From c5c3a903fcf2fba7cdded85a88d4720372d9c729 Mon Sep 17 00:00:00 2001 From: Christian Bruckmayer Date: Tue, 8 Dec 2015 15:56:18 +0100 Subject: [PATCH 1/4] Update paperclip to 4.3.2 To fix CVE-2015-2963 --- Gemfile.lock | 14 ++++++++------ 1 file changed, 8 insertions(+), 6 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index a63c84e4..2e14ba9f 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -98,7 +98,7 @@ GEM climate_control (0.0.3) activesupport (>= 3.0) cliver (0.3.2) - cocaine (0.5.4) + cocaine (0.5.8) climate_control (>= 0.0.3, < 1.0) cocoon (1.2.6) coderay (1.1.0) @@ -206,7 +206,8 @@ GEM mail (2.6.3) mime-types (>= 1.16, < 3) method_source (0.8.2) - mime-types (2.4.3) + mime-types (2.99) + mimemagic (0.3.0) mina (0.3.0) open4 rake @@ -261,11 +262,12 @@ GEM paper_trail (3.0.1) activerecord (>= 3.0, < 5.0) activesupport (>= 3.0, < 5.0) - paperclip (4.1.1) - activemodel (>= 3.0.0) - activesupport (>= 3.0.0) - cocaine (~> 0.5.3) + paperclip (4.3.2) + activemodel (>= 3.2.0) + activesupport (>= 3.2.0) + cocaine (~> 0.5.5) mime-types + mimemagic (= 0.3.0) parser (2.2.0.pre.3) ast (>= 1.1, < 3.0) slop (~> 3.4, >= 3.4.5) From 81a43cc2b6ad4577c3fb34f8605ee01a6c1e7993 Mon Sep 17 00:00:00 2001 From: Christian Bruckmayer Date: Tue, 8 Dec 2015 16:05:29 +0100 Subject: [PATCH 2/4] Raise exception on XSRF fail Reported by hakiri.io --- app/controllers/application_controller.rb | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/app/controllers/application_controller.rb b/app/controllers/application_controller.rb index df6bedff..49fdc6fa 100644 --- a/app/controllers/application_controller.rb +++ b/app/controllers/application_controller.rb @@ -1,6 +1,6 @@ class ApplicationController < ActionController::Base include ApplicationHelper - protect_from_forgery + protect_from_forgery with: :exception before_filter :get_conferences before_filter :store_location helper_method :date_string From 66d4e6e833c22bd5a8ea78827e0c16b1f56f5d62 Mon Sep 17 00:00:00 2001 From: Christian Bruckmayer Date: Tue, 8 Dec 2015 16:15:08 +0100 Subject: [PATCH 3/4] Update jquery-rails To fix CVE-2015-1840 reported by Hakiri.io --- Gemfile.lock | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/Gemfile.lock b/Gemfile.lock index 2e14ba9f..53da4f2f 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -186,7 +186,7 @@ GEM jquery-datatables-rails (2.2.3) jquery-rails sass-rails - jquery-rails (3.1.2) + jquery-rails (3.1.4) railties (>= 3.0, < 5.0) thor (>= 0.14, < 2.0) json (1.8.1) From 64396c9786fe3176c76c744cc2ba7203577b2476 Mon Sep 17 00:00:00 2001 From: Christian Bruckmayer Date: Tue, 22 Dec 2015 17:06:37 +0100 Subject: [PATCH 4/4] Update rails gem to 4.1.14 Fix CVE-2015-3227 Fix CVE-2015-3226 --- Gemfile.lock | 66 ++++++++++++++++++++++++++-------------------------- 1 file changed, 33 insertions(+), 33 deletions(-) diff --git a/Gemfile.lock b/Gemfile.lock index 53da4f2f..73c293cd 100644 --- a/Gemfile.lock +++ b/Gemfile.lock @@ -8,29 +8,29 @@ GIT GEM remote: https://rubygems.org/ specs: - actionmailer (4.1.8) - actionpack (= 4.1.8) - actionview (= 4.1.8) + actionmailer (4.1.14) + actionpack (= 4.1.14) + actionview (= 4.1.14) mail (~> 2.5, >= 2.5.4) - actionpack (4.1.8) - actionview (= 4.1.8) - activesupport (= 4.1.8) + actionpack (4.1.14) + actionview (= 4.1.14) + activesupport (= 4.1.14) rack (~> 1.5.2) rack-test (~> 0.6.2) - actionview (4.1.8) - activesupport (= 4.1.8) + actionview (4.1.14) + activesupport (= 4.1.14) builder (~> 3.1) erubis (~> 2.7.0) active_model_serializers (0.8.1) activemodel (>= 3.0) - activemodel (4.1.8) - activesupport (= 4.1.8) + activemodel (4.1.14) + activesupport (= 4.1.14) builder (~> 3.1) - activerecord (4.1.8) - activemodel (= 4.1.8) - activesupport (= 4.1.8) + activerecord (4.1.14) + activemodel (= 4.1.14) + activesupport (= 4.1.14) arel (~> 5.0.0) - activesupport (4.1.8) + activesupport (4.1.14) i18n (~> 0.6, >= 0.6.9) json (~> 1.7, >= 1.7.7) minitest (~> 5.1) @@ -189,7 +189,7 @@ GEM jquery-rails (3.1.4) railties (>= 3.0, < 5.0) thor (>= 0.14, < 2.0) - json (1.8.1) + json (1.8.3) jwt (1.0.0) launchy (2.4.2) addressable (~> 2.3) @@ -212,7 +212,7 @@ GEM open4 rake mini_portile (0.6.0) - minitest (5.4.3) + minitest (5.8.3) momentjs-rails (2.8.1) railties (>= 3.1) monetize (0.3.0) @@ -224,7 +224,7 @@ GEM monetize (~> 0.3.0) money (~> 6.1.1) railties (>= 3.0) - multi_json (1.10.1) + multi_json (1.11.2) multi_xml (0.5.5) multipart-post (2.0.0) mysql2 (0.3.16) @@ -295,31 +295,31 @@ GEM slop (~> 3.4) quiet_assets (1.0.2) railties (>= 3.1, < 5.0) - rack (1.5.2) + rack (1.5.5) rack-openid (1.3.1) rack (>= 1.1.0) ruby-openid (>= 2.1.8) - rack-test (0.6.2) + rack-test (0.6.3) rack (>= 1.0) - rails (4.1.8) - actionmailer (= 4.1.8) - actionpack (= 4.1.8) - actionview (= 4.1.8) - activemodel (= 4.1.8) - activerecord (= 4.1.8) - activesupport (= 4.1.8) + rails (4.1.14) + actionmailer (= 4.1.14) + actionpack (= 4.1.14) + actionview (= 4.1.14) + activemodel (= 4.1.14) + activerecord (= 4.1.14) + activesupport (= 4.1.14) bundler (>= 1.3.0, < 2.0) - railties (= 4.1.8) + railties (= 4.1.14) sprockets-rails (~> 2.0) rails-observers (0.1.2) activemodel (~> 4.0) - railties (4.1.8) - actionpack (= 4.1.8) - activesupport (= 4.1.8) + railties (4.1.14) + actionpack (= 4.1.14) + activesupport (= 4.1.14) rake (>= 0.8.7) thor (>= 0.18.1, < 2.0) rainbow (2.0.0) - rake (10.3.2) + rake (10.4.2) rb-fsevent (0.9.4) rb-inotify (0.9.4) ffi (>= 0.5.0) @@ -392,7 +392,7 @@ GEM multi_json (~> 1.0) rack (~> 1.0) tilt (~> 1.1, != 1.3.0) - sprockets-rails (2.2.0) + sprockets-rails (2.3.3) actionpack (>= 3.0) activesupport (>= 3.0) sprockets (>= 2.8, < 4.0) @@ -400,7 +400,7 @@ GEM term-ansicolor (1.3.0) tins (~> 1.0) thor (0.19.1) - thread_safe (0.3.4) + thread_safe (0.3.5) tilt (1.4.1) timecop (0.7.1) timers (1.1.0)