Mitigates the following vulnerabilities:
- CVE-2019-16255: A code injection vulnerability of Shell#[] and
Shell#test
- CVE-2019-16254: HTTP response splitting in WEBrick (Additional fix)
- CVE-2019-15845: A NUL injection vulnerability of File.fnmatch and
File.fnmatch?
- CVE-2019-16201: Regular Expression Denial of Service vulnerability
of WEBrick’s Digest access authentication
This also adjusts Bundler to be explicitly fixed at either 1.17.2 or the Ruby/Rubygems-bundled version, whichever is newer -- this is slightly older than what we've already pushed (1.17.3), but nothing in the changelog appears to be relevant, so this seems fine: https://github.com/bundler/bundler/compare/v1.17.2...v1.17.3#diff-4ac32a78649ca5bdd8e0ba38b7006a1e
For Ruby 2.6, this means we no longer do anything to the bundled Rubygems (or Bundler), and simply provide whatever comes with the Ruby release as-is, and it is now up to users to explicitly update if they need a newer version than is provided here.