search

sanger / samples_extraction

MIT License
0 stars 5 forks source link

🚨 [security] [ruby] Update rails: 6.1.7.2 → 6.1.7.3 (patch) #267

Closed depfu[bot] closed 1 year ago

depfu[bot] commented 1 year ago

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ rails (6.1.7.2 → 6.1.7.3) · Repo

Release Notes

6.1.7.3

Active Support

  • Implement SafeBuffer#bytesplice

    [CVE-2023-28120]

Active Model

  • No changes.

Active Record

  • No changes.

Action View

  • Ignore certain data-* attributes in rails-ujs when element is contenteditable

    [CVE-2023-23913]

Action Pack

  • No changes.

Active Job

  • No changes.

Action Mailer

  • No changes.

Action Cable

  • No changes.

Active Storage

  • No changes.

Action Mailbox

  • No changes.

Action Text

  • No changes.

Railties

  • No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 4 commits:

↗️ actioncable (indirect, 6.1.7.2 → 6.1.7.3) · Repo · Changelog

Release Notes

6.1.7.3 (from changelog)

  • No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 4 commits:

↗️ actionmailbox (indirect, 6.1.7.2 → 6.1.7.3) · Repo · Changelog

↗️ actionmailer (indirect, 6.1.7.2 → 6.1.7.3) · Repo · Changelog

Release Notes

6.1.7.3 (from changelog)

  • No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 4 commits:

↗️ actionpack (indirect, 6.1.7.2 → 6.1.7.3) · Repo · Changelog

Release Notes

6.1.7.3 (from changelog)

  • No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 4 commits:

↗️ actiontext (indirect, 6.1.7.2 → 6.1.7.3) · Repo · Changelog

Release Notes

6.1.7.3 (from changelog)

  • No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 4 commits:

↗️ actionview (indirect, 6.1.7.2 → 6.1.7.3) · Repo · Changelog

Release Notes

6.1.7.3 (from changelog)

  • Ignore certain data-* attributes in rails-ujs when element is contenteditable

    [CVE-2023-23913]

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 4 commits:

↗️ activejob (indirect, 6.1.7.2 → 6.1.7.3) · Repo · Changelog

Release Notes

6.1.7.3 (from changelog)

  • No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 4 commits:

↗️ activemodel (indirect, 6.1.7.2 → 6.1.7.3) · Repo · Changelog

Release Notes

6.1.7.3 (from changelog)

  • No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 4 commits:

↗️ activerecord (indirect, 6.1.7.2 → 6.1.7.3) · Repo · Changelog

Release Notes

6.1.7.3 (from changelog)

  • No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 4 commits:

↗️ activestorage (indirect, 6.1.7.2 → 6.1.7.3) · Repo · Changelog

Release Notes

6.1.7.3 (from changelog)

  • No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 4 commits:

↗️ activesupport (indirect, 6.1.7.2 → 6.1.7.3) · Repo · Changelog

Security Advisories 🚨

🚨 Possible XSS Security Vulnerability in SafeBuffer#bytesplice

There is a vulnerability in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input.
This vulnerability has been assigned the CVE identifier CVE-2023-28120.

Versions Affected: All. Not affected: None Fixed Versions: 7.0.4.3, 6.1.7.3

Impact

ActiveSupport uses the SafeBuffer string subclass to tag strings as html_safe after they have been sanitized.
When these strings are mutated, the tag is should be removed to mark them as no longer being html_safe.

Ruby 3.2 introduced a new bytesplice method which ActiveSupport did not yet understand to be a mutation.
Users on older versions of Ruby are likely unaffected.

All users running an affected release and using bytesplice should either upgrade or use one of the workarounds immediately.

Workarounds

Avoid calling bytesplice on a SafeBuffer (html_safe) string with untrusted user input.

Release Notes

6.1.7.3 (from changelog)

  • Implement SafeBuffer#bytesplice

    [CVE-2023-28120]

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 4 commits:

↗️ concurrent-ruby (indirect, 1.2.0 → 1.2.2) · Repo · Changelog

Release Notes

1.2.2

concurrent-ruby 1.2.2:

  • (#993) Fix arguments passed to Concurrent::Map's default_proc.

1.2.1

concurrent-ruby 1.2.1:

  • (#990) Add missing require 'fiber' for FiberLocalVar.
  • (#989) Optimize Concurrent::Map#[] on CRuby by letting the backing Hash handle the default_proc.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 16 commits:

↗️ mail (indirect, 2.8.0.1 → 2.8.1) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 13 commits:

↗️ minitest (indirect, 5.17.0 → 5.18.0) · Repo · Changelog

Release Notes

5.18.0 (from changelog)

  • 2 major enhancements:

    • Added assert_pattern & refute_pattern for pattern matching. (flavorjones)

    • Added matching must_pattern_match & wont_pattern_match to minitest/spec.

  • 1 bug fix:

    • Support the new message format of NameError in Ruby 3.3 (mame)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 7 commits:

↗️ nokogiri (indirect, 1.14.1 → 1.14.2) · Repo · Changelog

Release Notes

1.14.2

1.14.2 / 2023-02-13

Fixed

  • Calling NodeSet#to_html on an empty node set no longer raises an encoding-related exception. This bug was introduced in v1.14.0 while fixing #2649. [#2784]

sha256 checksums:

966acf4f6c1fba10518f86498141cf44265564ac5a65dcc8496b65f8c354f776  nokogiri-1.14.2-aarch64-linux.gem
8a3a35cadae4a800ddc0b967394257343d62196d9d059b54e38cf067981db428  nokogiri-1.14.2-arm-linux.gem
81404cd014ecb597725c3847523c2ee365191a968d0b5f7d857e03f388c57631  nokogiri-1.14.2-arm64-darwin.gem
0a39222af14e75eb0243e8d969345e03b90c0e02b0f33c61f1ebb6ae53538bb5  nokogiri-1.14.2-java.gem
62a18f9213a0ceeaf563d1bc7ccfd93273323c4356ded58a5617c59bc4635bc5  nokogiri-1.14.2-x64-mingw-ucrt.gem
54f6ac2c15a7a88f431bb5e23f4616aa8fc97a92eb63336bcf65b7050f2d3be0  nokogiri-1.14.2-x64-mingw32.gem
c42fa0856f01f901954898e28c3c2b4dce0e843056b1b126f441d06e887e1b77  nokogiri-1.14.2-x86-linux.gem
f940d9c8e47b0f19875465376f2d1c8911bc9489ac9a48c124579819dc4a7f19  nokogiri-1.14.2-x86-mingw32.gem
2508978f5ca28944919973f6300f0a7355fbe72604ab6a6913f1630be1030265  nokogiri-1.14.2-x86_64-darwin.gem
bc6405e1f3ddac6e401f82d775f1c0c24c6e58c371b3fadaca0596d5d511e476  nokogiri-1.14.2-x86_64-linux.gem
c765a74aac6cf430a710bb0b6038b8ee11f177393cd6ae8dadc7a44a6e2658b6  nokogiri-1.14.2.gem

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 4 commits:

↗️ rack (indirect, 2.2.6.2 → 2.2.6.4) · Repo · Changelog

Security Advisories 🚨

🚨 Possible Denial of Service Vulnerability in Rack’s header parsing

There is a denial of service vulnerability in the header parsing component of Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27539.

Versions Affected: >= 2.0.0 Not affected: None. Fixed Versions: 2.2.6.4, 3.0.6.1

Impact

Carefully crafted input can cause header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse headers using Rack (virtually all Rails applications) are impacted.

Workarounds

Setting Regexp.timeout in Ruby 3.2 is a possible workaround.

🚨 Possible DoS Vulnerability in Multipart MIME parsing

There is a possible DoS vulnerability in the Multipart MIME parsing code in Rack. This vulnerability has been assigned the CVE identifier CVE-2023-27530.

Versions Affected: All. Not affected: None Fixed Versions: 3.0.4.2, 2.2.6.3, 2.1.4.3, 2.0.9.3

Impact

The Multipart MIME parsing code in Rack limits the number of file parts, but does not limit the total number of parts that can be uploaded. Carefully crafted requests can abuse this and cause multipart parsing to take longer than expected.

All users running an affected release should either upgrade or use one of the workarounds immediately.

Workarounds

A proxy can be configured to limit the POST body size which will mitigate this issue.

Commits

See the full diff on Github. The new version differs by 4 commits:

↗️ rack-test (indirect, 2.0.2 → 2.1.0) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ railties (indirect, 6.1.7.2 → 6.1.7.3) · Repo · Changelog

Release Notes

6.1.7.3 (from changelog)

  • No changes.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 4 commits:

↗️ timeout (indirect, 0.3.1 → 0.3.2) · Repo

Release Notes

0.3.2

What's Changed

New Contributors

Full Changelog: v0.3.1...v0.3.2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 10 commits:

↗️ zeitwerk (indirect, 2.6.6 → 2.6.7) · Repo · Changelog

Release Notes

2.6.7 (from changelog)

  • Reset module state on Zeitwerk::NameError.

    If an autoload is triggered, the file is loaded successfully, but the expected constant does not get defined, Ruby resets the state of the module. In particular, autoload? returns nil for that constant name, and constants does not include the constant name (starting with Ruby 3.1).

    Zeitwerk is more strict, not defining the expected constant is an error condition and the loader raises Zeitwerk::NameError. But this happens during the require call and the exception prevents Ruby from doing that cleanup.

    With this change, the parent module is left in a state that makes more sense and is consistent with what Ruby does.

  • A message is logged if an autoload did not define the expected constant.

    When that happens, Zeitwerk::NameError is raised and you normally see the exception. But if the error is shallowed, and you are inspecting the logs to investigate something, this new message may be helpful.

  • By default, Zeitwerk::Loader#dirs filters ignored root directories out. Please, pass ignored: true if you want them included.

    It is very strange to configure a root directory and also ignore it, the edge case is supported only for completeness. However, in that case, client code listing root directories rarely needs the ignored ones.

  • Documentation improvements.

  • Enforcement of private interfaces continues with another gradual patch.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 53 commits:

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)
depfu[bot] commented 1 year ago

Closed in favor of #272.