[Secure-testing-commits] [Git][security-tracker-team/security-tracker][master] 4 commits: jruby 1.5.6-5 vulnerable to CVE-2018-1000074

[Chris Lamb]

Chris Lamb pushed to branch master at Debian Security Tracker / security-tracker


Commits:
4fe929ed by Chris Lamb at 2018-04-02T08:47:16+01:00
jruby 1.5.6-5 vulnerable to CVE-2018-1000074

- - - - -
c5c89f2c by Chris Lamb at 2018-04-02T08:47:54+01:00
Triage jruby for LTS

- - - - -
759dc058 by Chris Lamb at 2018-04-02T08:48:03+01:00
Triage rubygems for LTS

- - - - -
8cb9f6ab by Chris Lamb at 2018-04-02T08:51:03+01:00
data/dla-needed.txt: Add note for ruby 1.9.1.

- - - - -


2 changed files:

- data/CVE/list
- data/dla-needed.txt


Changes:

=====================================
data/CVE/list
=====================================
--- a/data/CVE/list
+++ b/data/CVE/list
@@ -4986,7 +4986,7 @@ CVE-2018-1000074 (RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 
 	- ruby2.1 <removed>
 	- ruby1.9.1 <removed>
 	- rubygems <removed>
-	- jruby <unfixed>
+	- jruby 1.5.6-5
 	NOTE: https://github.com/rubygems/rubygems/commit/254e3d0ee873c008c0b74e8b8abcbdab4caa0a6d
 	NOTE: https://www.ruby-lang.org/en/news/2018/02/17/multiple-vulnerabilities-in-rubygems/
 CVE-2018-1000073 (RubyGems version Ruby 2.2 series: 2.2.9 and earlier, Ruby 2.3 series: ...)


=====================================
data/dla-needed.txt
=====================================
--- a/data/dla-needed.txt
+++ b/data/dla-needed.txt
@@ -43,6 +43,8 @@ ipython
   NOTE: with untrusted content and upgrade to Jessie. Please double-check all
   NOTE: this.
 --
+jruby
+--
 krb5
   NOTE: lts-do-not-call
   NOTE: Details not public. Yet. See https://lists.debian.org/msgid-search/20180208212643.GB7792@pisco.westfalen.local
@@ -105,6 +107,9 @@ qemu-kvm
 ruby-rack-protection
 --
 ruby1.9.1 (Santiago R.R.)
+  NOTE: 20180402: Also vulnerable to CVE-2018-1000074. (lamby)
+--
+rubygems
 --
 sam2p (Markus Koschany)
 --



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/compare/3c0e1137d4a270e2fdce7e4194ee05569fb02c9e...8cb9f6ab13f459aae9cd2d8c76ce59ac84457a70

---
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/compare/3c0e1137d4a270e2fdce7e4194ee05569fb02c9e...8cb9f6ab13f459aae9cd2d8c76ce59ac84457a70
You're receiving this email because of your account on salsa.debian.org.
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://lists.alioth.debian.org/pipermail/secure-testing-commits/attachments/20180402/b9aa1e12/attachment.html>