[Git][security-tracker-team/security-tracker][master] new ruby cgi gem issues

[Moritz Muehlenhoff (@jmm)]

Moritz Muehlenhoff pushed to branch master at Debian Security Tracker / security-tracker


Commits:
ae899cdd by Moritz Muehlenhoff at 2025-03-04T12:30:44+01:00
new ruby cgi gem issues

- - - - -


1 changed file:

- data/CVE/list


Changes:

=====================================
data/CVE/list
=====================================
@@ -10,9 +10,19 @@ CVE-2025-27221 (In the URI gem before 1.0.3 for Ruby, the URI handling methods (
 	NOTE: https://github.com/ruby/uri/pull/154
 	NOTE: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/uri/CVE-2025-27221.yml
 CVE-2025-27220 (In the CGI gem before 0.4.2 for Ruby, a Regular Expression Denial of S ...)
-	TODO: check
+	- ruby3.3 <unfixed>
+	- ruby3.1 <unfixed>
+	- ruby2.7 <removed>
+	NOTE: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27220.yml
+	NOTE: https://github.com/ruby/cgi/commit/cd1eb08076c8b8e310d4d553d427763f2577a1b6 (v0.4.2)
+	NOTE: https://github.com/ruby/cgi/pull/52
 CVE-2025-27219 (In the CGI gem before 0.4.2 for Ruby, the CGI::Cookie.parse method in  ...)
-	TODO: check
+	- ruby3.3 <unfixed>
+	- ruby3.1 <unfixed>
+	- ruby2.7 <removed>
+	NOTE: https://github.com/rubysec/ruby-advisory-db/blob/master/gems/cgi/CVE-2025-27219.yml
+	NOTE: https://github.com/ruby/cgi/commit/9907b76dad0777ee300de236dad4b559e07596ab (v0.4.2)
+	NOTE: https://github.com/ruby/cgi/pull/52
 CVE-2025-24309 (in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitr ...)
 	NOT-FOR-US: OpenHarmony
 CVE-2025-24301 (in OpenHarmony v5.0.2 and prior versions allow a local attacker arbitr ...)



View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ae899cdda6c626a7968e241c685b7824535932ce

-- 
View it on GitLab: https://salsa.debian.org/security-tracker-team/security-tracker/-/commit/ae899cdda6c626a7968e241c685b7824535932ce
You're receiving this email because of your account on salsa.debian.org.


-------------- next part --------------
An HTML attachment was scrubbed...
URL: <http://alioth-lists.debian.net/pipermail/debian-security-tracker-commits/attachments/20250304/ea4e753a/attachment.htm>