🚨 Your current dependencies have known security vulnerabilities 🚨
This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
There is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when
untrusted user input is written to the cache store using the raw: true parameter, re-reading the result
from the cache can evaluate the user input as a Marshalled object instead of plain text. Vulnerable code looks like:
data = cache.fetch("demo", raw: true) { untrusted_string }
Versions Affected: rails < 5.2.5, rails < 6.0.4
Not affected: Applications not using MemCacheStore or RedisCacheStore. Applications that do not use the raw option when storing untrusted user input.
Fixed Versions: rails >= 5.2.4.3, rails >= 6.0.3.1
Impact
Unmarshalling of untrusted user input can have impact up to and including RCE. At a minimum,
this vulnerability allows an attacker to inject untrusted Ruby objects into a web application.
In addition to upgrading to the latest versions of Rails, developers should ensure that whenever
they are calling Rails.cache.fetch they are using consistent values of the raw parameter for both
reading and writing, especially in the case of the RedisCacheStore which does not, prior to these changes,
detect if data was serialized using the raw option upon deserialization.
Workarounds
It is recommended that application developers apply the suggested patch or upgrade to the latest release as
soon as possible. If this is not possible, we recommend ensuring that all user-provided strings cached using
the raw argument should be double-checked to ensure that they conform to the expected format.
There is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when
untrusted user input is written to the cache store using the raw: true parameter, re-reading the result
from the cache can evaluate the user input as a Marshalled object instead of plain text. Vulnerable code looks like:
data = cache.fetch("demo", raw: true) { untrusted_string }
Versions Affected: rails < 5.2.5, rails < 6.0.4
Not affected: Applications not using MemCacheStore or RedisCacheStore. Applications that do not use the raw option when storing untrusted user input.
Fixed Versions: rails >= 5.2.4.3, rails >= 6.0.3.1
Impact
Unmarshalling of untrusted user input can have impact up to and including RCE. At a minimum,
this vulnerability allows an attacker to inject untrusted Ruby objects into a web application.
In addition to upgrading to the latest versions of Rails, developers should ensure that whenever
they are calling Rails.cache.fetch they are using consistent values of the raw parameter for both
reading and writing, especially in the case of the RedisCacheStore which does not, prior to these changes,
detect if data was serialized using the raw option upon deserialization.
Workarounds
It is recommended that application developers apply the suggested patch or upgrade to the latest release as
soon as possible. If this is not possible, we recommend ensuring that all user-provided strings cached using
the raw argument should be double-checked to ensure that they conform to the expected format.
The kramdown gem before 2.3.0 for Ruby processes the template option inside
Kramdown documents by default, which allows unintended read access (such as
template="/etc/passwd") or unintended embedded Ruby code execution (such as a
string that begins with template="string://<%= `). NOTE: kramdown is used in
Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.
In Nokogiri versions <= 1.11.0.rc3, XML Schemas parsed by Nokogiri::XML::Schema
are trusted by default, allowing external resources to be accessed over the
network, potentially enabling XXE or SSRF attacks.
This behavior is counter to
the security policy followed by Nokogiri maintainers, which is to treat all input
as untrusted by default whenever possible.
Please note that this security
fix was pushed into a new minor version, 1.11.x, rather than a patch release to
the 1.10.x branch, because it is a breaking change for some schemas and the risk
was assessed to be "Low Severity".
Affected Versions
Nokogiri <= 1.10.10 as well as prereleases 1.11.0.rc1, 1.11.0.rc2, and 1.11.0.rc3
Mitigation
There are no known workarounds for affected versions. Upgrade to Nokogiri 1.11.0.rc4 or later.
If, after upgrading to 1.11.0.rc4 or later, you wish
to re-enable network access for resolution of external resources (i.e., return to
the previous behavior):
Ensure the input is trusted. Do not enable this option
for untrusted input.
When invoking the Nokogiri::XML::Schema constructor,
pass as the second parameter an instance of Nokogiri::XML::ParseOptions with the NONET flag turned off.
So if your previous code was:
# in v1.11.0.rc3 and earlier, this call allows resources to be accessed over the network# but in v1.11.0.rc4 and later, this call will disallow network access for external resourcesschema=Nokogiri::XML::Schema.new(schema)# in v1.11.0.rc4 and later, the following is equivalent to the code above# (the second parameter is optional, and this demonstrates its default value)schema=Nokogiri::XML::Schema.new(schema,Nokogiri::XML::ParseOptions::DEFAULT_SCHEMA)
Then you can add the second parameter to indicate that the input is trusted by changing it to:
# in v1.11.0.rc3 and earlier, this would raise an ArgumentError# but in v1.11.0.rc4 and later, this allows resources to be accessed over the networkschema=Nokogiri::XML::Schema.new(trusted_schema,Nokogiri::XML::ParseOptions.new.nononet)
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.
All Depfu comment commands
@depfu rebase
Rebases against your default branch and redoes this update
@depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@depfu close
Closes this PR and deletes the branch
@depfu reopen
Restores the branch and reopens this PR (if it's closed)
@depfu pause
Ignores all future updates for this dependency and closes this PR
@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)
Commit-Lint commands
You can trigger Commit-Lint actions by commenting on this PR:
- `@Commit-Lint merge patch` will merge dependabot PR on "patch" versions (X.X.Y - Y change)
- `@Commit-Lint merge minor` will merge dependabot PR on "minor" versions (X.Y.Y - Y change)
- `@Commit-Lint merge major` will merge dependabot PR on "major" versions (Y.Y.Y - Y change)
- `@Commit-Lint merge disable` will desactivate merge dependabot PR
- `@Commit-Lint review` will approve dependabot PR
- `@Commit-Lint stop review` will stop approve dependabot PR
🚨 Your current dependencies have known security vulnerabilities 🚨
This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
What changed?
✳️ github-pages (204 → 212) · Repo
Release Notes
212
211
210
209
208
207
206
205
Does any of this look wrong? Please let us know.
Sorry, we couldn't find anything useful about this release.
↗️ activesupport (indirect, 5.2.4.1 → 6.0.3.5) · Repo · Changelog
Security Advisories 🚨
🚨 Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
🚨 Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
Release Notes
Too many releases to show here. View the full release notes.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ concurrent-ruby (indirect, 1.1.6 → 1.1.8) · Repo · Changelog
Release Notes
1.1.8 (from changelog)
1.1.7 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ dnsruby (indirect, 1.61.3 → 1.61.5) · Repo
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ em-websocket (indirect, 0.5.1 → 0.5.2) · Repo · Changelog
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ faraday (indirect, 1.0.0 → 1.3.0) · Repo · Changelog
Release Notes
1.3.0
1.2.0
1.1.0
1.0.1
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ ffi (indirect, 1.12.2 → 1.14.2) · Repo · Changelog
Release Notes
1.14.2 (from changelog)
1.14.1 (from changelog)
1.14.0 (from changelog)
1.13.1 (from changelog)
1.13.0 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ github-pages-health-check (indirect, 1.16.1 → 1.17.0) · Repo
Release Notes
1.17.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ html-pipeline (indirect, 2.12.3 → 2.14.0) · Repo · Changelog
Release Notes
2.14.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ jekyll (indirect, 3.8.5 → 3.9.0) · Repo · Changelog
Release Notes
3.9.0
3.8.7
3.8.6
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ jekyll-feed (indirect, 0.13.0 → 0.15.1) · Repo · Changelog
Release Notes
0.15.1
0.15.0
0.14.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ jekyll-mentions (indirect, 1.5.1 → 1.6.0) · Repo · Changelog
Release Notes
1.6.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ jekyll-redirect-from (indirect, 0.15.0 → 0.16.0) · Repo · Changelog
Release Notes
0.16.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ jekyll-remote-theme (indirect, 0.4.1 → 0.4.2) · Repo
Release Notes
0.4.2
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ jekyll-seo-tag (indirect, 2.6.1 → 2.7.1) · Repo · Changelog
Release Notes
2.7.1
2.7.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ jekyll-theme-hacker (indirect, 0.1.1 → 0.1.2) · Repo
Release Notes
0.1.2
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ jemoji (indirect, 0.11.1 → 0.12.0) · Repo · Changelog
Release Notes
0.12.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ kramdown (indirect, 1.17.0 → 2.3.0) · Repo · Changelog
Security Advisories 🚨
🚨 Unintended read access in kramdown gem
↗️ listen (indirect, 3.2.1 → 3.4.1) · Repo · Changelog
Release Notes
3.4.0
3.3.4
3.3.3
3.3.2
3.3.1
3.3.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ mini_portile2 (indirect, 2.4.0 → 2.5.0) · Repo · Changelog
Release Notes
2.5.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ minitest (indirect, 5.14.0 → 5.14.3) · Repo · Changelog
Release Notes
5.14.3 (from changelog)
5.14.2 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ nokogiri (indirect, 1.10.9 → 1.11.1) · Repo · Changelog
Security Advisories 🚨
🚨 Nokogiri::XML::Schema trusts input by default, exposing risk of an XXE vulnerability
Release Notes
1.11.1
1.11.0
1.10.10
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ octokit (indirect, 4.17.0 → 4.20.0) · Repo
Release Notes
4.20.0
4.19.0
4.18.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ public_suffix (indirect, 3.1.1 → 4.0.6) · Repo · Changelog
Release Notes
4.0.6 (from changelog)
4.0.5 (from changelog)
4.0.4 (from changelog)
4.0.3 (from changelog)
4.0.2 (from changelog)
4.0.1 (from changelog)
4.0.0 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ rb-fsevent (indirect, 0.10.3 → 0.10.4) · Repo
Release Notes
0.10.4
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ rouge (indirect, 3.13.0 → 3.26.0) · Repo · Changelog
Release Notes
Too many releases to show here. View the full release notes.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ ruby-enum (indirect, 0.7.2 → 0.9.0) · Repo · Changelog
Release Notes
0.9.0 (from changelog)
0.8.0 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ rubyzip (indirect, 2.2.0 → 2.3.0) · Repo · Changelog
Release Notes
2.3.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ typhoeus (indirect, 1.3.1 → 1.4.0) · Repo · Changelog
Release Notes
1.4.0 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ tzinfo (indirect, 1.2.6 → 1.2.9) · Repo · Changelog
Release Notes
1.2.9
1.2.8
1.2.7
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
🆕 faraday-net_http (added, 1.0.1)
🆕 kramdown-parser-gfm (added, 1.1.0)
🆕 racc (added, 1.5.2)
🆕 rexml (added, 3.2.4)
🆕 ruby2_keywords (added, 0.0.4)
🆕 simpleidn (added, 0.2.1)
🆕 unf (added, 0.1.4)
🆕 unf_ext (added, 0.0.7.7)
🆕 zeitwerk (added, 2.4.2)
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase
.All Depfu comment commands