On Thu, 11 Feb 2021 18:40:58 +0100 Salvatore Bonaccorso
<car...@debian.org> wrote:
> The following vulnerability was published for ruby-carrierwave.
>
> CVE-2021-21288[0]:
> | CarrierWave is an open-source RubyGem which provides a simple and
> | flexible way to upload files from Ruby applications. In CarrierWave
> | before versions 1.3.2 and 2.1.1 the download feature has an SSRF
> | vulnerability, allowing attacks to provide DNS entries or IP
addresses
> | that are intended for internal use and gather information about the
> | Intranet infrastructure of the platform. This is fixed in versions
> | 1.3.2 and 2.1.1.
version 1.3.2 needs ruby-ssrf-filter which is still in NEW.
