[petergoldstein]

Adds a dalli advisory, submitted by the dalli maintainer, fixed in a coordinated release (5.2.4, 5.1.6, 5.0.12, 4.3.9 and 3.2.15).

Advisory	GitHub severity	Summary
GHSA-5xvx-r8rg-5qm2	high	A quiet block, an interrupted get_multi, or a value containing CR/LF can return another key's value

Versions

• The advisory covers three issues with different ranges (described in the entry); together they affect every supported release line, so there's no unaffected_versions.
• Patched: ~> 3.2.15, ~> 4.3.9, ~> 5.0.12, ~> 5.1.6 and >= 5.2.4.

Notes

• A CVE has been requested through GitHub but not yet assigned, so the entry has no cve: field. I'll follow up once it's assigned, along with the other dalli entries still waiting on theirs.
• The GitHub advisory has a severity but no CVSS score, so the entry has no cvss_v3.
• bundle exec rspec spec/advisories_spec.rb spec/schema_validation_spec.rb passes locally.
• Independent of Add GHSA-r47x-6p6r-mvcp for dalli #1280 (GHSA-r47x-6p6r-mvcp); either can merge first.

[jasnow]

LGTM

[simi]

@petergoldstein can you remove Claude attribution?

[petergoldstein]

Claude attribution removed from comment @simi

[flavorjones]

@petergoldstein Can you remove the attribution from the commit message as well?

[petergoldstein]

Removed the attribution from the commit message as well.

[flavorjones]

Thank you!