[PA-4364] Bump puppet-runtime's Ruby to 2.7.6 and apply patch to Ruby 2.5.9 - Puppet Jira Server

XML

Word

Printable

Release Notes:
Security Fix
Release Notes Summary:

Hide
For puppet-agent 7.x, we have bumped Ruby to 2.7.6, that contains the fix for CVE-2022-28739.
For puppet-agent 6.x, Ruby 2.5.9 is EOL and didn't get an official fix, but we were able to apply the patch, Ruby SHA that was applied to 2.5.9 is 1cc5567b46249e6b4bd2dd3cfdd348ab885f59e3.

Show
For puppet-agent 7.x, we have bumped Ruby to 2.7.6, that contains the fix for CVE-2022-28739. For puppet-agent 6.x, Ruby 2.5.9 is EOL and didn't get an official fix, but we were able to apply the patch, Ruby SHA that was applied to 2.5.9 is 1cc5567b46249e6b4bd2dd3cfdd348ab885f59e3.

A new vulnerability, CVE-2022-28739, was just announced that affects Ruby 2.7.5. We need to jump to the latest version 2.7.6.