Allow Rails 4.1.15+ for 4.1.14.1 and 4.1.14.2 CVEs #248
Conversation
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Prior version constraint considered version 4.1.15 vulnerable to security issues patched in 4.1.14.1 or 4.1.14.2. Changed to treat everything newer than 4.1.14 in the 4.1 line as patched.
| - "~> 5.0.0.beta1.1" | ||
| - "~> 4.2.5.1" | ||
| - "~> 4.1.14.1" | ||
| - "~> 4.1.14, >= 4.1.14.1" |
There was a problem hiding this comment.
I am assuming this is the correct syntax for a two-part constraint based on previous use here. A test run of bundler-audit seemed happy with the syntax.
There was a problem hiding this comment.
@matt-glover yep! bundler-audit splits by ,.
reedloden
added a commit
that referenced
this pull request
Mar 9, 2016
Allow Rails 4.1.15+ for 4.1.14.1 and 4.1.14.2 CVEs
dcarral
pushed a commit
to dcarral/ruby-advisory-db
that referenced
this pull request
Mar 10, 2016
Fix rubysec#244 using the two-part constraint syntax applied in rubysec#248
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Related to #245 but this is for the 4.1 line.
The old version constraint considered version 4.1.15 vulnerable to security issues patched in 4.1.14.1 or 4.1.14.2. Changed it to treat everything newer than 4.1.14 in the 4.1 line as patched.