Fix known security vunerabilities in required gems #182
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Trying to bundle on macOS Mojave I would get the following error:
ruby-2.5.0/ruby/intern.h:47:19: warning: 'register' storage class
specifier is deprecated and incompatible with C++17
[-Wdeprecated-register]
void rb_mem_clear(register VALUE*, register long);
^~~~~~~~~
ruby-2.5.1/include/ruby-2.5.0/ruby/intern.h:47:36: warning:
'register' storage class specifier is deprecated and incompatible
with C++17 [-Wdeprecated-register]
void rb_mem_clear(register VALUE*, register long);
^~~~~~~~~
This was fixed by bumping the gem from 0.2.0 to 0.2.4.
There were two CVEs filed against the rack gem, this bumps the version from 2.0.5 to 2.0.6. [CVE-2018-16471][1] > moderate severity > Vulnerable versions: >= 2.0.0, < 2.0.6 > Patched version: 2.0.6 > > There is a possible XSS vulnerability in Rack before 2.0.6 and 1.6.11. > Carefully crafted requests can impact the data returned by the scheme > method on Rack::Request. Applications that expect the scheme to be > limited to 'http' or 'https' and do not escape the return value could be > vulnerable to an XSS attack. Note that applications using the normal > escaping mechanisms provided by Rails may not impacted, but applications > that bypass the escaping mechanisms, or do not use them may be > vulnerable. [CVE-2018-16470][2] > moderate severity > Vulnerable versions: >= 2.0.4, < 2.0.6 > Patched version: 2.0.6 > > There is a possible DoS vulnerability in the multipart parser in Rack > before 2.0.6. Specially crafted requests can cause the multipart parser > to enter a pathological state, causing the parser to use CPU resources > disproportionate to the request size. [1]: https://nvd.nist.gov/vuln/detail/CVE-2018-16471 [2]: https://nvd.nist.gov/vuln/detail/CVE-2018-16470
There was one CVE filed against the loofah gem, this bumps the version from 1.8.4 to 1.8.5 [CVE-2018-16468][1] > moderate severity > Vulnerable versions: < 2.2.3 > Patched version: 2.2.3 > > In the Loofah gem for Ruby, through version 2.2.2, unsanitized > JavaScript may occur in sanitized output when a crafted SVG element is > republished. Users are advised to upgrade to version 2.2.3. See flavorjones/loofah#154 for more details. [1]: https://nvd.nist.gov/vuln/detail/CVE-2018-16468
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The rails app had potential security vulnerabilities in its dependencies. This updates the following gems to patch those CVEs:
rackloofahI also updated
mini_racergem because I couldn't get the dependency tree to build on macOS. I was able to still build with Docker after the update.Note: I still have a failing spec, but according to @mirandawang on slack that looks like a defunct test case. I left it in place to keep the changes in the PR small.