Skip to content

Commit

Permalink
Upgrading nokogiri gem due to security vulnerability
Browse files Browse the repository at this point in the history
Note that this upgrade changes minimum required ruby version from
1.9.3-p551 to 2.1.8.

```
$ bundle audit check
Name: nokogiri
Version: 1.6.8.1
Advisory: CVE-2016-4658
Criticality: Unknown
URL: sparklemotion/nokogiri#1615
Title: Nokogiri gem contains several vulnerabilities in libxml2 and libxslt
Solution: upgrade to >= 1.7.1

Name: nokogiri
Version: 1.6.8.1
Advisory: CVE-2017-5029
Criticality: Unknown
URL: sparklemotion/nokogiri#1634
Title: Nokogiri gem contains two upstream vulnerabilities in libxslt 1.1.29
Solution: upgrade to >= 1.7.2

Name: nokogiri
Version: 1.6.8.1
Advisory: CVE-2016-4658
Criticality: Unknown
URL: sparklemotion/nokogiri#1615
Title: Nokogiri gem contains several vulnerabilities in libxml2 and libxslt
Solution: upgrade to >= 1.7.1

Name: nokogiri
Version: 1.6.8.1
Advisory: CVE-2017-5029
Criticality: Unknown
URL: sparklemotion/nokogiri#1634
Title: Nokogiri gem contains two upstream vulnerabilities in libxslt 1.1.29
Solution: upgrade to >= 1.7.2

Vulnerabilities found!
```
  • Loading branch information
juchem committed Apr 23, 2018
1 parent 2ee9501 commit cc27c59
Showing 1 changed file with 5 additions and 5 deletions.
10 changes: 5 additions & 5 deletions Gemfile.lock
Original file line number Diff line number Diff line change
Expand Up @@ -23,7 +23,7 @@ GEM
aws-sdk-v1 (= 1.67.0)
aws-sdk-v1 (1.67.0)
json (~> 1.4)
nokogiri (~> 1)
nokogiri (>= 1.7.2)
coderay (1.1.0)
crack (0.4.3)
safe_yaml (~> 1.0.0)
Expand All @@ -46,12 +46,12 @@ GEM
little-plugger (>= 1.1.3)
multi_json (>= 1.8.4)
method_source (0.8.2)
mini_portile2 (2.1.0)
mini_portile2 (2.3.0)
minitest (5.9.0)
multi_json (1.13.1)
nokogiri (1.6.8.1)
mini_portile2 (~> 2.1.0)
nokogiri (1.6.8.1-java)
nokogiri (1.8.2)
mini_portile2 (~> 2.3.0)
nokogiri (1.8.2-java)
pry (0.10.3)
coderay (~> 1.1.0)
method_source (~> 0.8.1)
Expand Down

0 comments on commit cc27c59

Please sign in to comment.