FreeBSD Port: ruby20-126.96.36.1995,1 - reported as vulnerable while it isn't ?
swills at FreeBSD.org
Sun Jun 21 14:54:41 UTC 2015
Did you build your own ports where ruby 2.0 was default? I see the package name
here is ruby-188.8.131.525,1, not ruby20-184.108.40.2065,1. The entries in vuxml look
So I think maybe it's matching the second entry and then looking for a ruby
version 2.1.6,1 or newer. Not sure what the right solution is for this right
On Sun, Jun 21, 2015 at 08:43:33AM +0200, Ing. Břetislav Kubesa wrote:
> already for longer time while updating to 220.127.116.115,1 version, I'm
> getting message that it's vulnerable, but I think it's not the case as
> vulnerable are ruby20 < 18.104.22.1685,1 (but it's not ruby20 <= 22.214.171.1245,1).
> However I'm not sure where to report it for checking, so I hope it's the
> right place here.
> Thank you.
> ---> Upgrading 'ruby-126.96.36.1993_1,1' to 'ruby-188.8.131.525,1' (lang/ruby20)
> ---> Building '/usr/ports/lang/ruby20'
> ===> Cleaning for ruby-184.108.40.2065,1
> ===> ruby-220.127.116.115,1 has known vulnerabilities:
> ruby-18.104.22.1685,1 is vulnerable:
> Ruby -- OpenSSL Hostname Verification Vulnerability
> CVE: CVE-2015-1855
> Best regards,
> Bretislav Kubesa
> freebsd-ports at freebsd.org mailing list
> To unsubscribe, send any mail to "freebsd-ports-unsubscribe at freebsd.org"
-------------- next part --------------
A non-text attachment was scrubbed...
Name: not available
Size: 603 bytes
Desc: not available
More information about the freebsd-ports