🚨 Your current dependencies have known security vulnerabilities 🚨
This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
In some cases user supplied information can be inadvertently leaked from
Strong Parameters. Specifically the return value of each, or each_value,
or each_pair will return the underlying "untrusted" hash of data that was
read from the parameters. Applications that use this return value may be
inadvertently use untrusted user input.
Impacted code will look something like this:
def update
# Attacker has included the parameter: `{ is_admin: true }`
User.update(clean_up_params)
end
def clean_up_params
params.each { |k, v| SomeModel.check(v) if k == :name }
end
Note the mistaken use of each in the clean_up_params method in the above
example.
Workarounds
Do not use the return values of each, each_value, or each_pair in your
application.
It is possible to possible to, given a global CSRF token such as the one
present in the authenticity_token meta tag, forge a per-form CSRF token for
any action for that session.
Versions Affected: rails < 5.2.5, rails < 6.0.4
Not affected: Applications without existing HTML injection vulnerabilities.
Fixed Versions: rails >= 5.2.4.3, rails >= 6.0.3.1
Impact
Given the ability to extract the global CSRF token, an attacker would be able to
construct a per-form CSRF token for that session.
Workarounds
This is a low-severity security issue. As such, no workaround is necessarily
until such time as the application can be upgraded.
There is a potential Cross-Site Scripting (XSS) vulnerability in Action
View's translation helpers. Views that allow the user to control the
default (not found) value of the t and translate helpers could be
susceptible to XSS attacks.
Impact
When an HTML-unsafe string is passed as the default for a missing
translation key named html or ending in _html,
the default string is incorrectly marked as HTML-safe and not escaped.
Vulnerable code may look like the following examples:
<%# The welcome_html translation is not defined for the current locale: %><%= t("welcome_html", default: untrusted_user_controlled_string) %><%# Neither the title.html translation nor the missing.html translation is defined for the current locale: %><%= t("title.html", default: [:"missing.html", untrusted_user_controlled_string]) %>
Workarounds
Impacted users who can’t upgrade to a patched Rails version can avoid
this issue by manually escaping default translations with the html_escape helper (aliased as h):
In the scenario where an attacker might be able to control the href attribute of an anchor tag or
the action attribute of a form tag that will trigger a POST action, the attacker can set the
href or action to a cross-origin URL, and the CSRF token will be sent.
Workarounds
To work around this problem, change code that allows users to control the href attribute of an anchor
tag or the action attribute of a form tag to filter the user parameters.
For example, code like this:
link_to params
to code like this:
link_to filtered_params
def filtered_params
# Filter just the parameters that you trust
end
There is a possible XSS vulnerability in ActionView's JavaScript literal
escape helpers. Views that use the j or escape_javascript methods
may be susceptible to XSS attacks.
Versions Affected: All.
Not affected: None.
Fixed Versions: 6.0.2.2, 5.2.4.2
Impact
There is a possible XSS vulnerability in the j and escape_javascript
methods in ActionView. These methods are used for escaping JavaScript string
literals. Impacted code will look something like this:
<script>let a =`<%= j unknown_input %>`</script>
or
<script>let a =`<%= escape_javascript unknown_input %>`</script>
Releases
The 6.0.2.2 and 5.2.4.2 releases are available at the normal locations.
Workarounds
For those that can't upgrade, the following monkey patch may be used:
ActionView::Helpers::JavaScriptHelper::JS_ESCAPE_MAP.merge!(
{
"`" => "\\`",
"$" => "\\$"
}
)
moduleActionView::Helpers::JavaScriptHelperalias:old_ej:escape_javascriptalias:old_j:jdefescape_javascript(javascript)
javascript = javascript.to_s
if javascript.empty?
result =""else
result = javascript.gsub(/(\\|<\/|\r\n|\342\200\250|\342\200\251|[\n\r"']|[`]|[$])/u, JS_ESCAPE_MAP)
end
javascript.html_safe? ? result.html_safe : result
endalias:j:escape_javascriptend
There is a possible DoS vulnerability in the PostgreSQL adapter in Active
Record. This vulnerability has been assigned the CVE identifier CVE-2021-22880.
Carefully crafted input can cause the input validation in the "money" type of
the PostgreSQL adapter in Active Record to spend too much time in a regular
expression, resulting in the potential for a DoS attack.
This only impacts Rails applications that are using PostgreSQL along with
money type columns that take user input.
Workarounds
In the case a patch can't be applied, the following monkey patch can be used
in an initializer:
module ActiveRecord
module ConnectionAdapters
module PostgreSQL
module OID # :nodoc:
class Money < Type::Decimal # :nodoc:
def cast_value(value)
return value unless ::String === value
value = value.sub(/^\((.+)\)$/, '-\1') # (4)
case value
when /^-?\D*+[\d,]+\.\d{2}$/ # (1)
value.gsub!(/[^-\d.]/, "")
when /^-?\D*+[\d.]+,\d{2}$/ # (2)
value.gsub!(/[^-\d,]/, "").sub!(/,/, ".")
end
super(value)
end
end
end
end
end
end
There is a vulnerability in ActiveStorage's S3 adapter that allows the Content-Length of a
direct file upload to be modified by an end user.
Versions Affected: rails < 5.2.4.2, rails < 6.0.3.1
Not affected: Applications that do not use the direct upload functionality of the ActiveStorage S3 adapter.
Fixed Versions: rails >= 5.2.4.3, rails >= 6.0.3.1
Impact
Utilizing this vulnerability, an attacker can control the Content-Length of an S3 direct upload URL without receiving a
new signature from the server. This could be used to bypass controls in place on the server to limit upload size.
Workarounds
This is a low-severity security issue. As such, no workaround is necessarily
until such time as the application can be upgraded.
There is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when
untrusted user input is written to the cache store using the raw: true parameter, re-reading the result
from the cache can evaluate the user input as a Marshalled object instead of plain text. Vulnerable code looks like:
data = cache.fetch("demo", raw: true) { untrusted_string }
Versions Affected: rails < 5.2.5, rails < 6.0.4
Not affected: Applications not using MemCacheStore or RedisCacheStore. Applications that do not use the raw option when storing untrusted user input.
Fixed Versions: rails >= 5.2.4.3, rails >= 6.0.3.1
Impact
Unmarshalling of untrusted user input can have impact up to and including RCE. At a minimum,
this vulnerability allows an attacker to inject untrusted Ruby objects into a web application.
In addition to upgrading to the latest versions of Rails, developers should ensure that whenever
they are calling Rails.cache.fetch they are using consistent values of the raw parameter for both
reading and writing, especially in the case of the RedisCacheStore which does not, prior to these changes,
detect if data was serialized using the raw option upon deserialization.
Workarounds
It is recommended that application developers apply the suggested patch or upgrade to the latest release as
soon as possible. If this is not possible, we recommend ensuring that all user-provided strings cached using
the raw argument should be double-checked to ensure that they conform to the expected format.
In Nokogiri versions <= 1.11.0.rc3, XML Schemas parsed by Nokogiri::XML::Schema
are trusted by default, allowing external resources to be accessed over the
network, potentially enabling XXE or SSRF attacks.
This behavior is counter to
the security policy followed by Nokogiri maintainers, which is to treat all input
as untrusted by default whenever possible.
Please note that this security
fix was pushed into a new minor version, 1.11.x, rather than a patch release to
the 1.10.x branch, because it is a breaking change for some schemas and the risk
was assessed to be "Low Severity".
Affected Versions
Nokogiri <= 1.10.10 as well as prereleases 1.11.0.rc1, 1.11.0.rc2, and 1.11.0.rc3
Mitigation
There are no known workarounds for affected versions. Upgrade to Nokogiri 1.11.0.rc4 or later.
If, after upgrading to 1.11.0.rc4 or later, you wish
to re-enable network access for resolution of external resources (i.e., return to
the previous behavior):
Ensure the input is trusted. Do not enable this option
for untrusted input.
When invoking the Nokogiri::XML::Schema constructor,
pass as the second parameter an instance of Nokogiri::XML::ParseOptions with the NONET flag turned off.
So if your previous code was:
# in v1.11.0.rc3 and earlier, this call allows resources to be accessed over the network# but in v1.11.0.rc4 and later, this call will disallow network access for external resourcesschema=Nokogiri::XML::Schema.new(schema)# in v1.11.0.rc4 and later, the following is equivalent to the code above# (the second parameter is optional, and this demonstrates its default value)schema=Nokogiri::XML::Schema.new(schema,Nokogiri::XML::ParseOptions::DEFAULT_SCHEMA)
Then you can add the second parameter to indicate that the input is trusted by changing it to:
# in v1.11.0.rc3 and earlier, this would raise an ArgumentError# but in v1.11.0.rc4 and later, this allows resources to be accessed over the networkschema=Nokogiri::XML::Schema.new(trusted_schema,Nokogiri::XML::ParseOptions.new.nononet)
Pulled in upstream patch from libxml that addresses CVE-2020-7595. Full details are available in #1992. Note that this patch is not yet (as of 2020-02-10) in an upstream release of libxml.
It is possible to forge a secure or host-only cookie prefix in Rack using
an arbitrary cookie write by using URL encoding (percent-encoding) on the
name of the cookie. This could result in an application that is dependent on
this prefix to determine if a cookie is safe to process being manipulated
into processing an insecure or cross-origin request.
This vulnerability has been assigned the CVE identifier CVE-2020-8184.
Versions Affected: rack < 2.2.3, rack < 2.1.4
Not affected: Applications which do not rely on __Host- and __Secure- prefixes to determine if a cookie is safe to process
Fixed Versions: rack >= 2.2.3, rack >= 2.1.4
Impact
An attacker may be able to trick a vulnerable application into processing an
insecure (non-SSL) or cross-origin request if they can gain the ability to write
arbitrary cookies that are sent to the application.
Workarounds
If your application is impacted but you cannot upgrade to the released versions or apply
the provided patch, this issue can be temporarily addressed by adding the following workaround:
module Rack
module Utils
module_function def parse_cookies_header(header)
return {} unless header
header.split(/[;] */n).each_with_object({}) do |cookie, cookies|
next if cookie.empty?
key, value = cookie.split('=', 2)
cookies[key] = (unescape(value) rescue value) unless cookies.key?(key)
end
end
end
end
It is possible to forge a secure or host-only cookie prefix in Rack using
an arbitrary cookie write by using URL encoding (percent-encoding) on the
name of the cookie. This could result in an application that is dependent on
this prefix to determine if a cookie is safe to process being manipulated
into processing an insecure or cross-origin request.
This vulnerability has been assigned the CVE identifier CVE-2020-8184.
Versions Affected: rack < 2.2.3, rack < 2.1.4
Not affected: Applications which do not rely on __Host- and __Secure- prefixes to determine if a cookie is safe to process
Fixed Versions: rack >= 2.2.3, rack >= 2.1.4
Impact
An attacker may be able to trick a vulnerable application into processing an
insecure (non-SSL) or cross-origin request if they can gain the ability to write
arbitrary cookies that are sent to the application.
Workarounds
If your application is impacted but you cannot upgrade to the released versions or apply
the provided patch, this issue can be temporarily addressed by adding the following workaround:
module Rack
module Utils
module_function def parse_cookies_header(header)
return {} unless header
header.split(/[;] */n).each_with_object({}) do |cookie, cookies|
next if cookie.empty?
key, value = cookie.split('=', 2)
cookies[key] = (unescape(value) rescue value) unless cookies.key?(key)
end
end
end
end
There was a possible directory traversal vulnerability in the Rack::Directory app
that is bundled with Rack.
Versions Affected: rack < 2.2.0
Not affected: Applications that do not use Rack::Directory.
Fixed Versions: 2.1.3, >= 2.2.0
Impact
If certain directories exist in a director that is managed by Rack::Directory, an attacker could, using this vulnerability, read the
contents of files on the server that were outside of the root specified in the
Rack::Directory initializer.
Workarounds
Until such time as the patch is applied or their Rack version is upgraded,
we recommend that developers do not use Rack::Directory in their
applications.
There was a possible directory traversal vulnerability in the Rack::Directory app
that is bundled with Rack.
Versions Affected: rack < 2.2.0
Not affected: Applications that do not use Rack::Directory.
Fixed Versions: 2.1.3, >= 2.2.0
Impact
If certain directories exist in a director that is managed by Rack::Directory, an attacker could, using this vulnerability, read the
contents of files on the server that were outside of the root specified in the
Rack::Directory initializer.
Workarounds
Until such time as the patch is applied or their Rack version is upgraded,
we recommend that developers do not use Rack::Directory in their
applications.
The ReDoS flaw allows an attacker to exhaust the server's capacity to process
incoming requests by sending a WebSocket handshake request containing a header
of the following form:
That is, a header containing an unclosed string parameter value whose content is
a repeating two-byte sequence of a backslash and some other character. The
parser takes exponential time to reject this header as invalid, and this will
block the processing of any other work on the same thread. Thus if you are
running a single-threaded server, such a request can render your service
completely unavailable.
Workarounds
There are no known work-arounds other than disabling any public-facing WebSocket functionality you are operating.
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.
All Depfu comment commands
@depfu rebase
Rebases against your default branch and redoes this update
@depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@depfu close
Closes this PR and deletes the branch
@depfu reopen
Restores the branch and reopens this PR (if it's closed)
@depfu pause
Ignores all future updates for this dependency and closes this PR
@depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)
depfu[bot]
commented
3 years ago
🚨 Your current dependencies have known security vulnerabilities 🚨
This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!
Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.
What changed?
✳️ rails (5.2.3 → 5.2.4.5) · Repo
Release Notes
5.2.4.4
5.2.4.1
5.2.4
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ actioncable (indirect, 5.2.3 → 5.2.4.5) · Repo · Changelog
Release Notes
5.2.4.4 (from changelog)
5.2.4.3 (from changelog)
5.2.4.1 (from changelog)
5.2.4 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ actionmailer (indirect, 5.2.3 → 5.2.4.5) · Repo · Changelog
Release Notes
5.2.4.4 (from changelog)
5.2.4.3 (from changelog)
5.2.4.1 (from changelog)
5.2.4 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ actionpack (indirect, 5.2.3 → 5.2.4.5) · Repo · Changelog
Security Advisories 🚨
🚨 Possible Strong Parameters Bypass in ActionPack
🚨 Ability to forge per-form CSRF tokens given a global CSRF token
Release Notes
5.2.4.4 (from changelog)
5.2.4.3 (from changelog)
5.2.4.1 (from changelog)
5.2.4 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ actionview (indirect, 5.2.3 → 5.2.4.5) · Repo · Changelog
Security Advisories 🚨
🚨 Potential XSS vulnerability in Action View
🚨 CSRF Vulnerability in rails-ujs
🚨 Possible XSS vulnerability in ActionView
Release Notes
5.2.4.4 (from changelog)
5.2.4.3 (from changelog)
5.2.4.1 (from changelog)
5.2.4 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ activejob (indirect, 5.2.3 → 5.2.4.5) · Repo · Changelog
Release Notes
5.2.4.4 (from changelog)
5.2.4.3 (from changelog)
5.2.4.1 (from changelog)
5.2.4 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ activemodel (indirect, 5.2.3 → 5.2.4.5) · Repo · Changelog
Release Notes
5.2.4.4 (from changelog)
5.2.4.3 (from changelog)
5.2.4.1 (from changelog)
5.2.4 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ activerecord (indirect, 5.2.3 → 5.2.4.5) · Repo · Changelog
Security Advisories 🚨
🚨 Possible DoS Vulnerability in Active Record PostgreSQL adapter
Release Notes
5.2.4.4 (from changelog)
5.2.4.3 (from changelog)
5.2.4.1 (from changelog)
5.2.4 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ activestorage (indirect, 5.2.3 → 5.2.4.5) · Repo · Changelog
Security Advisories 🚨
🚨 Circumvention of file size limits in ActiveStorage
Release Notes
5.2.4.4 (from changelog)
5.2.4.3 (from changelog)
5.2.4.1 (from changelog)
5.2.4 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ activesupport (indirect, 5.2.3 → 5.2.4.5) · Repo · Changelog
Security Advisories 🚨
🚨 Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore
Release Notes
5.2.4.4 (from changelog)
5.2.4.3 (from changelog)
5.2.4.1 (from changelog)
5.2.4 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ builder (indirect, 3.2.3 → 3.2.4) · Repo · Changelog
↗️ concurrent-ruby (indirect, 1.1.5 → 1.1.8) · Repo · Changelog
Release Notes
1.1.8 (from changelog)
1.1.7 (from changelog)
1.1.6 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ crass (indirect, 1.0.5 → 1.0.6) · Repo · Changelog
Release Notes
1.0.6
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ erubi (indirect, 1.9.0 → 1.10.0) · Repo · Changelog
Release Notes
1.10.0 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ i18n (indirect, 1.7.0 → 1.8.8) · Repo · Changelog
Release Notes
1.8.8
1.8.7
1.8.6
1.8.4
1.8.3
1.8.2
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ loofah (indirect, 2.3.1 → 2.9.0) · Repo · Changelog
Release Notes
2.9.0
2.8.0
2.7.0
2.6.0 (from changelog)
2.5.0 (from changelog)
2.4.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ mimemagic (indirect, 0.3.3 → 0.3.5) · Repo · Changelog
Release Notes
0.3.5 (from changelog)
0.3.4 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ mini_portile2 (indirect, 2.4.0 → 2.5.0) · Repo · Changelog
Release Notes
2.5.0
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ minitest (indirect, 5.13.0 → 5.14.3) · Repo · Changelog
Release Notes
5.14.3 (from changelog)
5.14.2 (from changelog)
5.14.0 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ nio4r (indirect, 2.5.2 → 2.5.5) · Repo · Changelog
Release Notes
2.5.4 (from changelog)
2.5.3 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ nokogiri (indirect, 1.10.5 → 1.11.1) · Repo · Changelog
Security Advisories 🚨
🚨 Nokogiri::XML::Schema trusts input by default, exposing risk of an XXE vulnerability
🚨 xmlStringLenDecodeEntities in parser.c in libxml2 2.9.10 has an infinite loop in a certain end-of-file situation.
Release Notes
1.11.1
1.11.0
1.10.10
1.10.9
1.10.8
1.10.7
1.10.6
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ rack (indirect, 2.1.1 → 2.2.3) · Repo · Changelog
Security Advisories 🚨
🚨 Percent-encoded cookies can be used to overwrite existing prefixed cookie names
🚨 Percent-encoded cookies can be used to overwrite existing prefixed cookie names
🚨 Directory traversal in Rack::Directory app bundled with Rack
🚨 Directory traversal in Rack::Directory app bundled with Rack
Release Notes
2.2.2 (from changelog)
2.2.1 (from changelog)
2.2.0 (from changelog)
2.1.2 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ railties (indirect, 5.2.3 → 5.2.4.5) · Repo · Changelog
Release Notes
5.2.4.4 (from changelog)
5.2.4.3 (from changelog)
5.2.4.1 (from changelog)
5.2.4 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ rake (indirect, 13.0.0 → 13.0.3) · Repo · Changelog
Release Notes
13.0.3 (from changelog)
13.0.1 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ sprockets-rails (indirect, 3.2.1 → 3.2.2) · Repo · Changelog
Release Notes
3.2.2
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ thor (indirect, 0.20.3 → 1.1.0) · Repo · Changelog
Release Notes
1.1.0 (from changelog)
1.0.1 (from changelog)
1.0.0 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ tzinfo (indirect, 1.2.5 → 1.2.9) · Repo · Changelog
Release Notes
1.2.9
1.2.8
1.2.7
1.2.6
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ websocket-driver (indirect, 0.7.1 → 0.7.3) · Repo · Changelog
Release Notes
0.7.3 (from changelog)
0.7.2 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
↗️ websocket-extensions (indirect, 0.1.4 → 0.1.5) · Repo · Changelog
Security Advisories 🚨
🚨 Regular Expression Denial of Service in websocket-extensions (RubyGem)
Release Notes
0.1.5 (from changelog)
Does any of this look wrong? Please let us know.
Commits
See the full diff on Github. The new version differs by more commits than we can show here.
🆕 racc (added, 1.5.2)
Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with
@depfu rebase.All Depfu comment commands