Re: Stretch 9.2 announcement: dead link for ruby-rack-cors DSA
On Wed, Oct 11, 2017 at 10:29:32PM +0200, Salvatore Bonaccorso wrote:
> Hi Adam,
>
> On Wed, Oct 11, 2017 at 09:15:08PM +0100, Adam D. Barratt wrote:
> > On Wed, 2017-10-11 at 22:08 +0200, Holger Wansing wrote:
> > > at https://www.debian.org/News/2017/20171007 the DSA link for ruby-
> > > rack-cors
> > > is dead:
> > >
> > > https://www.debian.org/security/2017/dsa-3931
> > >
> > > There is no such DSA.
> > > And also no such announcement on https://lists.debian.org/debian-secu
> > > rity-announce/
> > >
> >
> > It's in DSA/list in the secure-testing repository:
> >
> > [10 Aug 2017] DSA-3931-1 ruby-rack-cors - security update
> > {CVE-2017-11173}
> > [stretch] - ruby-rack-cors 0.4.0-1+deb9u1
> >
> > which is where the stable tools got the information from to begin with.
> >
> > The package is also in http://security.debian.org/debian-security/pool/
> > updates/main/r/ruby-rack-cors/
> >
> > So it looks like the announcement went missing somehow. team@security
> > CCed for comment.
>
> Indeed, it looks that the announcement at least never arived in d-s-a.
>
> I wonder if after two monts now it makes still sense to send the
> advisory or at least just import the text for the website.
That's the DSA text, no idea why it got lost. Surely doesn't make sense to
re-send it two months later:
Cheers,
Moritz
- -------------------------------------------------------------------------
Debian Security Advisory DSA-3931-1 security@debian.org
https://www.debian.org/security/ Moritz Muehlenhoff
August 10, 2017 https://www.debian.org/security/faq
- -------------------------------------------------------------------------
Package : ruby-rack-cors
CVE ID : CVE-2017-11173
Jens Mueller discovered that an incorrect regular expression in rack-cors
may lead to insufficient restriction of CORS requests.
For the stable distribution (stretch), this problem has been fixed in
version 0.4.0-1+deb9u1.
We recommend that you upgrade your ruby-rack-cors packages.
Further information about Debian Security Advisories, how to apply
these updates to your system and frequently asked questions can be
found at: https://www.debian.org/security/
Reply to: