Bug #20385: Backport CVE-2024-27280

• Status: Closed
• Assignee: -
• Target version: -
• Backport: 3.0: DONE, 3.1: DONE, 3.2: DONTNEED, 3.3: DONTNEED

[hsbt (Hiroshi SHIBATA)]

I disclosed https://www.ruby-lang.org/en/news/2024/03/21/buffer-overread-cve-2024-27280/ today.

This StringIO versions should be backported in the next release.

• For Ruby 3.0: https://github.com/ruby/ruby/pull/10320
• For Ruby 3.1: https://github.com/ruby/ruby/pull/10321

[hsbt (Hiroshi SHIBATA)]

• Backport changed from 3.0: REQUIRED, 3.1: REQUIRED, 3.2: DONTNEED, 3.3: DONTNEED to 3.0: DONE, 3.1: DONE, 3.2: DONTNEED, 3.3: DONTNEED