Skip to content

[AutoPR- Security] Patch ruby for CVE-2025-61594 [LOW]#15436

Merged
kgodara912 merged 3 commits intomicrosoft:3.0-devfrom
azurelinux-security:azure-autosec/ruby/3.0/1018930
Jan 22, 2026
Merged

[AutoPR- Security] Patch ruby for CVE-2025-61594 [LOW]#15436
kgodara912 merged 3 commits intomicrosoft:3.0-devfrom
azurelinux-security:azure-autosec/ruby/3.0/1018930

Conversation

@azurelinux-security
Copy link
Contributor

@azurelinux-security azurelinux-security commented Jan 5, 2026 •
edited
Loading

Auto Patch ruby for CVE-2025-61594.

Autosec pipeline run -> https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1018930&view=results

Merge Checklist

All boxes should be checked before merging the PR (just tick any boxes which don't apply to this PR)

  • The toolchain has been rebuilt successfully (or no changes were made to it)
  • The toolchain/worker package manifests are up-to-date
  • Any updated packages successfully build (or no packages were changed)
  • Packages depending on static components modified in this PR (Golang, *-static subpackages, etc.) have had their Release tag incremented.
  • Package tests (%check section) have been verified with RUN_CHECK=y for existing SPEC files, or added to new SPEC files
  • All package sources are available
  • cgmanifest files are up-to-date and sorted (./cgmanifest.json, ./toolkit/scripts/toolchain/cgmanifest.json, .github/workflows/cgmanifest.json)
  • LICENSE-MAP files are up-to-date (./LICENSES-AND-NOTICES/SPECS/data/licenses.json, ./LICENSES-AND-NOTICES/SPECS/LICENSES-MAP.md, ./LICENSES-AND-NOTICES/SPECS/LICENSE-EXCEPTIONS.PHOTON)
  • All source files have up-to-date hashes in the *.signatures.json files
  • sudo make go-tidy-all and sudo make go-test-coverage pass
  • Documentation has been updated to match any changes to the build system
  • Ready to merge
Summary

What does the PR accomplish, why was it needed?

Change Log
Does this affect the toolchain?

YES/NO

Associated issues
  • N/A
Links to CVEs
Test Methodology

@microsoft-github-policy-service microsoft-github-policy-service bot added Packaging 3.0-dev PRs Destined for AzureLinux 3.0 labels Jan 5, 2026
@Kanishk-Bansal Kanishk-Bansal marked this pull request as ready for review January 5, 2026 13:14
@Kanishk-Bansal Kanishk-Bansal requested a review from a team as a code owner January 5, 2026 13:14
suresh-thelkar
suresh-thelkar requested changes Jan 7, 2026
View reviewed changes
Copy link
Contributor

@suresh-thelkar suresh-thelkar left a comment •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

.

@archana25-ms
Copy link
Contributor

archana25-ms commented Jan 9, 2026

The CVE-2025-61594.patch has been considered from ruby/uri@20157e3 as the uri version in azl 3.0 ruby-3.3.5 is 0.13.1.

@archana25-ms
Copy link
Contributor

archana25-ms commented Jan 9, 2026

Buddy Build link: https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1023027&view=results

Buddy Build result is successful

@suresh-thelkar
Copy link
Contributor

suresh-thelkar commented Jan 19, 2026

The CVE-2025-61594.patch has been considered from ruby/uri@20157e3 as the uri version in azl 3.0 ruby-3.3.5 is 0.13.1.

One missing closing parenthesis in test file (line with assert_equal(u0, u1) - this appears to be a typo in the PR patch display. Please fix it. Rest all looks good.

@suresh-thelkar
Copy link
Contributor

suresh-thelkar commented Jan 19, 2026

Here is the latest buddy build - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1029813&view=results

@archana25-ms
Copy link
Contributor

archana25-ms commented Jan 19, 2026

Here is the latest buddy build - https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1029813&view=results

Latest Buddy build link : https://dev.azure.com/mariner-org/mariner/_build/results?buildId=1029849&view=results

Buddy build is successful.

suresh-thelkar
suresh-thelkar approved these changes Jan 19, 2026
View reviewed changes
Copy link
Contributor

@suresh-thelkar suresh-thelkar left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for making the code changes. I sign off.

@Kanishk-Bansal Kanishk-Bansal added the ready-for-stable-review PR has passed initial review and is now ready for a second-level stable maintainer review label Jan 20, 2026
kgodara912
kgodara912 approved these changes Jan 22, 2026
View reviewed changes
Copy link
Contributor

@kgodara912 kgodara912 left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Buddy build is successful. Patch matches with upstream reference. LGTM.

@kgodara912 kgodara912 merged commit cabd233 into microsoft:3.0-dev Jan 22, 2026
17 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@suresh-thelkar suresh-thelkar suresh-thelkar approved these changes

@kgodara912 kgodara912 kgodara912 approved these changes

Assignees

No one assigned

Labels

3.0-dev PRs Destined for AzureLinux 3.0 AutoPR-Security Packaging ready-for-stable-review PR has passed initial review and is now ready for a second-level stable maintainer review security

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@azurelinux-security @archana25-ms @suresh-thelkar @kgodara912 @Kanishk-Bansal