Redmine

Thank you for reporting the issue. The quickest workaround is to update to Redmine 4.1. Redmine 4.1 uses i18n 1.6.

source:/tags/4.1.1/Gemfile#L17

Thanks we did it that way , also in 4.0.x branch i18n should be bumped to 0.8.0

Popa Marius wrote:

Thanks we did it that way , also in 4.0.x branch i18n should be bumped to 0.8.0

Is not only the bump, it requires also to backport some code changes from r17888 and r18286. At that time, Toshi tried to update the gem https://www.redmine.org/projects/redmine/repository/revisions/16324.

The version of Hash#slice in the i18n gem (which was vulnerable to CVE-2014-10077) is only used if there is not already another version of this method present:

• From Ruby 2.5.0 on, Ruby itself ships this method.
• When used with Rails (resp. ActiveSupport) on version >= 3.0, < 6.0, it also ships this method. It is used in preference to the one in the i18n gem since ActiveSupport is loaded before i18n

Thus, the version of the method shipped with the i18n gem should never actually be used by us (or any dependent code). Thus, I think this vulnerability doesn't apply to us.