umn-asr / umn_course_fees

0 stars 0 forks source link

Update to Rails 5.2.8.1 #81

Closed thoma127 closed 2 years ago

thoma127 commented 2 years ago

Part of Pivotal Tracker #182702320

Addresses multiple CVEs:

Name: activerecord
Version: 5.2.8
CVE: CVE-2022-32224
GHSA: GHSA-3hhc-qp5v-9p2j
Criticality: Unknown
  1 Add owners.md
URL: https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U
Title: Possible RCE escalation bug with Serialized Columns in Active Record
Solution: upgrade to '~> 5.2.8, >= 5.2.8.1', '~> 6.0.5, >= 6.0.5.1', '~> 6.1.6, >= 6.1.6.1', '>= 7.0.3.1'

Name: nokogiri
Version: 1.13.6
GHSA: GHSA-2qc6-mcvw-92cw
Criticality: Unknown
URL: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2qc6-mcvw-92cw
Title: Update bundled libxml2 to v2.10.3 to resolve multiple CVEs
Solution: upgrade to '>= 1.13.9'

Name: rails-html-sanitizer
Version: 1.4.2
CVE: CVE-2022-32209
GHSA: GHSA-pg8v-g4xq-hww9
Criticality: Medium
URL: https://groups.google.com/g/rubyonrails-security/c/ce9PhUANQ6s
Title: Possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer
Solution: upgrade to '>= 1.4.3'

Name: tzinfo
Version: 1.2.9
CVE: CVE-2022-31163
GHSA: GHSA-5cm2-9h8c-rvfx
Criticality: High
URL: https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx
Title: TZInfo relative path traversal vulnerability allows loading of arbitrary files
Solution: upgrade to '~> 0.3.61', '>= 1.2.10'