Skip to content

Commit bf6db1e

Browse files
authored
Update CVE-2011-3624.yml for Ruby vulnerabilities
Removed outdated patched version for Ruby 1.9.2 and updated notes regarding webrick's gem separation.
1 parent ba5da8f commit bf6db1e

File tree

1 file changed

+0
-10
lines changed

1 file changed

+0
-10
lines changed

rubies/ruby/CVE-2011-3624.yml

Lines changed: 0 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,6 @@ description: |
1313
cvss_v2: 5.0
1414
cvss_v3: 5.3
1515
patched_versions:
16-
- "~> 1.9.2"
1716
- ">= 3.0.0"
1817
related:
1918
url:
@@ -28,12 +27,3 @@ related:
2827
- https://github.com/advisories/GHSA-rc82-v3mm-rhj2
2928
notes: |
3029
- Ruby 3.0.0 was the release when webrick was moved into a separate gem.
31-
- Did not find references to 1.8.7 fix.
32-
- Found this in above 1.9.2 ChangeLog. Unclear if connected.
33-
-- Fri Jun 24 19:57:30 2011 Hiroshi Nakamura <nahi@ruby-lang.org>
34-
* lib/webrick/httprequest.rb (setup_forwarded_info): Parsing request
35-
header failed when the request is from 2 or more Apache reverse
36-
proxies. It's said that all X-Forwarded-* headers will contain more
37-
than one (comma-separated) value if the original request already
38-
contained one of these headers. Since we could use these values as
39-
Host header, we choose the initial(first) value. See #4922.

0 commit comments

Comments
 (0)