[Git][security-tracker-team/security-tracker][master] Reserve DLA-4716-1 for ruby2.7

[Abhijith PA (@abhijith)]

Abhijith PA pushed to branch master at Debian Security Tracker / security-tracker


Commits:
d45ccec0 by Abhijith PA at 2026-08-04T10:06:03+05:30
Reserve DLA-4716-1 for ruby2.7

- - - - -


3 changed files:

- data/CVE/list
- data/DLA/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
@@ -130998,7 +130998,6 @@ CVE-2025-61594 (URI is a module providing classes to handle Uniform Resource Ide
 	- ruby3.1 <removed>
 	[bookworm] - ruby3.1 <no-dsa> (Minor issue)
 	- ruby2.7 <removed>
-	[bullseye] - ruby2.7 <postponed> (Minor issue, infoleak in specific scenario)
 	- rubygems <unfixed>
 	[trixie] - rubygems <no-dsa> (Minor issue)
 	[bookworm] - rubygems <no-dsa> (Minor issue)
@@ -191802,7 +191801,6 @@ CVE-2025-24294 (The attack vector is a potential Denial of Service (DoS). The vu
 	- ruby3.1 <removed>
 	[bookworm] - ruby3.1 <no-dsa> (Minor issue)
 	- ruby2.7 <removed>
-	[bullseye] - ruby2.7 <postponed> (Minor issue; DoS)
 	NOTE: https://www.ruby-lang.org/en/news/2025/07/08/dos-resolv-cve-2025-24294/
 	NOTE: https://github.com/ruby/resolv/commit/4c2f71b5e80826506f78417d85b38481c058fb25 (v0.6.2)
 	NOTE: https://github.com/ruby/resolv/commit/24ed513f028d8e5c76310fcdecf07f79eb721a32 (v0.3.1)


=====================================
data/DLA/list
=====================================
@@ -1,3 +1,6 @@
+[04 Aug 2026] DLA-4716-1 ruby2.7 - security update
+	{CVE-2025-24294 CVE-2025-61594 CVE-2026-27820 CVE-2026-41316}
+	[bullseye] - ruby2.7 2.7.4-1+deb11u6
 [02 Aug 2026] DLA-4715-1 kissfft - security update
 	{CVE-2025-34297 CVE-2026-41445}
 	[bullseye] - kissfft 131.1.0-1+deb11u1


=====================================
data/dla-needed.txt
=====================================
@@ -788,6 +788,7 @@ ruby2.7/bullseye (Abhijith PA)
   NOTE: 20260608: https://people.debian.org/~abhijith/upload/ruby2.7_patches/ (abhijith)
   NOTE: 20260731: Prepared an upload with already triaged issues. Group Net::IMAP issues
   NOTE: 20260731: and do upload later (abhijith)
+  NOTE: 20260804: Uploaded 2.7.4-1+deb11u6 and released DLA-4716-1 (abhijith)
 --
 ruby3.1/bookworm
   NOTE: 20260713: Added by Front-Desk (Beuc)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d45ccec037f42efbe3cd9c95579d0b3581fb5418

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/d45ccec037f42efbe3cd9c95579d0b3581fb5418
You're receiving this email because of your account on salsa.debian.org. Manage all notifications: https://salsa.debian.org/-/profile/notifications | Help: https://salsa.debian.org/help


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20260804/8ab608b1/attachment.htm>