loofah 2.10.0 release flagged as CVE-2018-8048 (loofah < 2.2.1)

[ryanfb]

Background

Brakeman version: 5.0.1
Rails version: 6.1.3.2
Ruby version: 3.0.1

False Positive

Full warning from Brakeman:

== Warnings ==

Confidence: Medium
Category: Cross-Site Scripting
Check: SanitizeMethods
Message: loofah gem 2.10.0 is vulnerable (CVE-2018-8048). Upgrade to 2.2.1
File: Gemfile.lock
Line: 215

Why might this be a false positive?

loofah 2.10.0 (released today) is later than 2.2.1, but the version comparison seems to be parsing it as being earlier than 2.2.1.

[runephilosof-abtion]

irb: "2.10" < "2.2.1"
=> true

brakeman/lib/brakeman/checks/check_sanitize_methods.rb

Line 93 in aef6253

loofah_version and loofah_version < "2.2.1"

[biow0lf]

Gem::Version.new("2.10") < Gem::Version.new("2.2.1") # => false