[<prev] [next>] [thread-next>] [day] [month] [year] [list]
Message-ID: <55FEA7E1.1070007@uu.nl>
Date: Sun, 20 Sep 2015 14:34:41 +0200
From: Dawa Ometto <d.ometto@...il.com>
To: oss-security@...ts.openwall.com
Subject: CVE Request: gollum information disclosure vulnerability
-----BEGIN PGP SIGNED MESSAGE-----
Hash: SHA512
Hi,
A vulnerability has been found in the gollum wiki, which allows
attackers to gain read access to arbitrary files on the system.
Website: https://github.com/gollum/gollum
Affected versions: 4.0.0 and earlier
Patched version: 4.0.1
Fix: update the gollum gem by running `gem update gollum`
See this commit for the patch:
https://github.com/gollum/gollum/commit/ce68a88293ce3b18c261312392ad33a88bb69ea1
Please assign a CVE identifier.
Thanks in advance,
Dawa Ometto
-----BEGIN PGP SIGNATURE-----
Comment: GPGTools - https://gpgtools.org
iQEcBAEBCgAGBQJV/qfhAAoJEOZ/bElPm95rx8sIAN1//QHUPQEM3Dy3M4zTesTw
72rBxilGPpsb/sCJunekbigW9gVubWrfqmpt7S7RZNW5PTUpspAlgp03Zz6mqhzX
PFYAtF4OaQkumGAigI5Ae+4Zd2I0swkzWWi3G8Xhyze6POYQYy2rxsoOJCfV2l/I
3dxKJL9bX23PCc2G3TyOoNr4ctYsjtHLLosUDuoyTYsRgoturUlf1+My+naV9Ccv
+JtRkeCCtZ+YsJmnnhxzWp/KtCAVju5xalfDbxPJdYeo40+P8crTjXHzLAfD7zra
6IvdnqX9w3VtfKSWzDmoVIefFa6Mq8na7ojeOWAjKSnLoDimyqzAXkTrMPh13Ds=
=DwwE
-----END PGP SIGNATURE-----
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
