# changelog

author: Eduard Chiganov <echiganov@cloudlinux.com> - 2.4.10-15
changelog:
  - ALR-140: Fixed mistake in net-telnet version description (epoch added).
  - Conflicts dependencies added.


author: Eduard Chiganov <echiganov@cloudlinux.com> - 2.6.10-9
changelog:
  - ALR-140: Mistake in net-telnet version description was fixed through epoch usage.
  - Conflicts dependencies added.
  - ALR-150: Updated to 2.6.10-9 release to prevent rubygems version conflicts.


author: Eduard Chiganov <echiganov@cloudlinux.com> - 2.7.6-138
changelog:
  - ALR-140: Mistake in net-telnet version description was fixed through epoch usage.
  - ALR-149: Patch for ipaddr fixed.
  - ALR-151: Update to 2.7.6 version
  - Conflicts dependencies added.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 2.7.8-143
changelog:
  - CVE-2024-49761: rexml redos via leading-zero hex character reference.
  - CVE-2024-43398: rexml dos via deep same-local-name attributes.
  - CVE-2024-41946: rexml dos via entity expansion in sax/pull parsers.
  - CVE-2024-41123: rexml dos via slow processing-instruction parsing.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 2.7.8-145
changelog:
  - CVE-2024-35176: rexml dos via attribute value with many `>` characters.
  - CVE-2024-39908: rexml redos via repeated space characters in ATTLIST.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 2.7.8-147
changelog:
  - CVE-2025-27219: cgi dos via super-linear CGI::Cookie.parse cookie merge.
  - CVE-2025-27220: cgi redos in CGI::Util#escapeElement element matcher.
  - CVE-2025-61594: uri password leak when combining URIs (CVE-2025-27221 bypass).


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 2.7.8-148
changelog:
  - CVE-2023-28755: uri redos in the vendored Bundler::URI RFC3986 parser. The
    same patch also carries the CVE-2023-36617 follow-up hardening (upstream
    ruby/uri 9d7bcef, 9010ee2): the rfc3986 PORT and rfc2396 ABS_URI / REL_URI
    leading quantifiers become possessive in every uri copy. No ELSLANG ticket
    exists for CVE-2023-36617, so it is not listed as a tracked id.
  - CVE-2024-27280: stringio buffer over-read in ungetc/ungetbyte.
  - CVE-2024-27281: rdoc code execution via unrestricted yaml and marshal loads.
  - CVE-2024-27282: regexp arbitrary heap read via unbounded reg->dmin.


author: Jarek Prokop <jprokop@redhat.com> - 3.0.2-150
changelog:
  - Upgrade to Ruby 3.0.2.
  - Fix command injection vulnerability in RDoc.
    Resolves: CVE-2021-31799
  - Fix FTP PASV command response can cause Net::FTP to connect to arbitrary host.
    Resolves: CVE-2021-31810
  - Fix StartTLS stripping vulnerability in Net::IMAP.
    Resolves: CVE-2021-32066
  - Fix dependencies of gems with explicit source installed from a different
    source.
    Resolves: CVE-2020-36327


author: Eduard Chiganov <echiganov@cloudlinux.com> - 3.0.4-161
changelog:
  - ALR-153: Updated to 3.0.4
  - Patch 23 (Fix-stack-buffer-overflow) disabled because fixed in upstream.
  - Broken symlink in ruby-libs deleted.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 3.0.7-170
changelog:
  - CVE-2024-35176: rexml dos via many less-than characters in an attribute value.
  - CVE-2024-39908: rexml redos via repeated zeros in a character reference.


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 3.0.7-172
changelog:
  - CVE-2025-27219: cgi DoS via super-linear cookie merge in CGI::Cookie.parse.
  - CVE-2025-27220: cgi ReDoS in CGI::Util#escapeElement / #unescapeElement.
  - CVE-2025-61594: uri credential leak when combining URIs with + (CVE-2025-27221 bypass).


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 3.1.7-10
changelog:
  - CVE-2025-58767: rexml denial of service via multiple xml declarations
  - CVE-2026-27820: fix heap buffer overflow in Zlib::GzipReader#ungetc by making
    the gzip output buffer expansion unconditional in zstream_buffer_ungets()


author: Juan Carlos Garcia <jgarcia@cloudlinux.com> - 3.1.7-11
changelog:
  - CVE-2025-61594: fix credential leak in bundled uri library when combining
    URIs with + / merge (set_userinfo/set_user/host=/port= clearing and atomic
    authority replacement in lib/uri/generic.rb); backport of upstream uri 0.12.5


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 1.0.0-1
changelog:
  - Pin $releasever to the EL major version in the repo file to avoid HTTP 404
    on point-release hosts where $releasever resolves to e.g. 7.9


author: Koba Karaputadze <kkaraputadze@cloudlinux.com> - 1.0.0-2
changelog:
  - Ship alt-ruby-els-rollout.repo with the els-alt-1..6 gradual-rollout slots
    (enabled) and their -bypass counterparts (disabled), so the ALT slot
    rollout reaches clients gradually instead of only at graduation to stable


