Re: CVE-2021-28965
Hi Praveen,
On Fri, Apr 16, 2021 at 3:24 PM Pirate Praveen <praveen@onenetbeyond.org> wrote:
> I think the separate package was introduced by mistake without seeing
> the copy embedded in ruby. I think the right way is to fix this in ruby
> and remove this separate package. But I'd like someone from ruby team
> to confirm this.
Makes sense. Probably the time to RM ruby-rexml from the archive is *now*?
As for fixing this in src:ruby2.7, see #986742. TL;DR: ruby2.7 2.7.3-1
was uploaded to fix this earlier today.
- u
Reply to: