From: "hsbt (Hiroshi SHIBATA) via ruby-core" Date: 2026-09-16T02:12:11+00:00 Subject: [ruby-core:126736] [Ruby Bug#22317] Also update lib/rubygems/vendor/resolv/lib/resolv.rb for CVE issue?? Issue #22317 has been updated by hsbt (Hiroshi SHIBATA). Status changed from Open to Closed The vendored copy is not affected. RubyGems never used it as a resolver. The only reference was `Resolv::IPv4::Regex` and `Resolv::IPv6::Regex` in the vendored `net/http`, which decide whether an address may be sent as a Server Name Indication. `Resolv::DNS` was never instantiated, so the decoder paths that CVE-2026-80212 and CVE-2026-80213 fix were unreachable. I removed it anyway in https://github.com/ruby/rubygems/pull/9877. It will be released in the RubyGems 4.0 series and merged into Ruby 4.0 in due course. ---------------------------------------- Bug #22317: Also update lib/rubygems/vendor/resolv/lib/resolv.rb for CVE issue?? https://bugs.ruby-lang.org/issues/22317#change-119032 * Author: mtasaka (Mamoru TASAKA) * Status: Closed * ruby -v: 4.0.7 * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- Recently two CVE security issues are reported against resolv gem, and looks like fixed resolv 0.7.2 was pushed into ruby_4_0 branch: https://github.com/ruby/ruby/commit/2da9a6ef3f423fb85acfd5c41150bb22cdeb14ef which updates lib/resolv.rb in ruby tree, which is finally included in released ruby 4.0.7 tarball. However, there is another "resolv.rb" under lib/rubygems/vendor/resolv/lib/ in ruby 4.0.7 "tarball" and it says the version is still 0.7.0, so looks like this is still affected by CVE issue. https://github.com/ruby/ruby/blob/v4.0.7/lib/rubygems/vendor/resolv/lib/resolv.rb#L38 So propably the above file also needs updating?? -- https://bugs.ruby-lang.org/ ______________________________________________ ruby-core mailing list -- ruby-core@ml.ruby-lang.org To unsubscribe send an email to ruby-core-leave@ml.ruby-lang.org ruby-core info -- https://ml.ruby-lang.org/mailman3/lists/ruby-core.ml.ruby-lang.org/