update Manifest.txt and CHANGELOG.md

[skip ci]
flavorjones · Mar 19, 2018 · 70bd089 · 70bd089
1 parent 332ec6a
commit 70bd089
Show file tree

Hide file tree

Showing 2 changed files with 9 additions and 0 deletions.
diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -1,5 +1,12 @@
 # Changelog
 
+## 2.2.1 / 2018-03-19
+
+Addresses CVE-2018-8048. Loofah allowed non-whitelisted attributes to be present in sanitized output when input with specially-crafted HTML fragments.
+
+This CVE's public notice is at https://github.com/flavorjones/loofah/issues/144
+
+
 ## 2.2.0 / 2018-02-11
 
 Features:

diff --git a/Manifest.txt b/Manifest.txt
@@ -5,6 +5,7 @@ MIT-LICENSE.txt
 Manifest.txt
 README.md
 Rakefile
+SECURITY.md
 benchmark/benchmark.rb
 benchmark/fragment.html
 benchmark/helper.rb
@@ -14,6 +15,7 @@ lib/loofah/elements.rb
 lib/loofah/helpers.rb
 lib/loofah/html/document.rb
 lib/loofah/html/document_fragment.rb
+lib/loofah/html5/libxml2_workarounds.rb
 lib/loofah/html5/scrub.rb
 lib/loofah/html5/whitelist.rb
 lib/loofah/instance_methods.rb