Once again the advisory indicates the fix in a version we already seem to have. Perhaps I am seeing something wrong..

This one is for Pascal.

Status comment: (none) => Fixed 4.3.2-4 ?
Assignee: bugsquad => pterjan

Hi,

The release number from Ubuntu is totally different from the one from Mageia so 4.3.2-4 in Ubuntu package does not mean 4.3.2-7.mga9 is newer or contains the patch for the CVE.

Best regards,

Nico.

Status comment: Fixed 4.3.2-4 ? => (none)

Suggested advisory:
========================

The updated packages fix a security vulnerability:

A Regular Expression Denial of Service (ReDoS) issue was discovered in the sanitize_html function of redcloth gem v4.0.0. This vulnerability allows attackers to cause a Denial of Service (DoS) via supplying a crafted payload. (CVE-2023-31606)

References:
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-31606
https://ubuntu.com/security/notices/USN-6358-1
========================

Updated packages in 9/core/updates_testing:
========================
ruby-RedCloth-4.3.2-7.1.mga9
ruby-RedCloth-doc-4.3.2-7.1.mga9

from SRPM:
ruby-RedCloth-4.3.2-7.1.mga9.src.rpm

Updated packages in 8/core/updates_testing:
========================
ruby-RedCloth-4.3.2-5.1.mga8
ruby-RedCloth-doc-4.3.2-5.1.mga8

from SRPM:
ruby-RedCloth-4.3.2-5.1.mga8.src.rpm

Version: Cauldron => 9
Whiteboard: MGA9TOO, MGA8TOO => MGA8TOO
Assignee: pterjan => qa-bugs
Status: NEW => ASSIGNED
CVE: (none) => CVE-2023-31606

Advisory from comment 3 uploaded, please remove the "advisory" keyword if it needs to be changed

CC: (none) => marja11
Keywords: (none) => advisory

MGA9-64 Xfce on Acer Aspire 5253
No installation issues
No previous update, urmpq return nothing but itself, and reading the doc, this is a parser for use in the ruby language, developerrs stuff.
So OK on clean install.

CC: (none) => herman.viaene
Whiteboard: MGA8TOO => MGA8TOO MGA9-64-OK

MGA8-64 Plasma in Virtualbox

No installation issues, so following Herman's lead and sending it on.

Validating.

Keywords: (none) => validated_update
CC: (none) => andrewsfarm, sysadmin-bugs
Whiteboard: MGA8TOO MGA9-64-OK => MGA8TOO MGA8-64-OK MGA9-64-OK

An update for this issue has been pushed to the Mageia Updates repository.

https://advisories.mageia.org/MGASA-2023-0291.html

Status: ASSIGNED => RESOLVED
Resolution: (none) => FIXED