From: "mtasaka (Mamoru TASAKA) via ruby-core" Date: 2026-09-15T13:58:08+00:00 Subject: [ruby-core:126729] [Ruby Bug#22317] Also update lib/rubygems/vendor/resolv/lib/resolv.rb for CVE issue?? Issue #22317 has been reported by mtasaka (Mamoru TASAKA). ---------------------------------------- Bug #22317: Also update lib/rubygems/vendor/resolv/lib/resolv.rb for CVE issue?? https://bugs.ruby-lang.org/issues/22317 * Author: mtasaka (Mamoru TASAKA) * Status: Open * ruby -v: 4.0.7 * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- Recently two CVE security issues are reported against resolv gem, and looks like fixed resolv 0.7.2 was pushed into ruby_4_0 branch: https://github.com/ruby/ruby/commit/2da9a6ef3f423fb85acfd5c41150bb22cdeb14ef which updates lib/resolv.rb in ruby tree, which is finally included in released ruby 4.0.7 tarball. However, there is another "resolv.rb" under lib/rubygems/vendor/resolv/lib/ in ruby 4.0.7 "tarball" and it says the version is still 0.7.0, so looks like this is still affected by CVE issue. https://github.com/ruby/ruby/blob/v4.0.7/lib/rubygems/vendor/resolv/lib/resolv.rb#L38 So propably the above file also needs updating?? -- https://bugs.ruby-lang.org/ ______________________________________________ ruby-core mailing list -- ruby-core@ml.ruby-lang.org To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/