[GHSA-qrgf-jqqm-x7xv] High severity vulnerability that affects dragonfly

[G-Rath]

Updates

• Affected products

[G-Rath]

Per markevans/dragonfly#520 - I've gone with marking v1.0.0 as the first fixed version to be on the safe side since I don't know the exact v0.x version this was patched in, and it's a bit confusing with the advisory range being for v0.9.15 but the details talking about fog-dragonfly and v0.8.2.

I've stuck with the <= 0.9.15 for fog-dragonfly because it looks like someone has just published that randomly and it only has two versions (v0.8.1 & v0.8.2) so I think it's best to assume all versions are affected for now - people can always improve this advisory in future :)

[darakian]

Many thanks for the great background research! 👍

[advisory-database]

Hi @G-Rath! Thank you so much for contributing to the GitHub Advisory Database. This database is free, open, and accessible to all, and it's people like you who make it great. Thanks for choosing to help others. We hope you send in more contributions in the future!