alt-ruby26 (2.6.10-17) stable; urgency=medium

  * SECURITY UPDATE: Bundler argument injection via leading-dash Gemfile git URL
    - debian/patches/CVE-2021-43809.patch: insert "--" end-of-options
      separator before the URI in the clone and fetch commands built by
      lib/bundler/source/git/git_proxy.rb.
    - CVE-2021-43809

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Wed, 06 May 2026 09:55:00 +0000

alt-ruby26 (2.6.10-16) stable; urgency=medium

  * SECURITY UPDATE: REXML ReDoS via leading-zero hex character reference
    - debian/patches/CVE-2024-49761.patch: replace the
      /&#0*((?:\d+)|(?:x[a-fA-F0-9]+));/ regex in unnormalize() with
      /&#((?:\d+)|(?:x[a-fA-F0-9]+));/ so that &#0x...; is no longer
      accepted as a hex character reference, eliminating the
      catastrophic-backtracking ReDoS on inputs with many leading
      zeros.
    - CVE-2024-49761
  * SECURITY UPDATE: REXML DoS via deep same-local-name attributes
    - debian/patches/CVE-2024-43398.patch: replace the per-attribute
      tree-walk in Element#[]= with an O(1) parse-time conflict check
      using a parser-level @namespaces hash and an expanded_names
      hash keyed on [uri, local_part]; seed @namespaces with the
      implicitly-bound xml prefix per upstream 78f8712 to avoid
      breaking XHTML documents that use both xml:lang and lang.
    - CVE-2024-43398
  * SECURITY UPDATE: REXML DoS via entity expansion in SAX/pull parsers
    - debian/patches/CVE-2024-41946.patch: route the SAX2Parser :text
      handler through @parser.unnormalize (upstream prerequisite
      4ebf21f), and add @entity_expansion_count + per-call
      sum/Security.entity_expansion_text_limit accounting in
      BaseParser so that billion-laughs-style XML triggers
      "entity expansion has grown too large" / "number of entity
      expansions exceeded" in SAX and pull mode, matching the
      existing DOM behaviour.
    - CVE-2024-41946
  * SECURITY UPDATE: REXML DoS via slow processing-instruction parsing
    - debian/patches/CVE-2024-41123.patch: rewrite process_instruction
      to call parse_name and then match the content separately,
      avoiding the catastrophic-backtracking INSTRUCTION_PATTERN
      regex; grow the IOSource read buffer exponentially via
      min_bytes so that source.match() is O(log n) attempts rather
      than O(n) on inputs that never match the regex.
    - CVE-2024-41123
  * Add debian/patches/rexml-cve-tests.patch with regression tests
    adapted from upstream for the four CVEs above; replaces
    assert_linear_performance (not available on 2.6) with
    Timeout-based guards and uses class+message form of assert_raise
    so the tests work under the bundled minitest-style Test::Unit.

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Thu, 30 Apr 2026 12:00:00 +0200

alt-ruby26 (2.6.10-15) stable; urgency=medium

  * ALR-235: Build for Debian 12 and 13 ARM platforms.

 -- Razmik Manvelyan <rmanvelyan@cloudlinux.com>  Tue, 24 Mar 2026 14:00:00 +0400

alt-ruby26 (2.6.10-14) stable; urgency=medium

  * Security fixes
    - CVE-2023-28756: Fix ReDoS vulnerability in Time.rfc2822 parsing.

 -- Juan Carlos Garcia <jgarcia@cloudlinux.com>  Mon, 09 Feb 2026 13:20:00 +0100

alt-ruby26 (2.6.10-13) stable; urgency=medium

  * ALR-220: Build for Debian 12 and 13.

 -- Eduard Chiganov <echiganov@cloudlinux.com>  Wed, 19 Nov 2025 14:20:00 +0200

alt-ruby26 (2.6.10-1) stable; urgency=medium

  * ALR-175: initial build

 -- Ilya Voyskovsky <ivoyskovsky@cloudlinux.com>  Mon, 31 Jul 2023 15:00:00 +0200
