CVE-2024-22191 for Avo 2.46.0
# avo-2m
miniature-optician-85831
01/18/2024, 7:30 AMThread automatically created by gee_forr in #740893011994738751
l
loud-jewelry-99127
01/18/2024, 7:52 AMHello @few-beach-88179, yes there will be a patch with that security fix for Avo 2.x
f
few-beach-88179
01/18/2024, 8:06 AMexcellent news! thank you 🙂
l
loud-jewelry-99127
01/18/2024, 9:30 AMhttps://rubygems.org/gems/avo/versions/2.47.0 have the security issue fixed, thank you @User
f
few-beach-88179
01/18/2024, 2:21 PMnice one - just saw. Thanks so much!
few-beach-88179
01/18/2024, 2:22 PMi always feel so dirty adding a CVE to the bundle-audit ignore list.
l
loud-jewelry-99127
01/18/2024, 4:05 PMNot ideal, I know
f
few-beach-88179
01/19/2024, 7:02 AMGAH! 2.47.0 has a different CVE attached?!?! https://github.com/avo-hq/avo/security/advisories/GHSA-g8vp-2v5p-9qfh
few-beach-88179
01/19/2024, 7:03 AMCVE-2024-22411 this time 😦
l
loud-jewelry-99127
01/23/2024, 10:31 AMHey @few-beach-88179 just tested it on
2.47.0loud-jewelry-99127
01/23/2024, 10:32 AMI'll try to figure out the version where it was fixed and we'll add to the list so it stop raising
loud-jewelry-99127
01/23/2024, 10:32 AMJust letting you know that is safe
f
few-beach-88179
01/23/2024, 10:33 AMawesome - thanks. Weirdly - I ran bundler-audit again, and that CVE is no longer being raised as an issue?
l
loud-jewelry-99127
01/23/2024, 10:33 AMAh cool!
loud-jewelry-99127
01/23/2024, 10:34 AMMaybe you have that one on a exclude list?
f
few-beach-88179
01/23/2024, 12:21 PMno - I ran the audit with no exclusions. The vuln was probably updated to ignore 2.47.0 as a vulnerable version