Add a patched version for CVE-2023-31606

rubysec · Nov 3, 2023 · 0e7d31c · 0e7d31c
1 parent a89b84a
commit 0e7d31c
Showing 1 changed file with 4 additions and 1 deletion.
diff --git a/gems/RedCloth/CVE-2023-31606.yml b/gems/RedCloth/CVE-2023-31606.yml
@@ -13,11 +13,14 @@ description: |
 cvss_v3: 7.5
 unaffected_versions:
   - "< 4.0.0"
-notes: "Never patched: vulnerableVersionRange: <= 4.3.2; NVD has no cvss values"
+patched_versions:
+  - ">= 4.3.3"
 related:
   url:
     - https://nvd.nist.gov/vuln/detail/CVE-2023-31606
     - https://github.com/e23e/CVE-2023-31606#readme
     - https://github.com/jgarber/redcloth/issues/73
     - https://github.com/jgarber/redcloth/blob/v4.3.2/lib/redcloth/formatters/html.rb#L327
     - https://github.com/advisories/GHSA-qcm3-vfq5-wfr2
+    - https://github.com/jgarber/redcloth/pull/75
+    - https://github.com/jgarber/redcloth/blob/v4.3.3/lib/redcloth/formatters/html.rb#L327