Closed thoma127 closed 2 years ago
Part of Pivotal Tracker #182702320
Addresses multiple CVEs:
Name: activerecord Version: 5.2.8 CVE: CVE-2022-32224 GHSA: GHSA-3hhc-qp5v-9p2j Criticality: Unknown 1 Add owners.md URL: https://groups.google.com/g/rubyonrails-security/c/MmFO3LYQE8U Title: Possible RCE escalation bug with Serialized Columns in Active Record Solution: upgrade to '~> 5.2.8, >= 5.2.8.1', '~> 6.0.5, >= 6.0.5.1', '~> 6.1.6, >= 6.1.6.1', '>= 7.0.3.1' Name: nokogiri Version: 1.13.6 GHSA: GHSA-2qc6-mcvw-92cw Criticality: Unknown URL: https://github.com/sparklemotion/nokogiri/security/advisories/GHSA-2qc6-mcvw-92cw Title: Update bundled libxml2 to v2.10.3 to resolve multiple CVEs Solution: upgrade to '>= 1.13.9' Name: rails-html-sanitizer Version: 1.4.2 CVE: CVE-2022-32209 GHSA: GHSA-pg8v-g4xq-hww9 Criticality: Medium URL: https://groups.google.com/g/rubyonrails-security/c/ce9PhUANQ6s Title: Possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer Solution: upgrade to '>= 1.4.3' Name: tzinfo Version: 1.2.9 CVE: CVE-2022-31163 GHSA: GHSA-5cm2-9h8c-rvfx Criticality: High URL: https://github.com/tzinfo/tzinfo/security/advisories/GHSA-5cm2-9h8c-rvfx Title: TZInfo relative path traversal vulnerability allows loading of arbitrary files Solution: upgrade to '~> 0.3.61', '>= 1.2.10'
Part of Pivotal Tracker #182702320
Addresses multiple CVEs: