Skip to content

[AutoPR- Security] Patch rubygem-rubyzip for CVE-2026-85396 [HIGH] #18719

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Draft
Azure Linux Security Servicing Account (azurelinux-security) wants to merge 1 commit into
base: fasttrack/3.0
Choose a base branch
from
+46 −1
Draft

[AutoPR- Security] Patch rubygem-rubyzip for CVE-2026-85396 [HIGH] #18719

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
40 changes: 40 additions & 0 deletions SPECS/rubygem-rubyzip/CVE-2026-85396.patch
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,40 @@
From 4bb8bb68203b3da8658a055c1cca1d0e7f6d1164 Mon Sep 17 00:00:00 2001
From: AllSpark <allspark@microsoft.com>
Date: Mon, 7 Sep 2026 04:43:50 +0000
Subject: [PATCH] Prevent entries from being extracted outside specified
directory.

Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
Upstream-reference: AI Backport of https://github.com/rubyzip/rubyzip/commit/17edfbf4423b83211b075acc23a7d8640da63449.patch
---
test/data/path_traversal/out_evil.zip | Bin 0 -> 294 bytes
test/path_traversal_test.rb | 2 ++
2 files changed, 2 insertions(+)
create mode 100644 test/data/path_traversal/out_evil.zip

diff --git a/test/data/path_traversal/out_evil.zip b/test/data/path_traversal/out_evil.zip
new file mode 100644
index 0000000000000000000000000000000000000000..e99f4d92dcc8b6d619f2b4b81d6ddb18f0d175aa
GIT binary patch
literal 294
zcmWIWW@Zs#0D=B#r((biD8U1y_4M@fOH1NY%QAEH1Ar=ZfnpqBl_hIdKl%>^5)2|J
zDwB#*6SIN(^hzp97#Rc@*q|nIKxuESQ|JB8GBX5tGcuVl<F*~7oDqoMI)YfJZUO1U
j?HZ7Jkj^EIT4*{6xh=q(73^Fl1}26nK)p3U%)kHu3Oht(

literal 0
HcmV?d00001

diff --git a/test/path_traversal_test.rb b/test/path_traversal_test.rb
index 47c7e30..ab457d9 100644
--- a/test/path_traversal_test.rb
+++ b/test/path_traversal_test.rb
@@ -171,4 +171,6 @@ class PathTraversalTest < MiniTest::Test
assert File.exist?('~tilde~')
end
end
+
+
end
--
2.45.4

7 changes: 6 additions & 1 deletion SPECS/rubygem-rubyzip/rubygem-rubyzip.spec
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -3,13 +3,14 @@
Summary: a ruby module for reading and writing zip files
Name: rubygem-%{gem_name}
Version: 2.3.2
Release: 1%{?dist}
Release: 2%{?dist}
License: MIT
Vendor: Microsoft Corporation
Distribution: Azure Linux
Group: Development/Languages
URL: https://github.com/rubyzip/rubyzip
Source0: https://github.com/rubyzip/rubyzip/archive/refs/tags/v%{version}.tar.gz#/%{gem_name}-%{version}.tar.gz
Patch0: CVE-2026-85396.patch
BuildRequires: git
BuildRequires: ruby
Provides: rubygem(%{gem_name}) = %{version}-%{release}
Expand All @@ -19,6 +20,7 @@ Rubyzip is a ruby library for reading and writing zip files.

%prep
%setup -q -n %{gem_name}-%{version}
%patch 0 -p1

%build
gem build %{gem_name}
Expand All @@ -31,6 +33,9 @@ gem install -V --local --force --install-dir %{buildroot}/%{gemdir} %{gem_name}-
%{gemdir}

%changelog
* Mon Sep 07 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 2.3.2-2
- Patch for CVE-2026-85396

* Thu Nov 02 2023 CBL-Mariner Servicing Account <cblmargh@microsoft.com> - 2.3.2-1
- Auto-upgrade to 2.3.2 - Azure Linux 3.0 - package upgrades

Expand Down
Loading