Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update Rails to 7.0.8.1 #2536

Merged
merged 1 commit into from
Feb 27, 2024
Merged

Update Rails to 7.0.8.1 #2536

merged 1 commit into from
Feb 27, 2024

Conversation

nickcharlton
Copy link
Member

This was carried out with: bundle update rails --patch, to fix:

Name: actionpack
Version: 7.0.7.2
CVE: CVE-2024-26143
Criticality: Unknown
URL: https://discuss.rubyonrails.org/t/possible-xss-vulnerability-in-action-controller/84947
Title: Possible XSS Vulnerability in Action Controller
Solution: upgrade to '~> 7.0.8, >= 7.0.8.1', '>= 7.1.3.1'

Name: activestorage
Version: 7.0.7.2
CVE: CVE-2024-26144
Criticality: Unknown
URL: https://discuss.rubyonrails.org/t/possible-sensitive-session-information-leak-in-active-storage/84945
Title: Possible Sensitive Session Information Leak in Active Storage
Solution: upgrade to '~> 6.1.7, >= 6.1.7.7', '>= 7.0.8.1'

Name: rack
Version: 2.2.8
CVE: CVE-2024-25126
Criticality: Unknown
URL: https://discuss.rubyonrails.org/t/denial-of-service-vulnerability-in-rack-content-type-parsing/84941
Title: Denial of Service Vulnerability in Rack Content-Type Parsing
Solution: upgrade to '~> 2.2.8, >= 2.2.8.1', '>= 3.0.9.1'

Name: rack
Version: 2.2.8
CVE: CVE-2024-26141
Criticality: Unknown
URL: https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944
Title: Possible DoS Vulnerability with Range Header in Rack
Solution: upgrade to '~> 2.2.8, >= 2.2.8.1', '>= 3.0.9.1'

Name: rack
Version: 2.2.8
CVE: CVE-2024-26146
Criticality: Unknown
URL: https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942
Title: Possible Denial of Service Vulnerability in Rack Header Parsing
Solution: upgrade to '~> 2.0.9, >= 2.0.9.4', '~> 2.1.4, >= 2.1.4.4', '~> 2.2.8, >= 2.2.8.1', '>= 3.0.9.1'

This was carried out with: `bundle update rails --patch`, to fix:

    Name: actionpack
    Version: 7.0.7.2
    CVE: CVE-2024-26143
    Criticality: Unknown
    URL: https://discuss.rubyonrails.org/t/possible-xss-vulnerability-in-action-controller/84947
    Title: Possible XSS Vulnerability in Action Controller
    Solution: upgrade to '~> 7.0.8, >= 7.0.8.1', '>= 7.1.3.1'

    Name: activestorage
    Version: 7.0.7.2
    CVE: CVE-2024-26144
    Criticality: Unknown
    URL: https://discuss.rubyonrails.org/t/possible-sensitive-session-information-leak-in-active-storage/84945
    Title: Possible Sensitive Session Information Leak in Active Storage
    Solution: upgrade to '~> 6.1.7, >= 6.1.7.7', '>= 7.0.8.1'

    Name: rack
    Version: 2.2.8
    CVE: CVE-2024-25126
    Criticality: Unknown
    URL: https://discuss.rubyonrails.org/t/denial-of-service-vulnerability-in-rack-content-type-parsing/84941
    Title: Denial of Service Vulnerability in Rack Content-Type Parsing
    Solution: upgrade to '~> 2.2.8, >= 2.2.8.1', '>= 3.0.9.1'

    Name: rack
    Version: 2.2.8
    CVE: CVE-2024-26141
    Criticality: Unknown
    URL: https://discuss.rubyonrails.org/t/possible-dos-vulnerability-with-range-header-in-rack/84944
    Title: Possible DoS Vulnerability with Range Header in Rack
    Solution: upgrade to '~> 2.2.8, >= 2.2.8.1', '>= 3.0.9.1'

    Name: rack
    Version: 2.2.8
    CVE: CVE-2024-26146
    Criticality: Unknown
    URL: https://discuss.rubyonrails.org/t/possible-denial-of-service-vulnerability-in-rack-header-parsing/84942
    Title: Possible Denial of Service Vulnerability in Rack Header Parsing
    Solution: upgrade to '~> 2.0.9, >= 2.0.9.4', '~> 2.1.4, >= 2.1.4.4', '~> 2.2.8, >= 2.2.8.1', '>= 3.0.9.1'
@nickcharlton
Copy link
Member Author

We're hitting #2523, occasionally here. But otherwise it's fine.

@nickcharlton nickcharlton merged commit 1a87f21 into main Feb 27, 2024
9 of 10 checks passed
@nickcharlton nickcharlton deleted the nc-upgrade-rails-to-7.0.8.1 branch February 27, 2024 15:08
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant