antifuchs/ruby-build — pull request #1 by antifuchs (2014-02-08 01:33:47+00:00)
Title: Install libyaml 0.1.5 for 2.x rubies also

As reported in #504, the measures to fix CVE-2013-6393 only consistently affect Ruby versions below 2.0 - that is, the ones that had a dependency on libyaml in their build spec - I'm assuming the build specs for 2.0+ didn't include libyaml because it's vendored in. However, when re-installing 2.x MRIs, their build process doesn't consistently pick up any installed libyaml from the environment.

Hence, this pull request to (maybe temporarily?) add libyaml (at 0.1.5) to the packages installed before building on 2.x+.

Hope you'll consider this for inclusion - in our tests, it's reliably fixed the libyaml vulnerability on all the ruby versions we had installed, after a rebuild.