Add CVE-2024-4990 #724
Add CVE-2024-4990 #724
Conversation
yiisoft/yii2/CVE-2024-4990.yaml
Outdated
| cve: CVE-2024-4990 | ||
| branches: | ||
| 2.0.49.x: | ||
| time: null |
There was a problem hiding this comment.
| time: null | |
| time: 2024-05-30 17:23:00 |
There was a problem hiding this comment.
If I understood the time field correctly, that should hold the timestamp of the commit which fixed it in that branch. So if it is not for that branch, then I would go with 2024-05-30 since that was the commit yiisoft/yii2@628d406 which fixed it in the 2.0.50 branch. If that field is understood as fixed in that branch I would rather use 2024-06-04 16:23:00 from yiisoft/yii2@62d081f since that was merged to branch 2.0.49.x.
There was a problem hiding this comment.
@DBX12 makes sense, can you apply that change then?
There was a problem hiding this comment.
Hi @naderman
can you clarify how the time field is to be understood? :)
Edit: I misread your comment, so you can disregard that question. Also, the related CVE got updated again so I've pushed an update.
|
It seems like the 2.0.49.x branch got updated and version 2.0.49.4 contains the security fixes: yiisoft/yii2#20183 |
The security advisory got updated again.
The vulnerability was fixed with this commit: yiisoft/yii2@62d081f
|
Thanks for all your efforts on this @DBX12 ! |
This PR adds the CVE-2024-4990 in
yiisoft/yii2.This is my first contribution, I hope I did it right, especially the
brancheskey 😅