Debian Patches
Status for ruby-oj/3.17.7-1
| Patch | Description | Author | Forwarded | Bugs | Origin | Last update |
|---|---|---|---|---|---|---|
| 01_dont_mess_with_loadpath.patch | do not mess with $LOAD_PATH this is not at all needed for the tests | Cédric Boutillier <boutil@debian.org> | not-needed | 2017-09-30 | ||
| 03_find_test_helper.patch | add relative path so that some tests can finally find test/helper.rb | Cédric Boutillier <boutil@debian.org> | not-needed | 2023-06-13 | ||
| CVE-2026-54902-saj2-mark.patch | mark SAJ key-stack entries during GC cache_keys skips rb_gc_mark on the SAJ stack, but keys of CACHE_MAX_KEY (35) bytes or more are not stored in the string cache. Those VALUEs are then collected while close_object still reads them (CVE-2026-54902). Upstream 3.17.2 described this fix and did not change saj2.c. 3.17.6 still has the guard. |
Simon Quigley <tsimonq2@debian.org> | yes | upstream | 2026-09-24 |
All known versions for source package 'ruby-oj'
- 3.17.7-1 (sid, forky)
- 3.16.3-1+deb13u1 (trixie-proposed-updates, trixie-security)
- 3.16.3-1 (trixie)
- 3.14.2-1+deb12u1 (bookworm-security)
- 3.14.2-1 (bookworm)