[AutoPR- Security] Patch ruby for CVE-2026-82455 [MEDIUM]

SPECS/ruby/CVE-2026-82455.patch

@@ -0,0 +1,95 @@
+From 3e36af2f65f2a752cad4a47f4f12bac017d682bd Mon Sep 17 00:00:00 2001
+From: thesmartshadow <firaswq12@gmail.com>
+Date: Sun, 19 Apr 2026 02:20:37 +0300
+Subject: [PATCH 1/2] Prevent symlink-based escape during gem extraction
+
+---
+ lib/rubygems/package.rb           |  5 +++++
+ test/rubygems/test_gem_package.rb | 27 +++++++++++++++++++++++++++
+ 2 files changed, 32 insertions(+)
+
+diff --git a/lib/rubygems/package.rb b/lib/rubygems/package.rb
+index c855423..ac0d60e 100644
+--- a/lib/rubygems/package.rb
++++ b/lib/rubygems/package.rb
+@@ -450,6 +450,11 @@ EOM
+           directories << mkdir
+         end
+
++        real_mkdir = File.realpath(mkdir)
++        unless real_mkdir == destination_dir || normalize_path(real_mkdir).start_with?(normalize_path(destination_dir + "/"))
++          raise Gem::Package::PathError.new(real_mkdir, destination_dir)
++        end
++
+         if entry.file?
+           File.open(destination, "wb") {|out| copy_stream(entry, out) }
+           FileUtils.chmod file_mode(entry.header.mode) & ~File.umask, destination
+diff --git a/test/rubygems/test_gem_package.rb b/test/rubygems/test_gem_package.rb
+index 2065864..f6b1983 100644
+--- a/test/rubygems/test_gem_package.rb
++++ b/test/rubygems/test_gem_package.rb
+@@ -574,6 +574,33 @@ class TestGemPackage < Gem::Package::TarTestCase
+                  File.read(extracted)
+   end
+
++
++  def test_extract_tar_gz_rejects_preexisting_symlink_escape
++    omit "Symlinks not supported or not enabled" unless symlink_supported?
++
++    package = Gem::Package.new @gem
++
++    tgz_io = util_tar_gz do |tar|
++      tar.add_file "lib/owned.txt", 0o644 do |io|
++        io.write "poc-content"
++      end
++    end
++
++    escape_dir = File.join(@tempdir, "escape")
++    FileUtils.mkdir_p escape_dir
++
++    FileUtils.rm_rf File.join(@destination, "lib")
++    File.symlink escape_dir, File.join(@destination, "lib")
++
++    escaped = File.join(escape_dir, "owned.txt")
++
++    assert_raise Gem::Package::PathError do
++      package.extract_tar_gz tgz_io, @destination
++    end
++
++    refute File.exist?(escaped), "must not write outside extraction root via symlink"
++  end
++
+   def test_extract_symlink_into_symlink_dir
+     package = Gem::Package.new @gem
+     tgz_io = util_tar_gz do |tar|
+-- 
+2.45.4
+
+
+From 7fdc1e6d1a4f7c9cf84c7ff537bd7f6318cd558c Mon Sep 17 00:00:00 2001
+From: "Ali Firas (thesmartshadow)" <firaswq12@gmail.com>
+Date: Sat, 2 May 2026 01:09:39 +0300
+Subject: [PATCH 2/2] Potential fix for pull request finding
+
+Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
+Signed-off-by: Azure Linux Security Servicing Account <azurelinux-security@microsoft.com>
+Upstream-reference: https://github.com/ruby/rubygems/commit/103ca4230deacb31b9fcd813de109e83b5fc71ac.patch
+---
+ test/rubygems/test_gem_package.rb | 1 -
+ 1 file changed, 1 deletion(-)
+
+diff --git a/test/rubygems/test_gem_package.rb b/test/rubygems/test_gem_package.rb
+index f6b1983..ea066bf 100644
+--- a/test/rubygems/test_gem_package.rb
++++ b/test/rubygems/test_gem_package.rb
+@@ -574,7 +574,6 @@ class TestGemPackage < Gem::Package::TarTestCase
+                  File.read(extracted)
+   end
+
+-
+   def test_extract_tar_gz_rejects_preexisting_symlink_escape
+     omit "Symlinks not supported or not enabled" unless symlink_supported?
+
+-- 
+2.45.4
+

SPECS/ruby/ruby.spec

@@ -87,7 +87,7 @@ Name:           ruby
 # provides should be versioned according to the ruby version.
 # More info: https://stdgems.org/
 Version:        %{ruby_version}
-Release:        9%{?dist}
+Release:        10%{?dist}
 License:        (Ruby OR BSD) AND Public Domain AND MIT AND CC0 AND zlib AND UCD
 Vendor:         Microsoft Corporation
 Distribution:   Azure Linux
@@ -116,6 +116,7 @@ Patch9:         CVE-2025-61594.patch
 Patch10:        CVE-2026-27820.patch
 Patch11:        CVE-2026-80212.patch
 Patch12:        CVE-2026-80213.patch
+Patch13:        CVE-2026-82455.patch
 BuildRequires:  openssl-devel
 # Pkgconfig(yaml-0.1) is needed to build the 'psych' gem.
 BuildRequires:  pkgconfig(yaml-0.1)
@@ -420,6 +421,9 @@ sudo -u test make test TESTS="-v"
 %{_rpmconfigdir}/rubygems.con
 
 %changelog
+* Mon Sep 07 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.3.5-10
+- Patch for CVE-2026-82455
+
 * Mon Aug 31 2026 Azure Linux Security Servicing Account <azurelinux-security@microsoft.com> - 3.3.5-9
 - Patch for CVE-2026-80213, CVE-2026-80212