www/rubygem-carrierwave1: fix ssrf_filter to version 1.0.x6eb6dc1197
Port details
www/rubygem-carrierwave1 1.3.4_1
Upload files, map them to a range of ORMs, store on different backends
Port info
- Maintainer
- sunpoet@FreeBSD.org
- Packages
- latest: 1.3.4_1
- Upstream
- up to date
- Last update
- to 1.3.4_1 · 6eb6dc1197
- Quarterly
- 2026Q4: 1.3.4_1
- WWW
- https://github.com/carrierwaveuploader/carrierwave
- Links
- cgit · VuXML
Install
- Package
# pkg install rubygem-carrierwave1installs 1.3.4_1 fromlatest; fromquarterly(2026Q4) 1.3.4_1- Port
# cd /usr/ports/www/rubygem-carrierwave1 && make install clean- Size
- 41 KiB download · 178 KiB installed
- Depends on
- databases/rubygem-activemodel70 7.0.10, devel/ruby-gems 4.0.21, devel/rubygem-activesupport70 7.0.10, lang/ruby34 3.4.9_2,1, misc/rubygem-mime-types 3.7.0, security/rubygem-ssrf_filter10 1.0.8
- License
- MIT
Packages by version and architecture
latest
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 16 | 1.3.4_1 | 1.3.4_1 | – |
| FreeBSD 15 | 1.3.4_1 | 1.3.4_1 | – |
| FreeBSD 14 | 1.3.4_1 | 1.3.4_1 | 1.3.4_1 |
quarterly (2026Q4)
| FreeBSD version | amd64 | aarch64 | i386 |
|---|---|---|---|
| FreeBSD 15 | 1.3.4_1 | 1.3.4_1 | – |
| FreeBSD 14 | 1.3.4_1 | 1.3.4_1 | 1.3.4_1 |
version as in the ports tree (latest) or the most common one (quarterly) · different version · ✗ not built · – no packages for this platform. Package sets that have not been rebuilt for 60 days are left out.
Unaddressed (3)
The CVE record lists the packaged version 1.3.4_1 as affected, and no VuXML entry names the CVE. What does this mean?
| CVE | CVSS | Published | Description |
|---|---|---|---|
| CVE-2024-29034 | 6.8 | 2024-03-24 | CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. The vulnerability CVE-2023-49090 wasn't fully addressed. This vulnerability … |
| CVE-2023-49090 | 6.8 | 2023-11-29 | CarrierWave is a solution for file uploads for Rails, Sinatra and other Ruby web frameworks. CarrierWave has a Content-Type allowlist bypass vulnerability, possibly lead… |
| CVE-2026-44587 | 4.7 | 2026-06-17 | CarrierWave is a framework to upload files from Ruby applications. In versions prior to 2.2.7 and 3.1.3, the content_type_denylist check fails to escape regex metacharac… |
VuXML only (0)
Listed in VuXML, the packaged version 1.3.4_1 is still in the affected range; pkg audit reports it. What does this mean?
None.
Fixed (0)
No VuXML entries for this package.
Problem reports (0) · open in Bugzilla, most recently changed first
None.
Commits (2)
www/rubygem-carrierwave1: Add rubygem-carrierwave1 1.3.4 (copied from rubygem-carrierwave) - Add PORTSCOUT4e1a399b35