Upgrade Ruby version 2.4.9 to 2.4.10, 2.5.7 to 2.5.8, 2.6.5 to 2.6.6, 2.7.0 to 2.7.1

[nehresma]

A security advisory with subsequent fixed Ruby version upgrades was just released. Bumping Ruby versions addresses the following CVEs:

CVE-2020-10933: Heap exposure vulnerability in the socket library
https://www.ruby-lang.org/en/news/2020/03/31/heap-exposure-in-socket-cve-2020-10933/

CVE-2020-10663: Unsafe Object Creation Vulnerability in JSON (Additional fix)
https://www.ruby-lang.org/en/news/2020/03/19/json-dos-cve-2020-10663/

[nehresma]

Shoot, the SHA-256 hash values in that commit are for the .tar.gz files. Fixing to use .tar.xz SHA-256 hashes. Commit coming momentarily.

[nehresma]

I triple checked the hash values from the following sources:

https://www.ruby-lang.org/en/news/2020/03/31/ruby-2-4-10-released/
https://www.ruby-lang.org/en/news/2020/03/31/ruby-2-5-8-released/
https://www.ruby-lang.org/en/news/2020/03/31/ruby-2-6-6-released/
https://www.ruby-lang.org/en/news/2020/03/31/ruby-2-7-1-released/

If someone else wants to sanity check me that'd be great.

[tianon]

For some reason, Travis is failing to report back to GitHub about builds recently -- the build is started over at https://travis-ci.org/github/docker-library/ruby/builds/669267136

As for double checking the SHA values, I pulled this locally so I could run ./update.sh on it, and the SHA values are correct but there are a few files that got missed:

• 2.4/buster/slim/Dockerfile
• 2.4/stretch/slim/Dockerfile
• 2.5/buster/slim/Dockerfile
• 2.5/stretch/slim/Dockerfile
• 2.6/buster/slim/Dockerfile
• 2.6/stretch/slim/Dockerfile
• 2.7/buster/slim/Dockerfile

[nehresma]

Thanks for the sanity check @tianon. I've updated the missed files too.

[tianon]

Nice, Travis is green too! 👍