New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Use correct version for jruby #26

Open

ylecuyer wants to merge 2 commits into civisanalytics:main from ylecuyer:correct-jruby-version-yle

ylecuyer commented Sep 16, 2022

Hello,

Following this new CVE for jruby https://github.com/rubysec/ruby-advisory-db/blob/master/rubies/jruby/CVE-2022-25857.yml we received the following report:

Name: jruby
Version: 2.6.8.0
Advisory: CVE-2022-25857
Criticality: High
URL: https://github.com/jruby/jruby/issues/7342 
Title: CVE-2022-25857 jruby/psych/snakeyaml: Denial of Service (DoS) due
 missing to nested depth limitation for collections
Solution: upgrade to >= 9.3.8.0

The reported version isn't correct, it uses the supported ruby version and not the jruby version.

I did a patch to use the jruby version when checking from jruby

ylecuyer added 2 commits

September 16, 2022 11:36


          Use correct version for jruby

24cf1a1


          add changelog

e3942f6

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment