Simon Quigley pushed to branch master at Debian Security Tracker /
security-tracker
Commits:
691d8f77 by Simon Quigley at 2026-10-08T07:48:17-05:00
rails: mark CVE-2026-33658 and CVE-2026-33174 as not-affected for Bookworm
- - - - -
1 changed file:
- data/CVE/list
Changes:
=====================================
data/CVE/list
=====================================
@@ -179835,7 +179835,7 @@ CVE-2026-33661 (Pay is an open-source payment SDK
extension package for various
CVE-2026-33658 (Active Storage allows users to attach cloud and local files in
Rails a ...)
{DSA-6546-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
- [bookworm] - rails <no-dsa> (Minor issue)
+ [bookworm] - rails <not-affected> (Vulnerable code introduced later;
ActiveStorage::Streaming proxy Range handling added in 7.0)
[bullseye] - rails <postponed> (Minor issue, DoS)
NOTE:
https://github.com/rails/rails/security/advisories/GHSA-p9fm-f462-ggrg
NOTE: Fixed by:
https://github.com/rails/rails/commit/85ec5b1e00d3197d8c69a5e622e1b398a1b10b06
(v8.1.2.1)
@@ -183493,7 +183493,7 @@ CVE-2026-33176 (Active Support is a toolkit of
support libraries and Ruby core e
CVE-2026-33174 (Active Storage allows users to attach cloud and local files in
Rails a ...)
{DSA-6546-1}
- rails 2:7.2.3.1+dfsg-1 (bug #1132035)
- [bookworm] - rails <no-dsa> (Minor issue)
+ [bookworm] - rails <not-affected> (Vulnerable code introduced later;
ActiveStorage::Streaming proxy Range handling added in 7.0)
[bullseye] - rails <postponed> (Minor issue, DoS)
NOTE:
https://github.com/rails/rails/security/advisories/GHSA-r46p-8f7g-vvvg
NOTE: Fixed by:
https://github.com/rails/rails/commit/42012eaaa88dfc7d0030161b2bc8074a7bbce92a
(v8.1.2.1)
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/691d8f77ebd65d17ae02902709887dc4a08974bd
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/691d8f77ebd65d17ae02902709887dc4a08974bd
You're receiving this email because of your account on salsa.debian.org. Manage
all notifications: https://salsa.debian.org/-/profile/notifications | Help:
https://salsa.debian.org/help
_______________________________________________
debian-security-tracker-commits mailing list
[email protected]
https://alioth-lists.debian.net/cgi-bin/mailman/listinfo/debian-security-tracker-commits
