rubygem-rexml 3.3.6, where CVE-2024-41946 is already fixed
+- Patch CVE-2024-49761
+
 * Wed Sep 18 2024 Harshit Gupta <[email protected]> - 3.3.3-2
 - Revert ruby back to 3.3.3 to avoid build failure of rubygems-* packages
 - Add patch for CVE-2024-41946 for bundled gem rexml

SPECS/rubygem-rexml/CVE-2024-49761.patch

@@ -0,0 +1,46 @@
+From 67d11906da922cf0a9a5917f2f66c3cfb1472e4d Mon Sep 17 00:00:00 2001
+From: Saul Paredes <[email protected]>
+Date: Tue, 5 Nov 2024 09:55:45 -0800
+Subject: [PATCH] rubygem-rexml: patch CVE-2024-49761
+
+Patch adapted from https://github.com/ruby/rexml/commit/ce59f2eb1aeb371fe1643414f06618dbe031979f
+which fixes CVE-2024-49761 per https://nvd.nist.gov/vuln/detail/CVE-2024-49761
+
+Needed for rubygem-rexml versions < 3.3.9
+
+Signed-off-by: Saul Paredes <[email protected]>
+---
+ lib/rexml/parsers/baseparser.rb | 10 +++++++---
+ 1 file changed, 7 insertions(+), 3 deletions(-)
+
+diff --git a/lib/rexml/parsers/baseparser.rb b/lib/rexml/parsers/baseparser.rb
+index 28810bf..7a7d370 100644
+--- a/lib/rexml/parsers/baseparser.rb
++++ b/lib/rexml/parsers/baseparser.rb
+@@ -133,7 +133,7 @@ module REXML
+         PEDECL_PATTERN = "\\s+(%)\\s+#{NAME}\\s+#{PEDEF}\\s*>"
+         ENTITYDECL_PATTERN = /(?:#{GEDECL_PATTERN})|(?:#{PEDECL_PATTERN})/um
+         CARRIAGE_RETURN_NEWLINE_PATTERN = /\r\n?/
+-        CHARACTER_REFERENCES = /&#0*((?:\d+)|(?:x[a-fA-F0-9]+));/
++        CHARACTER_REFERENCES = /&#((?:\d+)|(?:x[a-fA-F0-9]+));/
+         DEFAULT_ENTITIES_PATTERNS = {}
+         default_entities = ['gt', 'lt', 'quot', 'apos', 'amp']
+         default_entities.each do |term|
+@@ -543,8 +543,12 @@ module REXML
+         return rv if matches.size == 0
+         rv.gsub!( Private::CHARACTER_REFERENCES ) {
+           m=$1
+-          m = "0#{m}" if m[0] == ?x
+-          [Integer(m)].pack('U*')
++          if m.start_with?("x")
++            code_point = Integer(m[1..-1], 16)
++          else
++            code_point = Integer(m, 10)
++          end
++          [code_point].pack('U*')
+         }
+         matches.collect!{|x|x[0]}.compact!
+         if matches.size > 0
+-- 
+2.25.1
+

SPECS/rubygem-rexml/rubygem-rexml.spec

@@ -3,13 +3,14 @@
 Summary:        REXML is an XML toolkit for Ruby
 Name:           rubygem-%{gem_name}
 Version:        3.3.4
-Release:        1%{?dist}
+Release:        2%{?dist}
 License:        BSD
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
 Group:          Development/Languages
 URL:            https://github.com/ruby/rexml
 Source0:        https://github.com/ruby/rexml/archive/refs/tags/v%{version}.tar.gz#/%{gem_name}-%{version}.tar.gz
+Patch0:         CVE-2024-49761.patch
 BuildRequires:  git
 BuildRequires:  ruby
 Requires:       ruby(release)
@@ -34,6 +35,9 @@ gem install -V --local --force --install-dir %{buildroot}/%{gemdir} %{gem_name}-
 %{gemdir}
 
 %changelog
+* Tue Nov 12 2024 Saul Paredes <[email protected]> - 3.3.4-2
+- Add patch for CVE-2024-49761
+
 * Fri Aug 9 2024 Bhagyashri Pathak <[email protected]> - 3.3.4-1
 - Upgrade to 3.3.4 to resolve CVE-2024-39908
 

cgmanifest.json

@@ -25894,8 +25894,8 @@
         "type": "other",
         "other": {
           "name": "ruby",
-          "version": "3.3.3",
-          "downloadUrl": "https://cache.ruby-lang.org/pub/ruby/3.3/ruby-3.3.3.tar.gz"
+          "version": "3.3.5",
+          "downloadUrl": "https://cache.ruby-lang.org/pub/ruby/3.3/ruby-3.3.5.tar.gz"
         }
       }
     },