rubysec/ruby-advisory-db — pull request #67 by jeremyolliver (2013-12-19 03:47:08+00:00)
Title: Specify patched versions of spree gems from old vulnerabilities

I noticed these don't list the patched versions yet. After a bit of searching, I found the following sources:

http://spreecommerce.com/blog/multiple-security-vulnerabilities-fixed - which links the relevant commit https://github.com/spree/spree/commit/70092eb55b8be8fe5d21a7658b62da658612fba7

The changes in that commit appear to cover, or at least look to be aimed at addressing all the described vulnerabilities in these particular reports.

Although I wasn't able to find changelogs to verify that this was the first released version including these fixes, the time of the 2.0.0 release co-incides a few days prior to the date the blog post linked above was published, and `git tag --contains 70092eb55b8be8fe5d21a7658b62da658612fba7` reports that the tags v2.0.0 and above include this commit.