Skip to content

Commit adc1382

Browse files
senid231senid231
committed
fix vulnerabilities
Name: actionpack Version: 5.1.4 Advisory: CVE-2020-8166 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/NOjKiGeXUgw Title: Ability to forge per-form CSRF tokens given a global CSRF token Solution: upgrade to ~> 5.2.4.3, >= 6.0.3.1 Name: actionpack Version: 5.1.4 Advisory: CVE-2020-8164 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/f6ioe4sdpbY Title: Possible Strong Parameters Bypass in ActionPack Solution: upgrade to ~> 5.2.4.3, >= 6.0.3.1 Name: actionview Version: 5.1.4 Advisory: CVE-2020-15169 Criticality: Unknown URL: https://groups.google.com/g/rubyonrails-security/c/b-C9kSGXYrc Title: Potential XSS vulnerability in Action View Solution: upgrade to ~> 5.2.4, >= 5.2.4.4, >= 6.0.3.3 Name: actionview Version: 5.1.4 Advisory: CVE-2020-8167 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/x9DixQDG9a0 Title: CSRF Vulnerability in rails-ujs Solution: upgrade to ~> 5.2.4.3, >= 6.0.3.1 Name: actionview Version: 5.1.4 Advisory: CVE-2019-5418 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/pFRKI96Sm8Q Title: File Content Disclosure in Action View Solution: upgrade to ~> 4.2.11, >= 4.2.11.1, ~> 5.0.7, >= 5.0.7.2, ~> 5.1.6, >= 5.1.6.2, ~> 5.2.2, >= 5.2.2.1, >= 6.0.0.beta3 Name: actionview Version: 5.1.4 Advisory: CVE-2020-5267 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/55reWMM_Pg8 Title: Possible XSS vulnerability in ActionView Solution: upgrade to ~> 5.2.4, >= 5.2.4.2, >= 6.0.2.2 Name: actionview Version: 5.1.4 Advisory: CVE-2019-5419 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/GN7w9fFAQeI Title: Denial of Service Vulnerability in Action View Solution: upgrade to >= 6.0.0.beta3, ~> 5.2.2, >= 5.2.2.1, ~> 5.1.6, >= 5.1.6.2, ~> 5.0.7, >= 5.0.7.2, ~> 4.2.11, >= 4.2.11.1 Name: activejob Version: 5.1.4 Advisory: CVE-2018-16476 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/FL4dSdzr2zw Title: Broken Access Control vulnerability in Active Job Solution: upgrade to ~> 4.2.11, ~> 5.0.7.1, ~> 5.1.6.1, ~> 5.1.7, >= 5.2.1.1 Name: activesupport Version: 5.1.4 Advisory: CVE-2020-8165 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/bv6fW4S0Y1c Title: Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore Solution: upgrade to ~> 5.2.4.3, >= 6.0.3.1 Name: ffi Version: 1.9.18 Advisory: CVE-2018-1000201 Criticality: High URL: https://github.com/ffi/ffi/releases/tag/1.9.24 Title: ruby-ffi DDL loading issue on Windows OS Solution: upgrade to >= 1.9.24 Name: jquery-rails Version: 4.3.1 Advisory: CVE-2019-11358 Criticality: Medium URL: https://blog.jquery.com/2019/04/10/jquery-3-4-0-released/ Title: Prototype pollution attack through jQuery $.extend Solution: upgrade to >= 4.3.4 Name: loofah Version: 2.1.1 Advisory: CVE-2018-8048 Criticality: Unknown URL: flavorjones/loofah#144 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.2.1 Name: loofah Version: 2.1.1 Advisory: CVE-2018-16468 Criticality: Medium URL: flavorjones/loofah#154 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.2.3 Name: loofah Version: 2.1.1 Advisory: CVE-2019-15587 Criticality: Medium URL: flavorjones/loofah#171 Title: Loofah XSS Vulnerability Solution: upgrade to >= 2.3.1 Name: nokogiri Version: 1.8.1 Advisory: CVE-2017-15412 Criticality: Unknown URL: sparklemotion/nokogiri#1714 Title: Nokogiri gem, via libxml, is affected by DoS vulnerabilities Solution: upgrade to >= 1.8.2 Name: nokogiri Version: 1.8.1 Advisory: CVE-2018-8048 Criticality: Unknown URL: sparklemotion/nokogiri#1746 Title: Revert libxml2 behavior in Nokogiri gem that could cause XSS Solution: upgrade to >= 1.8.3 Name: nokogiri Version: 1.8.1 Advisory: CVE-2020-26247 Criticality: Low URL: GHSA-vr8q-g5c7-m54m Title: Nokogiri::XML::Schema trusts input by default, exposing risk of an XXE vulnerability Solution: upgrade to >= 1.11.0.rc4 Name: nokogiri Version: 1.8.1 Advisory: CVE-2018-14404 Criticality: Unknown URL: sparklemotion/nokogiri#1785 Title: Nokogiri gem, via libxml2, is affected by multiple vulnerabilities Solution: upgrade to >= 1.8.5 Name: nokogiri Version: 1.8.1 Advisory: CVE-2019-11068 Criticality: Unknown URL: sparklemotion/nokogiri#1892 Title: Nokogiri gem, via libxslt, is affected by improper access control vulnerability Solution: upgrade to >= 1.10.3 Name: nokogiri Version: 1.8.1 Advisory: CVE-2020-7595 Criticality: High URL: sparklemotion/nokogiri#1992 Title: libxml2 2.9.10 has an infinite loop in a certain end-of-file situation Solution: upgrade to >= 1.10.8 Name: nokogiri Version: 1.8.1 Advisory: CVE-2019-5477 Criticality: Critical URL: sparklemotion/nokogiri#1915 Title: Nokogiri Command Injection Vulnerability via Nokogiri::CSS::Tokenizer#load_file Solution: upgrade to >= 1.10.4 Name: nokogiri Version: 1.8.1 Advisory: CVE-2019-13117 Criticality: Unknown URL: sparklemotion/nokogiri#1943 Title: Nokogiri gem, via libxslt, is affected by multiple vulnerabilities Solution: upgrade to >= 1.10.5 Name: rack Version: 2.0.8 Advisory: CVE-2020-8161 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/ruby-security-ann/T4ZIsfRf2eA Title: Directory traversal in Rack::Directory app bundled with Rack Solution: upgrade to ~> 2.1.3, >= 2.2.0 Name: rack Version: 2.0.8 Advisory: CVE-2020-8184 Criticality: Unknown URL: https://groups.google.com/g/rubyonrails-security/c/OWtmozPH9Ak Title: Percent-encoded cookies can be used to overwrite existing prefixed cookie names Solution: upgrade to ~> 2.1.4, >= 2.2.3 Name: rails-html-sanitizer Version: 1.0.3 Advisory: CVE-2018-3741 Criticality: Unknown URL: https://groups.google.com/d/msg/rubyonrails-security/tP7W3kLc5u4/uDy2Br7xBgAJ Title: XSS vulnerability in rails-html-sanitizer Solution: upgrade to >= 1.0.4 Name: sprockets Version: 3.7.1 Advisory: CVE-2018-3760 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/ruby-security-ann/2S9Pwz2i16k Title: Path Traversal in Sprockets Solution: upgrade to >= 2.12.5, < 3.0.0, >= 3.7.2, < 4.0.0, >= 4.0.0.beta8
1 parent 3649db2 commit adc1382

File tree

2 files changed

+69
-59
lines changed

2 files changed

+69
-59
lines changed

‎Gemfile

+1-1
Original file line numberDiff line numberDiff line change
@@ -4,7 +4,7 @@ git_source(:github) do |repo_name|
44
"https://github.com/#{repo_name}.git"
55
end
66
ruby '2.7.2'
7-
gem 'rails', '~> 5.1.4'
7+
gem 'rails', '~> 5.2.4'
88
gem 'puma', '~> 3.12'
99
gem 'sass-rails', '~> 5.0'
1010
gem 'uglifier', '>= 1.3.0'

‎Gemfile.lock

+68-58
Original file line numberDiff line numberDiff line change
@@ -19,52 +19,56 @@ GEM
1919
remote: https://rubygems.org/
2020
remote: https://rails-assets.org/
2121
specs:
22-
actioncable (5.1.4)
23-
actionpack (= 5.1.4)
22+
actioncable (5.2.4.4)
23+
actionpack (= 5.2.4.4)
2424
nio4r (~> 2.0)
25-
websocket-driver (~> 0.6.1)
26-
actionmailer (5.1.4)
27-
actionpack (= 5.1.4)
28-
actionview (= 5.1.4)
29-
activejob (= 5.1.4)
25+
websocket-driver (>= 0.6.1)
26+
actionmailer (5.2.4.4)
27+
actionpack (= 5.2.4.4)
28+
actionview (= 5.2.4.4)
29+
activejob (= 5.2.4.4)
3030
mail (~> 2.5, >= 2.5.4)
3131
rails-dom-testing (~> 2.0)
32-
actionpack (5.1.4)
33-
actionview (= 5.1.4)
34-
activesupport (= 5.1.4)
35-
rack (~> 2.0)
32+
actionpack (5.2.4.4)
33+
actionview (= 5.2.4.4)
34+
activesupport (= 5.2.4.4)
35+
rack (~> 2.0, >= 2.0.8)
3636
rack-test (>= 0.6.3)
3737
rails-dom-testing (~> 2.0)
3838
rails-html-sanitizer (~> 1.0, >= 1.0.2)
39-
actionview (5.1.4)
40-
activesupport (= 5.1.4)
39+
actionview (5.2.4.4)
40+
activesupport (= 5.2.4.4)
4141
builder (~> 3.1)
4242
erubi (~> 1.4)
4343
rails-dom-testing (~> 2.0)
4444
rails-html-sanitizer (~> 1.0, >= 1.0.3)
45-
activejob (5.1.4)
46-
activesupport (= 5.1.4)
45+
activejob (5.2.4.4)
46+
activesupport (= 5.2.4.4)
4747
globalid (>= 0.3.6)
48-
activemodel (5.1.4)
49-
activesupport (= 5.1.4)
50-
activerecord (5.1.4)
51-
activemodel (= 5.1.4)
52-
activesupport (= 5.1.4)
53-
arel (~> 8.0)
54-
activesupport (5.1.4)
48+
activemodel (5.2.4.4)
49+
activesupport (= 5.2.4.4)
50+
activerecord (5.2.4.4)
51+
activemodel (= 5.2.4.4)
52+
activesupport (= 5.2.4.4)
53+
arel (>= 9.0)
54+
activestorage (5.2.4.4)
55+
actionpack (= 5.2.4.4)
56+
activerecord (= 5.2.4.4)
57+
marcel (~> 0.3.1)
58+
activesupport (5.2.4.4)
5559
concurrent-ruby (~> 1.0, >= 1.0.2)
56-
i18n (~> 0.7)
60+
i18n (>= 0.7, < 2)
5761
minitest (~> 5.1)
5862
tzinfo (~> 1.1)
5963
addressable (2.5.2)
6064
public_suffix (>= 2.0.2, < 4.0)
61-
arel (8.0.0)
65+
arel (9.0.0)
6266
ast (2.4.0)
6367
awesome_print (1.8.0)
6468
bindex (0.5.0)
6569
bootstrap-datepicker-rails (1.7.1.1)
6670
railties (>= 3.0)
67-
builder (3.2.3)
71+
builder (3.2.4)
6872
bundle-audit (0.1.0)
6973
bundler-audit
7074
bundler-audit (0.7.0.1)
@@ -89,13 +93,13 @@ GEM
8993
execjs
9094
coffee-script-source (1.12.2)
9195
concurrent-ruby (1.0.5)
92-
crass (1.0.3)
96+
crass (1.0.6)
9397
diff-lcs (1.3)
9498
domain_name (0.5.20190701)
9599
unf (>= 0.0.5, < 1.0.0)
96100
down (5.2.0)
97101
addressable (~> 2.5)
98-
erubi (1.7.0)
102+
erubi (1.10.0)
99103
execjs (2.7.0)
100104
factory_bot (4.8.2)
101105
activesupport (>= 3.0.0)
@@ -109,12 +113,12 @@ GEM
109113
ruby2_keywords
110114
faraday_middleware (1.0.0)
111115
faraday (~> 1.0)
112-
ffi (1.9.18)
116+
ffi (1.14.2)
113117
ffi-compiler (1.0.1)
114118
ffi (>= 1.0.0)
115119
rake
116-
font-awesome-rails (4.7.0.2)
117-
railties (>= 3.2, < 5.2)
120+
font-awesome-rails (4.7.0.7)
121+
railties (>= 3.2, < 7)
118122
formatador (0.2.5)
119123
globalid (0.4.2)
120124
activesupport (>= 4.2.0)
@@ -158,7 +162,7 @@ GEM
158162
jbuilder (2.7.0)
159163
activesupport (>= 4.2.0)
160164
multi_json (>= 1.2)
161-
jquery-rails (4.3.1)
165+
jquery-rails (4.4.0)
162166
rails-dom-testing (>= 1, < 3)
163167
railties (>= 4.2.0)
164168
thor (>= 0.14, < 2.0)
@@ -175,22 +179,26 @@ GEM
175179
rb-fsevent (~> 0.9, >= 0.9.4)
176180
rb-inotify (~> 0.9, >= 0.9.7)
177181
ruby_dep (~> 1.2)
178-
loofah (2.1.1)
182+
loofah (2.9.0)
179183
crass (~> 1.0.2)
180184
nokogiri (>= 1.5.9)
181185
lumberjack (1.0.12)
182186
mail (2.7.1)
183187
mini_mime (>= 0.1.1)
188+
marcel (0.3.3)
189+
mimemagic (~> 0.3.2)
184190
method_source (0.9.0)
191+
mimemagic (0.3.5)
185192
mini_mime (1.0.0)
186-
mini_portile2 (2.3.0)
187-
minitest (5.10.3)
193+
mini_portile2 (2.5.0)
194+
minitest (5.14.3)
188195
multi_json (1.12.2)
189196
multipart-post (2.1.1)
190197
nenv (0.3.0)
191-
nio4r (2.5.4)
192-
nokogiri (1.8.1)
193-
mini_portile2 (~> 2.3.0)
198+
nio4r (2.5.5)
199+
nokogiri (1.11.1)
200+
mini_portile2 (~> 2.5.0)
201+
racc (~> 1.4)
194202
notiffany (0.1.1)
195203
nenv (~> 0.1)
196204
shellany (~> 0.0)
@@ -205,20 +213,22 @@ GEM
205213
pry (>= 0.10.4)
206214
public_suffix (3.0.1)
207215
puma (3.12.6)
208-
rack (2.0.8)
216+
racc (1.5.2)
217+
rack (2.2.3)
209218
rack-test (0.8.2)
210219
rack (>= 1.0, < 3)
211-
rails (5.1.4)
212-
actioncable (= 5.1.4)
213-
actionmailer (= 5.1.4)
214-
actionpack (= 5.1.4)
215-
actionview (= 5.1.4)
216-
activejob (= 5.1.4)
217-
activemodel (= 5.1.4)
218-
activerecord (= 5.1.4)
219-
activesupport (= 5.1.4)
220+
rails (5.2.4.4)
221+
actioncable (= 5.2.4.4)
222+
actionmailer (= 5.2.4.4)
223+
actionpack (= 5.2.4.4)
224+
actionview (= 5.2.4.4)
225+
activejob (= 5.2.4.4)
226+
activemodel (= 5.2.4.4)
227+
activerecord (= 5.2.4.4)
228+
activestorage (= 5.2.4.4)
229+
activesupport (= 5.2.4.4)
220230
bundler (>= 1.3.0)
221-
railties (= 5.1.4)
231+
railties (= 5.2.4.4)
222232
sprockets-rails (>= 2.0.0)
223233
rails-assets-bootstrap (3.3.7)
224234
rails-assets-jquery (>= 1.9.1, < 4)
@@ -230,15 +240,15 @@ GEM
230240
rails-dom-testing (2.0.3)
231241
activesupport (>= 4.2.0)
232242
nokogiri (>= 1.6)
233-
rails-html-sanitizer (1.0.3)
234-
loofah (~> 2.0)
243+
rails-html-sanitizer (1.3.0)
244+
loofah (~> 2.3)
235245
rails_layout (1.0.41)
236-
railties (5.1.4)
237-
actionpack (= 5.1.4)
238-
activesupport (= 5.1.4)
246+
railties (5.2.4.4)
247+
actionpack (= 5.2.4.4)
248+
activesupport (= 5.2.4.4)
239249
method_source
240250
rake (>= 0.8.7)
241-
thor (>= 0.18.1, < 2.0)
251+
thor (>= 0.19.0, < 2.0)
242252
rainbow (3.0.0)
243253
rake (13.0.1)
244254
rb-fchange (0.0.6)
@@ -300,7 +310,7 @@ GEM
300310
spring-watcher-listen (2.0.1)
301311
listen (>= 2.7, < 4.0)
302312
spring (>= 1.2, < 3.0)
303-
sprockets (3.7.1)
313+
sprockets (3.7.2)
304314
concurrent-ruby (~> 1.0)
305315
rack (> 1, < 3)
306316
sprockets-rails (3.2.1)
@@ -314,7 +324,7 @@ GEM
314324
turbolinks (5.0.1)
315325
turbolinks-source (~> 5)
316326
turbolinks-source (5.0.3)
317-
tzinfo (1.2.4)
327+
tzinfo (1.2.9)
318328
thread_safe (~> 0.1)
319329
uglifier (4.0.2)
320330
execjs (>= 0.3.0, < 3)
@@ -327,7 +337,7 @@ GEM
327337
activemodel (>= 5.0)
328338
bindex (>= 0.4.0)
329339
railties (>= 5.0)
330-
websocket-driver (0.6.5)
340+
websocket-driver (0.7.3)
331341
websocket-extensions (>= 0.1.0)
332342
websocket-extensions (0.1.5)
333343
will_paginate (3.1.6)
@@ -361,7 +371,7 @@ DEPENDENCIES
361371
listen (>= 3.0.5, < 3.2)
362372
pry-rails
363373
puma (~> 3.12)
364-
rails (~> 5.1.4)
374+
rails (~> 5.2.4)
365375
rails-assets-bootstrap (~> 3.3.7)!
366376
rails-assets-js-cookie (~> 2.2.0)!
367377
rails-assets-metismenu (~> 2.0)!

0 commit comments

Comments
 (0)