ruby-i18n/i18n

Synopsis Black duck vulnerability report

jadelekekpmg opened this issue · 3 comments

jadelekekpmg commented

CVE-2020-7791

Synopsis Black duck is reporting a vulnerability with ruby-i18n1.8.11

Description
This affects the package i18n before 2.1.15. Vulnerability arises out of insufficient handling of erroneous language tags in src/i18n/Concrete/TextLocalizer.cs and src/i18n/LocalizedApplication.cs.

The weird part is that the referenced description is talking about a .cs file.
Is Blackduck reporting a false positive here?

Digging deeper, it also says it is fixed here: turquoiseowl/i18n@c418e33

Which is a totally different project.

I am confused.

radar commented

I don’t see where Ruby i18n is reported there at all. I guess they’ve updated it?

jadelekekpmg commented

i18n
Hello @radar ,
Please see the attached image for the reported issue by BlackDuck.
The Description Says:
Description
This affects the package i18n before 2.1.15. Vulnerability arises out of insufficient handling of erroneous language tags in src/i18n/Concrete/TextLocalizer.cs and src/i18n/LocalizedApplication.cs.

View CVE record:
cve
I wonder if this is a false positive report?
Thanks,

radar commented