search

phusion / passenger-docker

Docker base images for Ruby, Python, Node.js and Meteor web apps
MIT License
2.78k stars 408 forks source link

Ruby upgrades for CVE-2023-28755 and CVE-2023-28756 #364

Closed ajhodgson closed 1 year ago

ajhodgson commented 1 year ago

Upgrade to Ruby 2.7.8 Upgrade to Ruby 3.0.6 Upgrade to Ruby 3.1.4 Upgrade to Ruby 3.2.2

CVE-2023-28755: ReDoS vulnerability in URI CVE-2023-28756: ReDoS vulnerability in Time

I would ask that you please merge https://github.com/phusion/passenger-docker/pull/359 and then let me rebase this before merging. We should not release any more Ruby 3.2 images without ensuring ruby is compiled with YJIT enabled.

ajhodgson commented 1 year ago

The failing tests seem to be while downloading rvm; probably rate-limiting or something? Not caused by this PR.

mathieujobin commented 1 year ago

not a rate-limiting, but sometthing weird with rvm indead... maybe hit restart on the job once...

filename is blank on the download url, see screenshot.

image

ajhodgson commented 1 year ago

Yeah my other PR had the same problem on some tests. Can't duplicate locally.

krasnoukhov commented 1 year ago

Is this going to be merged any time soon? Pretty important to get security fixes in...

krasnoukhov commented 1 year ago

cc @CamJN

krasnoukhov commented 1 year ago

Thanks for merging @CamJN, are you going to publish this to docker hub?

CamJN commented 1 year ago

@krasnoukhov i plan to, but building the images is very slow and there were some failures yesterday, so we'll see if it finishes successfully today.

krasnoukhov commented 1 year ago

Appreciate it @CamJN!

CamJN commented 1 year ago

release is pushed

krasnoukhov commented 1 year ago

Thanks @CamJN, appreciate it! Have a good one