{"action":"created","issue":{"url":"https://api.github.com/repos/heroku/heroku-buildpack-ruby/issues/395","labels_url":"https://api.github.com/repos/heroku/heroku-buildpack-ruby/issues/395/labels{/name}","comments_url":"https://api.github.com/repos/heroku/heroku-buildpack-ruby/issues/395/comments","events_url":"https://api.github.com/repos/heroku/heroku-buildpack-ruby/issues/395/events","html_url":"https://github.com/heroku/heroku-buildpack-ruby/issues/395","id":96675776,"number":395,"title":"CVE with packaged version of RubyGems 2.4.5 and Ruby 2.2.2 (possibly more versions of Ruby)","user":{"login":"jtarchie","id":75184,"avatar_url":"https://avatars.githubusercontent.com/u/75184?v=3","gravatar_id":"","url":"https://api.github.com/users/jtarchie","html_url":"https://github.com/jtarchie","followers_url":"https://api.github.com/users/jtarchie/followers","following_url":"https://api.github.com/users/jtarchie/following{/other_user}","gists_url":"https://api.github.com/users/jtarchie/gists{/gist_id}","starred_url":"https://api.github.com/users/jtarchie/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/jtarchie/subscriptions","organizations_url":"https://api.github.com/users/jtarchie/orgs","repos_url":"https://api.github.com/users/jtarchie/repos","events_url":"https://api.github.com/users/jtarchie/events{/privacy}","received_events_url":"https://api.github.com/users/jtarchie/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":1,"created_at":"2015-07-22T22:04:26Z","updated_at":"2015-07-23T16:45:04Z","closed_at":null,"body":"RubyGems has a [vulnerability](http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html).\r\n\r\nThey've released an update, but the buildpack is still using an earlier version. Pushing an app with Ruby 2.2.2 and the `gem --version` show version 2.4.5.\r\n\r\nAny plan to update RubyGems?"},"comment":{"url":"https://api.github.com/repos/heroku/heroku-buildpack-ruby/issues/comments/124164459","html_url":"https://github.com/heroku/heroku-buildpack-ruby/issues/395#issuecomment-124164459","issue_url":"https://api.github.com/repos/heroku/heroku-buildpack-ruby/issues/395","id":124164459,"user":{"login":"flavorjones","id":8207,"avatar_url":"https://avatars.githubusercontent.com/u/8207?v=3","gravatar_id":"","url":"https://api.github.com/users/flavorjones","html_url":"https://github.com/flavorjones","followers_url":"https://api.github.com/users/flavorjones/followers","following_url":"https://api.github.com/users/flavorjones/following{/other_user}","gists_url":"https://api.github.com/users/flavorjones/gists{/gist_id}","starred_url":"https://api.github.com/users/flavorjones/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/flavorjones/subscriptions","organizations_url":"https://api.github.com/users/flavorjones/orgs","repos_url":"https://api.github.com/users/flavorjones/repos","events_url":"https://api.github.com/users/flavorjones/events{/privacy}","received_events_url":"https://api.github.com/users/flavorjones/received_events","type":"User","site_admin":false},"created_at":"2015-07-23T16:45:04Z","updated_at":"2015-07-23T16:45:04Z","body":"For context, here's the Ruby ticket for the backport:\r\n\r\nhttps://bugs.ruby-lang.org/issues/11248\r\n\r\nwhich I'm confused by, as it's marked 'closed' and the patch isn't on the `ruby_2_2` branch at this time.\r\n\r\nI poked @tenderlove and he's bumped a ruby core security thread on the subject.\r\n"}}