Skip to content

Conversation

@ylecuyer
Copy link

Hello,

Following this new CVE for jruby https://github.com/rubysec/ruby-advisory-db/blob/master/rubies/jruby/CVE-2022-25857.yml we received the following report:

Name: jruby
Version: 2.6.8.0
Advisory: CVE-2022-25857
Criticality: High
URL: https://github.com/jruby/jruby/issues/7342 
Title: CVE-2022-25857 jruby/psych/snakeyaml: Denial of Service (DoS) due
 missing to nested depth limitation for collections
Solution: upgrade to >= 9.3.8.0

The reported version isn't correct, it uses the supported ruby version and not the jruby version.

I did a patch to use the jruby version when checking from jruby

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant