Skip to content

Commit

Permalink
Upgrade Rails, Rack, Loofah, I18n for security reasons
Browse files Browse the repository at this point in the history
Numerous CVEs found:

     Name: loofah
     Version: 2.2.2
     Advisory: CVE-2018-16468
     Criticality: Unknown
     URL: flavorjones/loofah#154
     Title: Loofah XSS Vulnerability
     Solution: upgrade to >= 2.2.3

     Name: nokogiri
     Version: 1.8.4
     Advisory: CVE-2018-14404
     Criticality: Unknown
     URL: sparklemotion/nokogiri#1785
     Title: Nokogiri gem, via libxml2, is affected by multiple vulnerabilities
     Solution: upgrade to >= 1.8.5

     Name: rack
     Version: 2.0.5
     Advisory: CVE-2018-16470
     Criticality: Unknown
     URL: https://groups.google.com/forum/#!topic/ruby-security-ann/Dz4sRl-ktKk
     Title: Possible DoS vulnerability in Rack
     Solution: upgrade to >= 2.0.6

     Name: rack
     Version: 2.0.5
     Advisory: CVE-2018-16471
     Criticality: Unknown
     URL: https://groups.google.com/forum/#!topic/ruby-security-ann/NAalCee8n6o
     Title: Possible XSS vulnerability in Rack
     Solution: upgrade to ~> 1.6.11, >= 2.0.6
  • Loading branch information
francois committed Nov 12, 2018
1 parent 271baa4 commit 9e2c170
Showing 1 changed file with 9 additions and 9 deletions.
18 changes: 9 additions & 9 deletions Gemfile.lock
Expand Up @@ -89,7 +89,7 @@ GEM
chromedriver-helper (1.2.0)
archive-zip (~> 0.10)
nokogiri (~> 1.8)
concurrent-ruby (1.0.5)
concurrent-ruby (1.1.3)
crass (1.0.4)
dotenv (2.5.0)
dotenv-rails (2.5.0)
Expand All @@ -103,7 +103,7 @@ GEM
globalid (0.4.1)
activesupport (>= 4.2.0)
hookup (1.2.4)
i18n (1.1.0)
i18n (1.1.1)
concurrent-ruby (~> 1.0)
io-like (0.3.0)
jbuilder (2.7.0)
Expand All @@ -126,14 +126,14 @@ GEM
rb-fsevent (~> 0.9, >= 0.9.4)
rb-inotify (~> 0.9, >= 0.9.7)
ruby_dep (~> 1.2)
loofah (2.2.2)
loofah (2.2.3)
crass (~> 1.0.2)
nokogiri (>= 1.5.9)
mail (2.7.0)
mail (2.7.1)
mini_mime (>= 0.1.1)
marcel (0.3.2)
marcel (0.3.3)
mimemagic (~> 0.3.2)
method_source (0.9.0)
method_source (0.9.2)
mimemagic (0.3.2)
mini_magick (4.8.0)
mini_mime (1.0.1)
Expand All @@ -143,7 +143,7 @@ GEM
multi_json (1.13.1)
multipart-post (2.0.0)
nio4r (2.3.1)
nokogiri (1.8.4)
nokogiri (1.8.5)
mini_portile2 (~> 2.3.0)
pdf-core (0.7.0)
pg (1.1.2)
Expand All @@ -154,7 +154,7 @@ GEM
prawn (>= 1.3.0, < 3.0.0)
public_suffix (3.0.3)
puma (3.12.0)
rack (2.0.5)
rack (2.0.6)
rack-test (1.1.0)
rack (>= 1.0, < 3)
rails (5.2.1)
Expand Down Expand Up @@ -221,7 +221,7 @@ GEM
activesupport (>= 4.0)
sprockets (>= 3.0.0)
state_machine (1.2.0)
thor (0.20.0)
thor (0.20.3)
thread_safe (0.3.6)
tilt (2.0.8)
ttfunk (1.5.1)
Expand Down

0 comments on commit 9e2c170

Please sign in to comment.