Happy Thursday Everyone! This week, we have patch releases to address various CVEs in upstream components. First up,

openvox-agent

8.31.2 which contains the following fixes: • Flaws in the Ruby 3.2 regular expression parser, surfaced last week in the news around GitLab, have been addresed with patches back-ported from Ruby 3.3.13 (thanks RedHat!) • Six CVEs announced at the end of September that affected OpenSSL 3.0 have been addressed with patches back-ported from Debian 12. Additionally, there are 8.17.1 and 9.1.1 releases of

openvox-server

and

openvoxdb

which contain the following fixes: • An upgrade to version 2.2.8 of the JRuby

joni

regular expression library, to address runaway memory use from the same parsing issues that were found in CRuby. • Upgrades to Jackson 2.21.8 to address various CVEs, including a potential RCE in XML de-serialization. • Ugrades to Jetty 2.1.14 to address various CVEs. Thanks a bunch to @ehelms for putting together the Ruby 3.2 regex patch set, and to Masthan Chevuu for bringing the Jackson and Jetty releases to our attention.