Open Source

For our first sponsored contribution time, we will be focusing on efforts to improve the usability of Drupal’s administration UI. We chose this because there are some deliverables we beleive we can achieve within six months that will make Drupal better and benefit our existing clients.

This is not Ruby-specific, but if you are creating a GitHub repo for your next Ruby project, you’ll want to review the following best practices: Improve your GitHub workflow with better repository defaults. Includes a quick introduction to some interesting low-level features of the gh CLI.

We have released the uri gem version 0.12.2, 0.10.3 that has a security fix for a ReDoS vulnerability.
This vulnerability has been assigned the CVE identifier CVE-2023-36617.

Details

A ReDoS issue was discovered in the URI component through 0.12.1 for Ruby. The URI parser mishandles invalid URLs that have specific characters. There is an increase in execution time for parsing strings to URI objects with rfc2396_parser.rb and rfc3986_parser.rb.

NOTE: this issue exists becuse of an incomplete fix for CVE-2023-28755.

The uri gem version 0.12.1 and all versions prior 0.12.1 are vulnerable for this vulnerability.

Recommended action

We recommend to update the uri gem to 0.12.2. In order to ensure compatibility with bundled version in older Ruby series, you may update as follows instead:

• For Ruby 3.0: Update to uri 0.10.3
• For Ruby 3.1 and 3.2: Update to uri 0.12.2

You can use gem update uri to update it. If you are using bundler, please add gem "uri", ">= 0.12.2" (or other version mentioned above) to your Gemfile.

Affected versions

• uri gem 0.12.1 or before

Credits

Thanks to ooooooo_q for discovering this issue.

Thanks to nobu for fixing this issue.

History

• Originally published at 2023-06-29 01:00:00 (UTC)

Posted by hsbt on 29 Jun 2023

We are happy to announce the publication on “Practical Offline Payments Using One-Time Passcodes” by The European Money and Finance Forum.

This is a wee operating system written to support the async style of programming in Rust on microcontrollers. It fits in about 2 kiB of Flash and uses about 20 bytes of RAM (before your tasks are added). In that space, you get a full async runtime with multiple tasks, support for complex concurrency via join and select, and a lot of convenient but simple APIs. I understood some of those words.