[Secure-testing-commits] r44180 - data/CVE
Guido Guenther
agx at moszumanska.debian.org
Sat Aug 27 15:01:16 UTC 2016
Author: agx
Date: 2016-08-27 15:01:16 +0000 (Sat, 27 Aug 2016)
New Revision: 44180
Modified:
data/CVE/list
Log:
Mark ruby-activesupport-3.2 as unaffected by CVE-2015-3226
The initial advisiory listed 3.x incorrectly since EscapedString
was introduced past 3.x. Testcase:
https://github.com/rails/rails/pull/26300
Modified: data/CVE/list
===================================================================
--- data/CVE/list 2016-08-27 13:09:18 UTC (rev 44179)
+++ data/CVE/list 2016-08-27 15:01:16 UTC (rev 44180)
@@ -38014,7 +38014,7 @@
[squeeze] - rails <end-of-life> (Unsupported in squeeze-lts)
[wheezy] - rails <not-affected> (Vulnerable code not present, is only a transitional package)
- ruby-activesupport-3.2 <removed>
- [wheezy] - ruby-activesupport-3.2 <end-of-life>
+ [wheezy] - ruby-activesupport-3.2 <not-affected> (Vulnerable code not present)
- ruby-activesupport-2.3 <removed>
[wheezy] - ruby-activesupport-2.3 <end-of-life> (https://lists.debian.org/debian-security-announce/2014/msg00164.html)
CVE-2015-3225 (lib/rack/utils.rb in Rack before 1.5.4 and 1.6.x before 1.6.2, as used ...)
More information about the Secure-testing-commits
mailing list