* SECURITY UPDATE: uri ReDoS in the RFC3986 and RFC2396 parsers - debian/patches/CVE-2023-28755.patch: clamp the greedy quantifiers of RFC3986_URI and RFC3986_relative_ref in lib/uri/rfc3986_parser.rb to possessive ones (17 * -> *+, 9 + -> ++), so a crafted URI such as URI.parse('https://example.com/dir/' + 'a' * 80000 + '/##.jpg') no longer backtracks quadratically, and add the (?: ) group around IPv6address/IPvFuture that RFC3986_relative_ref was missing. Backport of upstream ruby/uri 37770c2 and 17861a5 (uri 0.10.0.1). The same patch also carries the CVE-2023-36617 follow-up, which upstream describes as existing "because of an incomplete fix for CVE-2023-28755": the two leading quantifiers the original fix left greedy, one in each parser. In lib/uri/rfc3986_parser.rb the whitespace run of the PORT component regexp of RFC3986_Parser#default_regexp is clamped to a possessive quantifier, and in lib/uri/rfc2396_parser.rb the leading '\A\s*' of the ABS_URI and REL_URI patterns built by RFC2396_Parser#initialize_regexp becomes '\A\s*+', so URI.parse('http://my.example.com').port = "\t" * 8000 + 'a' and URI::RFC2396_Parser.new.split(' ' * 8000 + "\0") no longer backtrack quadratically either. Backport of upstream ruby/uri 9010ee2 and 9d7bcef, folded into the same patch since upstream never ships one parser's fix without the other's and both are the same defect class; the patch header records the full provenance. This tree has a single uri copy (pre-gemified, no bundler-vendored copy) and it is now hardened in both parsers; no vendored version string is touched. - CVE-2023-28755 - CVE-2023-36617 * SECURITY UPDATE: stringio buffer overread in ungetc/ungetbyte - debian/patches/CVE-2024-27280.patch: in ext/stringio/stringio.c, strio_unget_bytes() computed the string growth as cl+rest when the position is at or past the end, so rb_str_set_len() declared cl+pos valid bytes while only cl were written and the tail of the returned String exposed stale heap contents. Grow by cl - (rest < 0 ? pos : len) instead. Backport of upstream ruby/stringio a35268a (stringio 3.0.1.1). - CVE-2024-27280 * SECURITY UPDATE: rdoc code execution via .rdoc_options and ri cache - debian/patches/CVE-2024-27281.patch: RDoc::RDoc#load_options read ./.rdoc_options with YAML.load_file and RDoc::Store loaded the ri cache with a bare Marshal.load, so a crafted project directory or ri cache instantiated arbitrary objects. Load the options file with YAML.safe_load(permitted_classes: [RDoc::Options, Symbol]) and pass a MarshalFilter proc to Marshal.load that only admits plain data types and RDoc's own classes. Backport of upstream ruby/rdoc 32ff6ba0, 60a6d74e and a5de13bf (rdoc 6.3.4 + 6.3.4.1), with safe_load_file expressed as safe_load(File.read(...)) because psych 3.1.0 has no safe_load_file. - CVE-2024-27281 * SECURITY UPDATE: regexp arbitrary heap read in Onigmo search - debian/patches/CVE-2024-27282.patch: onig_search() clamps reg->dmax to the end of the subject but not reg->dmin, so forward_search_range() (p += reg->dmin) and backward_search_range() (range += reg->dmin) could scan for the exact/map target past the end of the subject buffer. Reject the search when reg->dmin exceeds the subject length. Backport of upstream ruby/ruby 33e5b47c (Ruby 3.0.7). - CVE-2024-27282