Fix CVE-2014-4043

Question

Fix CVE-2014-4043

overheadhunter opened this issue 3 years ago · comments

Please update jnr-posix to ≥ 3.1.18 😉

Related: #135, #120.

Sergey Tselovalnikov · Answer 1 · Wed Oct 06 2021 17:38:12 GMT+0800 (China Standard Time)

Hi, @overheadhunter! Thank you for reporting, I'll try to take a look over the weekend, will merge an update and will publish a new version. It seems like something happened to the Windows CI setup even though there were no code changes.

Sergey Tselovalnikov · Answer 2 · Sun Oct 10 2021 21:55:47 GMT+0800 (China Standard Time)

Hey, @overheadhunter! I released a new version of jnr-fuse - 0.5.6 with the updated dependencies, thanks for reporting!

Sebastian Stenzel · Answer 3 · Mon Oct 11 2021 02:41:30 GMT+0800 (China Standard Time)

Please reopen, we need at least version 3.1.18, but dependabot stopped with 3.1.10. I added a warning in #135 but maybe it wasn't clear enough.

Sebastian Stenzel · Answer 4 · Mon Oct 11 2021 21:40:46 GMT+0800 (China Standard Time)

Wow, nevermind. Fixed in 3.1.8. My bad 🙈