bundler-patch icon indicating copy to clipboard operation
bundler-patch copied to clipboard

Published 20 hours ago • verified publisher icon livingsocial

patch vulnerable not handling 4 digit version properly

Open chrismo opened this issue 7 years ago • 2 comments

CVE-2016-4658 came out, saying >= 1.7.1 is patched, but this tool is only bumping 1.6.8 to 1.6.8.1

chrismo avatar Mar 23 '17 22:03 chrismo

Not really a bug, turns out. It's another common constraint keeping it from getting to 1.7.1. BUT what may be a bug, is that it does an inadequate update, rather than just not updating at all.

chrismo avatar Mar 23 '17 22:03 chrismo

It should perhaps error out or something.

chrismo avatar Mar 24 '17 05:03 chrismo