Hello Simon,
On 27/09/2026 01:49, Simon Quigley wrote:
I am a member of the Debian Ruby Team, and this is my first time
attempting an LTS update. I have claimed ruby-oj in dla-needed.txt, per
the guide. Bookworm has 3.14.2-1, which is still affected by the memory-
safety bugs fixed upstream in ruby-oj 3.17.2 and 3.17.3. I backported
the same two patches from the trixie-security upload, which is currently
pending, but has been approved by the Security Team. The debdiff against
3.14.2-1 is attached; I have not uploaded it.
The patches are CVE-2026-oj-security-ec368db.patch (the 3.17.2 batch,
CVE-2026-54502 and CVE-2026-54896 through CVE-2026-54903) and CVE-2026-
oj-security-bbde91a.patch (CVE-2026-54500 and CVE-2026-54592). The first
one also includes the saj2.c key-stack mark. Upstream's 3.17.2 commit
describes that fix but never actually changes saj2.c, so I folded it in,
same as Trixie.
I also ran all 11 upstream proof of concepts against the archive package
and against this build. The archive package hits every one of them, this
package does not, and ordinary load/dump still works.
Salsa CI has passed: https://salsa.debian.org/ruby-team/ruby-oj/-/
pipelines/1177811
You can find built debs here: https://people.debian.org/~tsimonq2/ruby-
oj-3.14.2-1+deb12u1/
Feedback is welcome. I plan on uploading this on 2026-09-30, very early
UTC. If I should just go ahead, let me know.
Thanks for DLA-4803-1, this is all very good :)
For a library like ruby-oj, I would also recommend to test reverse
dependencies (only 2 packages in bookworm). The "Reverse-dependencies"
bit from
https://lts-team.pages.debian.net/wiki/Development.html#test-the-update
has some pointers if needed.
Cheers!
Sylvain Beucler
Debian LTS Team
