Skip to content

Commit 4884737

Browse files
KoronenKoronen
committed
Update vulnerable gems
Updates four vulnerable gems, as reported by the `bundler-audit` gem. - [X] activesupport - [X] nokogiri - [X] rack - [X] rest-client ``` $ bundle-audit check Name: activesupport Version: 4.0.13 Advisory: CVE-2015-3227 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/rubyonrails-security/bahr2JLnxvk Title: Possible Denial of Service attack in Active Support Solution: upgrade to >= 4.2.2, ~> 4.1.11, ~> 3.2.22 Name: nokogiri Version: 1.6.1 Advisory: CVE-2015-5312 Criticality: High URL: https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s Title: Nokogiri gem contains several vulnerabilities in libxml2 Solution: upgrade to >= 1.6.7.1 Name: nokogiri Version: 1.6.1 Advisory: CVE-2015-7499 Criticality: Medium URL: https://groups.google.com/forum/#!topic/ruby-security-ann/Dy7YiKb_pMM Title: Nokogiri gem contains a heap-based buffer overflow vulnerability in libxml2 Solution: upgrade to >= 1.6.7.2 Name: nokogiri Version: 1.6.1 Advisory: CVE-2015-1819 Criticality: Unknown URL: sparklemotion/nokogiri#1374 Title: Nokogiri gem contains several vulnerabilities in libxml2 and libxslt Solution: upgrade to ~> 1.6.6.4, >= 1.6.7.rc4 Name: nokogiri Version: 1.6.1 Advisory: 118481 Criticality: Unknown URL: sparklemotion/nokogiri#1087 Title: Nokogiri Gem for JRuby XML Document Root Element Handling Memory Consumption Remote DoS Solution: upgrade to >= 1.6.3 Name: rack Version: 1.5.2 Advisory: CVE-2015-3225 Criticality: Unknown URL: https://groups.google.com/forum/#!topic/ruby-security-ann/gcUbICUmKMc Title: Potential Denial of Service Vulnerability in Rack Solution: upgrade to >= 1.6.2, ~> 1.5.4, ~> 1.4.6 Name: rest-client Version: 1.6.7 Advisory: CVE-2015-1820 Criticality: Unknown URL: rest-client/rest-client#369 Title: rubygem-rest-client: session fixation vulnerability via Set-Cookie headers in 30x redirection responses Solution: upgrade to >= 1.8.0 Name: rest-client Version: 1.6.7 Advisory: CVE-2015-3448 Criticality: Unknown URL: http://www.osvdb.org/show/osvdb/117461 Title: Rest-Client Gem for Ruby logs password information in plaintext Solution: upgrade to >= 1.7.3 Vulnerabilities found! ```
1 parent 1fcb2ef commit 4884737

2 files changed

Lines changed: 50 additions & 40 deletions

File tree

‎Gemfile‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -23,16 +23,16 @@ group :development, :test do
2323
gem "timecop", "~> 0.7.1"
2424
end
2525

26-
gem "activerecord", "~> 4.0"
27-
gem "arel", "~> 4.0.2"
26+
gem "activerecord", "~> 4.1.11"
27+
gem "arel", "~> 5.0"
2828
gem "bcrypt-ruby", "~> 3.1.2"
29-
gem "delayed_job", "~> 4.0"
30-
gem "delayed_job_active_record", "~> 4.0"
29+
gem "delayed_job", "~> 4.1"
30+
gem "delayed_job_active_record", "~> 4.1"
3131
gem "feedbag", "~> 0.9.2"
3232
gem "feedjira", "~> 1.3.0"
3333
gem "i18n", "~> 0.6.9"
3434
gem "loofah", "~> 2.0.0"
35-
gem "nokogiri", "~> 1.6"
35+
gem "nokogiri", "~> 1.6", ">= 1.6.7.2"
3636
gem "rack-ssl", "~> 1.4.1"
3737
gem "racksh", "~> 1.0"
3838
gem "rake", "~> 10.1", ">= 10.1.1"

‎Gemfile.lock‎

Lines changed: 45 additions & 35 deletions
Original file line numberDiff line numberDiff line change
@@ -1,28 +1,26 @@
11
GEM
22
remote: https://rubygems.org/
33
specs:
4-
activemodel (4.0.13)
5-
activesupport (= 4.0.13)
6-
builder (~> 3.1.0)
7-
activerecord (4.0.13)
8-
activemodel (= 4.0.13)
9-
activerecord-deprecated_finders (~> 1.0.2)
10-
activesupport (= 4.0.13)
11-
arel (~> 4.0.0)
12-
activerecord-deprecated_finders (1.0.3)
13-
activesupport (4.0.13)
4+
activemodel (4.1.14)
5+
activesupport (= 4.1.14)
6+
builder (~> 3.1)
7+
activerecord (4.1.14)
8+
activemodel (= 4.1.14)
9+
activesupport (= 4.1.14)
10+
arel (~> 5.0.0)
11+
activesupport (4.1.14)
1412
i18n (~> 0.6, >= 0.6.9)
15-
minitest (~> 4.2)
16-
multi_json (~> 1.3)
13+
json (~> 1.7, >= 1.7.7)
14+
minitest (~> 5.1)
1715
thread_safe (~> 0.1)
18-
tzinfo (~> 0.3.37)
19-
arel (4.0.2)
16+
tzinfo (~> 1.1)
17+
arel (5.0.1.20140414130214)
2018
ast (2.1.0)
2119
astrolabe (1.3.1)
2220
parser (~> 2.2)
2321
backports (3.6.1)
2422
bcrypt-ruby (3.1.2)
25-
builder (3.1.4)
23+
builder (3.2.2)
2624
byebug (2.5.0)
2725
columnize (~> 0.3.6)
2826
debugger-linecache (~> 1.2.0)
@@ -42,13 +40,15 @@ GEM
4240
thor
4341
curb (0.8.6)
4442
debugger-linecache (1.2.0)
45-
delayed_job (4.0.0)
46-
activesupport (>= 3.0, < 4.1)
47-
delayed_job_active_record (4.0.0)
48-
activerecord (>= 3.0, < 4.1)
49-
delayed_job (>= 3.0, < 4.1)
43+
delayed_job (4.1.1)
44+
activesupport (>= 3.0, < 5.0)
45+
delayed_job_active_record (4.1.0)
46+
activerecord (>= 3.0, < 5)
47+
delayed_job (>= 3.0, < 5)
5048
diff-lcs (1.2.5)
5149
docile (1.1.1)
50+
domain_name (0.5.25)
51+
unf (>= 0.0.5, < 1.0.0)
5252
faker (1.2.0)
5353
i18n (~> 0.5)
5454
feedbag (0.9.2)
@@ -58,18 +58,22 @@ GEM
5858
loofah (~> 2.0.0)
5959
sax-machine (~> 0.2.1)
6060
hpricot (0.8.6)
61+
http-cookie (1.0.2)
62+
domain_name (~> 0.5)
6163
i18n (0.6.11)
6264
jsmin (1.0.1)
65+
json (1.8.3)
6366
kgio (2.9.3)
6467
loofah (2.0.0)
6568
nokogiri (>= 1.5.9)
6669
method_source (0.8.2)
67-
mime-types (2.0)
68-
mini_portile (0.5.2)
69-
minitest (4.7.5)
70-
multi_json (1.11.0)
71-
nokogiri (1.6.1)
72-
mini_portile (~> 0.5.0)
70+
mime-types (2.99)
71+
mini_portile2 (2.0.0)
72+
minitest (5.8.4)
73+
multi_json (1.11.2)
74+
netrc (0.11.0)
75+
nokogiri (1.6.7.2)
76+
mini_portile2 (~> 2.0.0.rc2)
7377
parser (2.2.3.0)
7478
ast (>= 1.1, < 3.0)
7579
pg (0.17.1)
@@ -81,7 +85,7 @@ GEM
8185
pry-byebug (1.2.0)
8286
byebug (~> 2.2)
8387
pry (~> 0.9.12)
84-
rack (1.5.2)
88+
rack (1.6.4)
8589
rack-protection (1.5.3)
8690
rack
8791
rack-ssl (1.4.1)
@@ -94,8 +98,10 @@ GEM
9498
rainbow (2.0.0)
9599
raindrops (0.13.0)
96100
rake (10.1.1)
97-
rest-client (1.6.7)
98-
mime-types (>= 1.16)
101+
rest-client (1.8.0)
102+
http-cookie (>= 1.0.2, < 2.0)
103+
mime-types (>= 1.16, < 3.0)
104+
netrc (~> 0.7)
99105
rspec (2.14.1)
100106
rspec-core (~> 2.14.0)
101107
rspec-expectations (~> 2.14.0)
@@ -155,7 +161,11 @@ GEM
155161
tilt (1.4.1)
156162
timecop (0.7.1)
157163
tins (0.13.1)
158-
tzinfo (0.3.43)
164+
tzinfo (1.2.2)
165+
thread_safe (~> 0.1)
166+
unf (0.1.4)
167+
unf_ext
168+
unf_ext (0.0.7.1)
159169
unicorn (4.7.0)
160170
kgio (~> 2.6)
161171
rack
@@ -168,19 +178,19 @@ PLATFORMS
168178
ruby
169179

170180
DEPENDENCIES
171-
activerecord (~> 4.0)
172-
arel (~> 4.0.2)
181+
activerecord (~> 4.1.11)
182+
arel (~> 5.0)
173183
bcrypt-ruby (~> 3.1.2)
174184
capybara (~> 2.4.1)
175185
coveralls (~> 0.7)
176-
delayed_job (~> 4.0)
177-
delayed_job_active_record (~> 4.0)
186+
delayed_job (~> 4.1)
187+
delayed_job_active_record (~> 4.1)
178188
faker (~> 1.2)
179189
feedbag (~> 0.9.2)
180190
feedjira (~> 1.3.0)
181191
i18n (~> 0.6.9)
182192
loofah (~> 2.0.0)
183-
nokogiri (~> 1.6)
193+
nokogiri (~> 1.6, >= 1.6.7.2)
184194
pg (~> 0.17.1)
185195
pry-byebug (~> 1.2)
186196
rack-protection (~> 1.5.3)

0 commit comments

Comments
 (0)