[ruby-core:111189] [Ruby master Misc#19178] How does CRuby handle CVE issues in stdlib gems which get patched?

Issue #19178 has been updated by hsbt (Hiroshi SHIBATA).


Austin, Thanks for your explanation for details. 

We will update the all of bundled stdlibs(=default gems) at the release time of Ruby.



----------------------------------------
Misc #19178: How does CRuby handle CVE issues in stdlib gems which get patched?
https://bugs.ruby-lang.org/issues/19178#change-100473

* Author: Segaja (Andreas Schleifer)
* Status: Open
* Priority: Normal
----------------------------------------
If there is a CVE issue in one of the stdlibs ( https://stdgems.org/ ) which gets patched, what is CRubys approach on how to push this critical fix to the users?

As far as I know stdlibs get only updated for the users if CRuby releases a new version. So will CRuby always release a new version if there is a critical fix an stdlib "needs" to be updated?



-- 
https://bugs.ruby-lang.org/
 ______________________________________________
 ruby-core mailing list -- [e-mail]
 To unsubscribe send an email to [e-mail]
 ruby-core info -- https://ml.ruby-lang.org/mailman3/postorius/lists/ruby-core.ml.ruby-lang.org/