Skip to content

use rexml => 3.2.5 due to CVE-2021-28965 #408

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom
Merged
merged 1 commit into from
May 6, 2021
Merged

use rexml => 3.2.5 due to CVE-2021-28965 #408

merged 1 commit into from
May 6, 2021

Conversation

@swiknaba
Copy link
Contributor

@swiknaba swiknaba commented May 5, 2021

GHSA-8cr8-4vfw-mr7h

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

@swiknaba swiknaba requested a review from a team as a code owner May 5, 2021 11:37
@swiknaba swiknaba changed the title use rexml ~> 3.2.5 due to CVE-2021-28965 use rexml => 3.2.5 due to CVE-2021-28965 May 5, 2021
ashkulz
ashkulz approved these changes May 6, 2021
View reviewed changes
Copy link
Member

@ashkulz ashkulz left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Thanks for the contribution!

@ashkulz ashkulz merged commit 928a51e into prontolabs:master May 6, 2021
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@ashkulz ashkulz ashkulz approved these changes

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

2 participants

@swiknaba @ashkulz