[DRE-maint] Bug#982552: ruby-carrierwave: CVE-2021-21288

[Pirate Praveen]

On Thu, 11 Feb 2021 18:40:58 +0100 Salvatore Bonaccorso 
<carnil at debian.org> wrote:
 > The following vulnerability was published for ruby-carrierwave.
 >
 > CVE-2021-21288[0]:
 > | CarrierWave is an open-source RubyGem which provides a simple and
 > | flexible way to upload files from Ruby applications. In CarrierWave
 > | before versions 1.3.2 and 2.1.1 the download feature has an SSRF
 > | vulnerability, allowing attacks to provide DNS entries or IP 
addresses
 > | that are intended for internal use and gather information about the
 > | Intranet infrastructure of the platform. This is fixed in versions
 > | 1.3.2 and 2.1.1.

version 1.3.2 needs ruby-ssrf-filter which is still in NEW.