Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Update Ruby to 2.6.6 to resolve 2 CVEs #1877

Merged
merged 1 commit into from
Aug 6, 2020
Merged

Update Ruby to 2.6.6 to resolve 2 CVEs #1877

merged 1 commit into from
Aug 6, 2020

Conversation

tas50
Copy link
Contributor

@tas50 tas50 commented Aug 6, 2020

Updating to Ruby 2.6.6 resolves these 2 CVEs:

CVE-2020-10663: Unsafe Object Creation Vulnerability in JSON (Additional fix)
CVE-2020-10933: Heap exposure vulnerability in the socket library

Signed-off-by: Tim Smith tsmith@chef.io

@tas50
Copy link
Contributor Author

tas50 commented Aug 6, 2020

This requires bumping omnibus software so it's probably worth doing #1874 first

@robbkidd robbkidd added Aspect: Packaging Distribution of the projects 'compiled' artifacts. Aspect: Security Can an unwanted third party affect the stability or look at privileged information? Type: Chore non-critical maintenance of a project. labels Aug 6, 2020
@tas50 tas50 requested a review from a team as a code owner August 6, 2020 22:55
@tas50 @robbkidd
Update Ruby to 2.6.6 to resolve 2 CVEs
9e07fbb 
Updating to Ruby 2.6.6 resolves these 2 CVEs:

    CVE-2020-10663: Unsafe Object Creation Vulnerability in JSON (Additional fix)
    CVE-2020-10933: Heap exposure vulnerability in the socket library

Signed-off-by: Tim Smith <tsmith@chef.io>
robbkidd
robbkidd approved these changes Aug 6, 2020
View reviewed changes
Copy link
Contributor

@robbkidd robbkidd left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

tenor-113577575

@robbkidd robbkidd merged commit 81e1698 into master Aug 6, 2020
@robbkidd robbkidd deleted the bump_ruby branch August 7, 2020 14:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers

@robbkidd robbkidd robbkidd approved these changes

Assignees
No one assigned
Labels
Aspect: Packaging Distribution of the projects 'compiled' artifacts. Aspect: Security Can an unwanted third party affect the stability or look at privileged information? Type: Chore non-critical maintenance of a project.
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
2 participants
@tas50 @robbkidd