Issue #22317 has been reported by mtasaka (Mamoru TASAKA). ---------------------------------------- Bug #22317: Also update lib/rubygems/vendor/resolv/lib/resolv.rb for CVE issue?? https://bugs.ruby-lang.org/issues/22317 * Author: mtasaka (Mamoru TASAKA) * Status: Open * ruby -v: 4.0.7 * Backport: 3.3: UNKNOWN, 3.4: UNKNOWN, 4.0: UNKNOWN ---------------------------------------- Recently two CVE security issues are reported against resolv gem, and looks like fixed resolv 0.7.2 was pushed into ruby_4_0 branch: https://github.com/ruby/ruby/commit/2da9a6ef3f423fb85acfd5c41150bb22cdeb14ef which updates lib/resolv.rb in ruby tree, which is finally included in released ruby 4.0.7 tarball. However, there is another "resolv.rb" under lib/rubygems/vendor/resolv/lib/ in ruby 4.0.7 "tarball" and it says the version is still 0.7.0, so looks like this is still affected by CVE issue. https://github.com/ruby/ruby/blob/v4.0.7/lib/rubygems/vendor/resolv/lib/reso... So propably the above file also needs updating?? -- https://bugs.ruby-lang.org/