Chris Lamb pushed to branch master at Debian Security Tracker / security-tracker
Commits:
4fe929ed by Chris Lamb at 2018-04-02T08:47:16+01:00
jruby 1.5.6-5 vulnerable to CVE-2018-1000074
- - - - -
c5c89f2c by Chris Lamb at 2018-04-02T08:47:54+01:00
Triage jruby for LTS
- - - - -
759dc058 by Chris Lamb at 2018-04-02T08:48:03+01:00
Triage rubygems for LTS
- - - - -
8cb9f6ab by Chris Lamb at 2018-04-02T08:51:03+01:00
data/dla-needed.txt: Add note for ruby 1.9.1.
- - - - -
2 changed files:
- data/CVE/list
- data/dla-needed.txt
Changes:
=====================================
data/CVE/list
=====================================
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -4986,7 +4986,7 @@ CVE-2018-1000074 (RubyGems version Ruby 2.2 series: 2.2.9
and earlier, Ruby 2.3
- ruby2.1 <removed>
- ruby1.9.1 <removed>
- rubygems <removed>
- - jruby <unfixed>
+ - jruby 1.5.6-5
NOTE:
https://github.com/rubygems/rubygems/commit/254e3d0ee873c008c0b74e8b8abcbdab4caa0a6d
NOTE:
https://www.ruby-lang.org/en/news/2018/02/17/multiple-vulnerabilities-in-rubygems/
CVE-2018-1000073 (RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby
2.3 series: ...)
=====================================
data/dla-needed.txt
=====================================
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -43,6 +43,8 @@ ipython
NOTE: with untrusted content and upgrade to Jessie. Please double-check all
NOTE: this.
--
+jruby
+--
krb5
NOTE: lts-do-not-call
NOTE: Details not public. Yet. See
https://lists.debian.org/msgid-search/20180208212643.GB7792@pisco.westfalen.local
@@ -105,6 +107,9 @@ qemu-kvm
ruby-rack-protection
--
ruby1.9.1 (Santiago R.R.)
+ NOTE: 20180402: Also vulnerable to CVE-2018-1000074. (lamby)
+--
+rubygems
--
sam2p (Markus Koschany)
--
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/compare/3c0e1137d4a270e2fdce7e4194ee05569fb02c9e...8cb9f6ab13f459aae9cd2d8c76ce59ac84457a70
---
View it on GitLab:
https://salsa.debian.org/security-tracker-team/security-tracker/compare/3c0e1137d4a270e2fdce7e4194ee05569fb02c9e...8cb9f6ab13f459aae9cd2d8c76ce59ac84457a70
You're receiving this email because of your account on salsa.debian.org.
_______________________________________________
Secure-testing-commits mailing list
Secure-testing-commits@lists.alioth.debian.org
http://lists.alioth.debian.org/cgi-bin/mailman/listinfo/secure-testing-commits
