[Git][security-tracker-team/security-tracker][master] jruby is fixed in sid, thanks to Jérôme Charaoui

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
151790e8 by Moritz Muehlenhoff at 2024-08-03T12:03:51+02:00
jruby is fixed in sid, thanks to Jérôme Charaoui

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -103819,12 +103819,13 @@ CVE-2023-28756 (A ReDoS issue was discovered in the Time component through 0.2.1
 	- ruby2.7 <removed>
 	- ruby2.5 <removed>
 	[experimental] - jruby 9.4.3.0+ds-1~exp1
-	- jruby <unfixed> (bug #1036283)
+	- jruby 9.4.5.0+ds-1 (bug #1036283)
 	[bookworm] - jruby <no-dsa> (Minor issue)
 	NOTE: Fixed by: https://github.com/ruby/ruby/commit/957bb7cb81995f26c671afce0ee50a5c660e540e (v3_1_4)
 	NOTE: Fixed by: https://github.com/ruby/time/commit/b57db51f577875d3e896dcd2ef1dcaf97f23e943 (v0.2.2)
 	NOTE: Fixed by: https://github.com/ruby/time/commit/3dce6f73d14f5fad6d9b302393fd02df48797b11 (v0.2.2)
 	NOTE: https://www.ruby-lang.org/en/news/2023/03/30/redos-in-time-cve-2023-28756/
+	NOTE: https://github.com/jruby/jruby/commit/36637a1b4e434cbb75c8f87be128b7763cedf99d (9.4.3.0)
 CVE-2023-28755 (A ReDoS issue was discovered in the URI component through 0.12.0 in Ru ...)
 	{DLA-3447-1 DLA-3408-1}
 	- rubygems 3.4.20-1
@@ -103835,12 +103836,13 @@ CVE-2023-28755 (A ReDoS issue was discovered in the URI component through 0.12.0
 	- ruby2.7 <removed>
 	- ruby2.5 <removed>
 	[experimental] - jruby 9.4.3.0+ds-1~exp1
-	- jruby <unfixed> (bug #1036283)
+	- jruby 9.4.5.0+ds-1 (bug #1036283)
 	[bookworm] - jruby <no-dsa> (Minor issue)
 	NOTE: Fixed by: https://github.com/ruby/ruby/commit/8ce4ab146498879b65e22f1be951b25eebb79300 (v3_1_4)
 	NOTE: Fixed by: https://github.com/ruby/uri/commit/eaf89cc31619d49e67c64d0b58ea9dc38892d175 (v0.12.1)
 	NOTE: https://www.ruby-lang.org/en/news/2023/03/28/redos-in-uri-cve-2023-28755/
 	NOTE: Incomplete fix, cf. CVE-2023-36617
+	NOTE: https://github.com/jruby/jruby/commit/7e220403384faef102e838b412b4d1b3a9cfb6ec (9.4.3.0)
 CVE-2023-28754 (Deserialization of Untrusted Data vulnerability in Apache ShardingSphe ...)
 	NOT-FOR-US: Apache ShardingSphere-Agent
 CVE-2023-28753 (netconsd prior to v0.2 was vulnerable to an integer overflow in its pa ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/151790e8632af2c9888f4e9f73bcc3c69a292531

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/151790e8632af2c9888f4e9f73bcc3c69a292531
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20240803/8ac97f2f/attachment.htm>