Bug#1030047: ruby-sanitize: CVE-2023-23627

2023-02-21 Thread duck
Quack Salvatore, Thanks for the patch, it looks good. I'm in the Ruby team but not involved in this particular package but I think we can let your NMU flow. It's causing havoc on other packages so the sooner the better :-). Regards. \_o< -- Marc Dequènes

Bug#1030047: ruby-sanitize: CVE-2023-23627

2023-01-30 Thread Moritz Mühlenhoff
Source: ruby-sanitize X-Debbugs-CC: t...@security.debian.org Severity: important Tags: security Hi, The following vulnerability was published for ruby-sanitize. CVE-2023-23627[0]: | Sanitize is an allowlist-based HTML and CSS sanitizer. Versions 5.0.0 | and later, prior to 6.0.1, are vulnerable