From 7585841a181b40845ac4e6b78244c9377b4f29e6 Mon Sep 17 00:00:00 2001 From: Henrique Morato Date: Wed, 29 Jul 2026 19:14:32 -0300 Subject: [PATCH 1/3] Fix activestorage CVE-2026-66066 patched_versions The 7.2.x fix shipped in 7.2.3.2, not 7.2.3.1, so "~> 7.2.3.1" wrongly marked the vulnerable 7.2.3.1 as patched and bundler-audit reported no vulnerability. Likewise "~> 8.0.5.1" only matched the 8.0.5.x tine and wrongly flagged 8.0.6+ as vulnerable. Use compound constraints so the affected ranges (<7.2.3.2, 8.0.x<8.0.5.1, 8.1.x<8.1.3.1) are correct. Also fix the advisory date (2027-07-29 -> 2026-07-29). --- gems/activestorage/CVE-2026-66066.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/gems/activestorage/CVE-2026-66066.yml b/gems/activestorage/CVE-2026-66066.yml index 1ae34fb69f..4dbc34ad84 100644 --- a/gems/activestorage/CVE-2026-66066.yml +++ b/gems/activestorage/CVE-2026-66066.yml @@ -6,7 +6,7 @@ ghsa: xr9x-r78c-5hrm url: https://www.cve.org/CVERecord/SearchResults?query=CVE-2026-66066 title: Possible arbitrary file read and remote code execution in Active Storage variant processing -date: 2027-07-29 +date: 2026-07-29 description: | ## Impact @@ -51,8 +51,8 @@ description: | from Ethiack, and RyotaK from GMO Flatt Security Inc.. cvss_v4: 9.5 patched_versions: - - "~> 7.2.3.1" - - "~> 8.0.5.1" + - "~> 7.2.3, >= 7.2.3.2" + - "~> 8.0.5, >= 8.0.5.1" - ">= 8.1.3.1" related: url: From d6259af926b3dc46f503e3b80e9cf78f944ab381 Mon Sep 17 00:00:00 2001 From: Henrique Morato Date: Wed, 29 Jul 2026 20:37:23 -0300 Subject: [PATCH 2/3] Change patched_version pattern --- gems/activestorage/CVE-2026-66066.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gems/activestorage/CVE-2026-66066.yml b/gems/activestorage/CVE-2026-66066.yml index 4dbc34ad84..2b44f19f1a 100644 --- a/gems/activestorage/CVE-2026-66066.yml +++ b/gems/activestorage/CVE-2026-66066.yml @@ -51,8 +51,8 @@ description: | from Ethiack, and RyotaK from GMO Flatt Security Inc.. cvss_v4: 9.5 patched_versions: - - "~> 7.2.3, >= 7.2.3.2" - - "~> 8.0.5, >= 8.0.5.1" + - ">= 7.2.3.2" + - ">= 8.0.5.1" - ">= 8.1.3.1" related: url: From 45b26b5097ec903f0c93ce8d2cec94e3f520e310 Mon Sep 17 00:00:00 2001 From: Henrique Morato Date: Wed, 29 Jul 2026 20:42:56 -0300 Subject: [PATCH 3/3] Revert "Change patched_version pattern" This reverts commit d6259af926b3dc46f503e3b80e9cf78f944ab381. --- gems/activestorage/CVE-2026-66066.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/gems/activestorage/CVE-2026-66066.yml b/gems/activestorage/CVE-2026-66066.yml index 2b44f19f1a..4dbc34ad84 100644 --- a/gems/activestorage/CVE-2026-66066.yml +++ b/gems/activestorage/CVE-2026-66066.yml @@ -51,8 +51,8 @@ description: | from Ethiack, and RyotaK from GMO Flatt Security Inc.. cvss_v4: 9.5 patched_versions: - - ">= 7.2.3.2" - - ">= 8.0.5.1" + - "~> 7.2.3, >= 7.2.3.2" + - "~> 8.0.5, >= 8.0.5.1" - ">= 8.1.3.1" related: url: