Skip to content

Commit

Permalink
Update vulnerable gems
Browse files Browse the repository at this point in the history 
Updates four vulnerable gems, as reported by the `bundler-audit` gem.

- [X] activesupport
- [X] nokogiri
- [X] rack
- [X] rest-client

    $ bundle-audit check
    Name: activesupport
    Version: 4.0.13
    Advisory: CVE-2015-3227
    Criticality: Unknown
    URL: https://groups.google.com/forum/#!topic/rubyonrails-security/bahr2JLnxvk
    Title: Possible Denial of Service attack in Active Support
    Solution: upgrade to >= 4.2.2, ~> 4.1.11, ~> 3.2.22

    Name: nokogiri
    Version: 1.6.1
    Advisory: CVE-2015-5312
    Criticality: High
    URL: https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s
    Title: Nokogiri gem contains several vulnerabilities in libxml2
    Solution: upgrade to >= 1.6.7.1

    Name: nokogiri
    Version: 1.6.1
    Advisory: CVE-2015-7499
    Criticality: Medium
    URL: https://groups.google.com/forum/#!topic/ruby-security-ann/Dy7YiKb_pMM
    Title: Nokogiri gem contains a heap-based buffer overflow vulnerability in
           libxml2
    Solution: upgrade to >= 1.6.7.2

    Name: nokogiri
    Version: 1.6.1
    Advisory: CVE-2015-1819
    Criticality: Unknown
    URL: sparklemotion/nokogiri#1374
    Title: Nokogiri gem contains several vulnerabilities in libxml2 and libxslt
    Solution: upgrade to ~> 1.6.6.4, >= 1.6.7.rc4

    Name: nokogiri
    Version: 1.6.1
    Advisory: 118481
    Criticality: Unknown
    URL: sparklemotion/nokogiri#1087
    Title: Nokogiri Gem for JRuby XML Document Root Element Handling Memory
           Consumption
    Remote DoS
    Solution: upgrade to >= 1.6.3

    Name: rack
    Version: 1.5.2
    Advisory: CVE-2015-3225
    Criticality: Unknown
    URL: https://groups.google.com/forum/#!topic/ruby-security-ann/gcUbICUmKMc
    Title: Potential Denial of Service Vulnerability in Rack
    Solution: upgrade to >= 1.6.2, ~> 1.5.4, ~> 1.4.6

    Name: rest-client
    Version: 1.6.7
    Advisory: CVE-2015-1820
    Criticality: Unknown
    URL: rest-client/rest-client#369
    Title: rubygem-rest-client: session fixation vulnerability via Set-Cookie
           headers in 30x redirection responses
    Solution: upgrade to >= 1.8.0

    Name: rest-client
    Version: 1.6.7
    Advisory: CVE-2015-3448
    Criticality: Unknown
    URL: http://www.osvdb.org/show/osvdb/117461
    Title: Rest-Client Gem for Ruby logs password information in plaintext
    Solution: upgrade to >= 1.7.3

    Vulnerabilities found!
  • Loading branch information
@Koronen
Koronen committed Jan 24, 2016
1 parent 1fcb2ef commit abed0d6
Show file tree
Hide file tree
Showing 2 changed files with 50 additions and 40 deletions.
10 changes: 5 additions & 5 deletions Gemfile
View file
Original file line number Diff line number Diff line change
Expand Up @@ -23,16 +23,16 @@ group :development, :test do
gem "timecop", "~> 0.7.1"
end

gem "activerecord", "~> 4.0"
gem "arel", "~> 4.0.2"
gem "activerecord", "~> 4.1"
gem "arel", "~> 5.0"
gem "bcrypt-ruby", "~> 3.1.2"
gem "delayed_job", "~> 4.0"
gem "delayed_job_active_record", "~> 4.0"
gem "delayed_job", "~> 4.1"
gem "delayed_job_active_record", "~> 4.1"
gem "feedbag", "~> 0.9.2"
gem "feedjira", "~> 1.3.0"
gem "i18n", "~> 0.6.9"
gem "loofah", "~> 2.0.0"
gem "nokogiri", "~> 1.6"
gem "nokogiri", "~> 1.6", ">= 1.6.7.2"
gem "rack-ssl", "~> 1.4.1"
gem "racksh", "~> 1.0"
gem "rake", "~> 10.1", ">= 10.1.1"
Expand Down
80 changes: 45 additions & 35 deletions Gemfile.lock
View file
Original file line number Diff line number Diff line change
@@ -1,28 +1,26 @@
GEM
remote: https://rubygems.org/
specs:
activemodel (4.0.13)
activesupport (= 4.0.13)
builder (~> 3.1.0)
activerecord (4.0.13)
activemodel (= 4.0.13)
activerecord-deprecated_finders (~> 1.0.2)
activesupport (= 4.0.13)
arel (~> 4.0.0)
activerecord-deprecated_finders (1.0.3)
activesupport (4.0.13)
activemodel (4.1.14)
activesupport (= 4.1.14)
builder (~> 3.1)
activerecord (4.1.14)
activemodel (= 4.1.14)
activesupport (= 4.1.14)
arel (~> 5.0.0)
activesupport (4.1.14)
i18n (~> 0.6, >= 0.6.9)
minitest (~> 4.2)
multi_json (~> 1.3)
json (~> 1.7, >= 1.7.7)
minitest (~> 5.1)
thread_safe (~> 0.1)
tzinfo (~> 0.3.37)
arel (4.0.2)
tzinfo (~> 1.1)
arel (5.0.1.20140414130214)
ast (2.1.0)
astrolabe (1.3.1)
parser (~> 2.2)
backports (3.6.1)
bcrypt-ruby (3.1.2)
builder (3.1.4)
builder (3.2.2)
byebug (2.5.0)
columnize (~> 0.3.6)
debugger-linecache (~> 1.2.0)
Expand All @@ -42,13 +40,15 @@ GEM
thor
curb (0.8.6)
debugger-linecache (1.2.0)
delayed_job (4.0.0)
activesupport (>= 3.0, < 4.1)
delayed_job_active_record (4.0.0)
activerecord (>= 3.0, < 4.1)
delayed_job (>= 3.0, < 4.1)
delayed_job (4.1.1)
activesupport (>= 3.0, < 5.0)
delayed_job_active_record (4.1.0)
activerecord (>= 3.0, < 5)
delayed_job (>= 3.0, < 5)
diff-lcs (1.2.5)
docile (1.1.1)
domain_name (0.5.25)
unf (>= 0.0.5, < 1.0.0)
faker (1.2.0)
i18n (~> 0.5)
feedbag (0.9.2)
Expand All @@ -58,18 +58,22 @@ GEM
loofah (~> 2.0.0)
sax-machine (~> 0.2.1)
hpricot (0.8.6)
http-cookie (1.0.2)
domain_name (~> 0.5)
i18n (0.6.11)
jsmin (1.0.1)
json (1.8.3)
kgio (2.9.3)
loofah (2.0.0)
nokogiri (>= 1.5.9)
method_source (0.8.2)
mime-types (2.0)
mini_portile (0.5.2)
minitest (4.7.5)
multi_json (1.11.0)
nokogiri (1.6.1)
mini_portile (~> 0.5.0)
mime-types (2.99)
mini_portile2 (2.0.0)
minitest (5.8.4)
multi_json (1.11.2)
netrc (0.11.0)
nokogiri (1.6.7.2)
mini_portile2 (~> 2.0.0.rc2)
parser (2.2.3.0)
ast (>= 1.1, < 3.0)
pg (0.17.1)
Expand All @@ -81,7 +85,7 @@ GEM
pry-byebug (1.2.0)
byebug (~> 2.2)
pry (~> 0.9.12)
rack (1.5.2)
rack (1.6.4)
rack-protection (1.5.3)
rack
rack-ssl (1.4.1)
Expand All @@ -94,8 +98,10 @@ GEM
rainbow (2.0.0)
raindrops (0.13.0)
rake (10.1.1)
rest-client (1.6.7)
mime-types (>= 1.16)
rest-client (1.8.0)
http-cookie (>= 1.0.2, < 2.0)
mime-types (>= 1.16, < 3.0)
netrc (~> 0.7)
rspec (2.14.1)
rspec-core (~> 2.14.0)
rspec-expectations (~> 2.14.0)
Expand Down Expand Up @@ -155,7 +161,11 @@ GEM
tilt (1.4.1)
timecop (0.7.1)
tins (0.13.1)
tzinfo (0.3.43)
tzinfo (1.2.2)
thread_safe (~> 0.1)
unf (0.1.4)
unf_ext
unf_ext (0.0.7.1)
unicorn (4.7.0)
kgio (~> 2.6)
rack
Expand All @@ -168,19 +178,19 @@ PLATFORMS
ruby

DEPENDENCIES
activerecord (~> 4.0)
arel (~> 4.0.2)
activerecord (~> 4.1)
arel (~> 5.0)
bcrypt-ruby (~> 3.1.2)
capybara (~> 2.4.1)
coveralls (~> 0.7)
delayed_job (~> 4.0)
delayed_job_active_record (~> 4.0)
delayed_job (~> 4.1)
delayed_job_active_record (~> 4.1)
faker (~> 1.2)
feedbag (~> 0.9.2)
feedjira (~> 1.3.0)
i18n (~> 0.6.9)
loofah (~> 2.0.0)
nokogiri (~> 1.6)
nokogiri (~> 1.6, >= 1.6.7.2)
pg (~> 0.17.1)
pry-byebug (~> 1.2)
rack-protection (~> 1.5.3)
Expand Down

0 comments on commit abed0d6

Please sign in to comment.