Re: rubygems / CVE-2018-1000074
"Santiago R.R." <santiagorr@riseup.net> writes:
> As I said in a previous mail, I think it is a not-so-severe issue (the
> user has to run the `gem owner` command for being exploitable), *and* I
> found it too intrusive to be backported to versions <= 2.2. I.e. it
> depends on a version of ruby's Psych that includes safe_load and all the
> functions it depends on. It is to note that, AFAICS, upstream did not
> included this fix in the patch for ruby 2.2 that relates to the rubygems
> CVEs:
> https://bugs.ruby-lang.org/attachments/download/7030/rubygems-276-for-ruby22.patch
Oops, sorry, I missed that post. I added references to both that thread
and this thread to dla-needed.txt and rubgems.
Yes, probably this should be marked no-dsa.
> I think it is a similar case for CVE-2018-1000079. I'd like
> security-team's opinion before tagging them as no-dsa.
The security tracker has wheezy marked as "Vulnerable code not present"
for CVE-2018-1000079.
--
Brian May <bam@debian.org>
Reply to: