Debian alert DLA-4803-1 (ruby-oj)

From:
             
 
Simon Quigley <simon@tsimonq2.net>
To:
             
 
debian-lts-announce@lists.debian.org
Subject:
             
 
[SECURITY] [DLA-4803-1] ruby-oj security update
Date:
             
 
Wed, 30 Sep 2026 18:22:08 -0500
Message-ID:
             
 
<ar2ZoHqJ_3W1SjkE@starship>
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA256

- -------------------------------------------------------------------------
Debian LTS Advisory DLA-4803-1                debian-lts@lists.debian.org
https://www.debian.org/lts/security/                        Simon Quigley
September 30, 2026                            https://wiki.debian.org/LTS
- -------------------------------------------------------------------------

Package        : ruby-oj
Version        : 3.14.2-1+deb12u1
CVE ID         : CVE-2026-54500 CVE-2026-54502 CVE-2026-54592 CVE-2026-54896
                 CVE-2026-54897 CVE-2026-54898 CVE-2026-54899 CVE-2026-54900
                 CVE-2026-54901 CVE-2026-54902 CVE-2026-54903

Multiple security vulnerabilities were discovered in Oj, a fast JSON
parser and serializer for Ruby, which could result in denial of service
or memory disclosure.

For Debian 12 bookworm, these problems have been fixed in version
3.14.2-1+deb12u1.

We recommend that you upgrade your ruby-oj packages.

For the detailed security status of ruby-oj please refer to
its security tracker page at:
https://security-tracker.debian.org/tracker/ruby-oj

Further information about Debian LTS security advisories, how to apply
these updates to your system, and frequently asked questions can be
found at: https://wiki.debian.org/LTS
-----BEGIN PGP SIGNATURE-----

iQIzBAEBCAAdFiEEXHq+og+GMEWcyMi14n8s+EWML6QFAmq9X+wACgkQ4n8s+EWM
L6ThlQ//cLuXJew6nPTsrFPTTFIDJIWg3rYLpjUh33eHa+V6BWTF0L+NPgpdVNhq
vf9km8QM02JKy1h0HPfc38yvzhE5FCb8H4yGtcL0H6YCmGse4AJcjeekTTdLZNDc
Vp2zxtpLQsS9lZkonuWJVgjDmtryYQFD7qaS5AwIHbx55+e6+sWk5OCA0HM8i5sY
w7qLY6RErVd4z9QNevVC/jANdBnIVOUeKF8wQRHuQQgnzWJ6hpEfQe3YcEQhoZUM
/Iu953SCViRCBx7DR+lx/gIqU+lVU0QcS46bjhnvbltqFbGXvctNyX/Ex63I2NW4
uw0TjNyVJnpwx8HVtjbazxVophCa1J4dcEwPvI2V0rhsDJsOl90sUK0LHMcLJEs3
XhrZVyZaRTCwAcbRRUVDU0mVlCOOcQW1SqOhvrIRYLGwEwZZWUC77Jua9X0b6CMH
d2qCEmQhd8hsQzidCrcgm/zkkF5wlHZwN9vgq6NYPE+k0G9GrQ8WEIeyFrjU/CLu
SWWk5bKSfgVI3uvcrPBWFKQlcq6mZ4ZfxHBXtL4aouGCNLnEEtnzCphyNellGSRM
GQHgk6eaE4YRM2sDBlrSXQufLyzt1IoddNPIZCcZq8Qt1IjGN4L2iidNGp4Lhi33
85DBEi5C+JTZ2SAPAL6Nb1WaYRilEg2e3FiFXEYivzpdBbfsmY0=
=F73z
-----END PGP SIGNATURE-----