{"action":"opened","issue":{"url":"https://api.github.com/repos/tommoor/sample_app_rails_4/issues/5","labels_url":"https://api.github.com/repos/tommoor/sample_app_rails_4/issues/5/labels{/name}","comments_url":"https://api.github.com/repos/tommoor/sample_app_rails_4/issues/5/comments","events_url":"https://api.github.com/repos/tommoor/sample_app_rails_4/issues/5/events","html_url":"https://github.com/tommoor/sample_app_rails_4/issues/5","id":121609400,"number":5,"title":"  <$= count $> 11 security vulnerabilties\n","user":{"login":"dev-pushbit-bot","id":16105895,"avatar_url":"https://avatars.githubusercontent.com/u/16105895?v=3","gravatar_id":"","url":"https://api.github.com/users/dev-pushbit-bot","html_url":"https://github.com/dev-pushbit-bot","followers_url":"https://api.github.com/users/dev-pushbit-bot/followers","following_url":"https://api.github.com/users/dev-pushbit-bot/following{/other_user}","gists_url":"https://api.github.com/users/dev-pushbit-bot/gists{/gist_id}","starred_url":"https://api.github.com/users/dev-pushbit-bot/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/dev-pushbit-bot/subscriptions","organizations_url":"https://api.github.com/users/dev-pushbit-bot/orgs","repos_url":"https://api.github.com/users/dev-pushbit-bot/repos","events_url":"https://api.github.com/users/dev-pushbit-bot/events{/privacy}","received_events_url":"https://api.github.com/users/dev-pushbit-bot/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":0,"created_at":"2015-12-11T00:33:48Z","updated_at":"2015-12-11T00:33:48Z","closed_at":null,"body":"\n##actionpack\n## actionpack (THREAT LEVEL: medium)\n  \n> https://groups.google.com/forum/#!topic/rubyonrails-security/dCp7duBiQgo\n> upgrade to ~> 3.2.20,~> 4.0.11,~> 4.1.7,>= 4.2.0.beta3\n\nSpecially crafted requests can be used to determine whether a file exists on\nthe filesystem that is outside the Rails application's root directory.  The\nfiles will not be served, but attackers can determine whether or not the file\nexists.\n\n\n##activerecord\n## activerecord (THREAT LEVEL: high)\n  \n> https://groups.google.com/forum/#!msg/rubyonrails-security/M4chq5Sb540/CC1Fh0Y_NWwJ\n> upgrade to ~> 4.0.9,>= 4.1.5\n\nThe create_with functionality in Active Record was implemented incorrectly and completely bypasses the strong parameters protection. Applications which pass user-controlled values to create_with could allow attackers to set arbitrary attributes on models.\n\n##activesupport\n## activesupport (THREAT LEVEL: unknown)\n  \n> https://groups.google.com/forum/#!topic/rubyonrails-security/bahr2JLnxvk\n> upgrade to >= 4.2.2,~> 4.1.11,~> 3.2.22\n\nSpecially crafted XML documents can cause applications to raise a \n`SystemStackError` and potentially cause a denial of service attack.  This \nonly impacts applications using REXML or JDOM as their XML processor.  Other \nXML processors that Rails supports are not impacted. \n\nAll users running an affected release should either upgrade or use one of the work arounds immediately.\n\nWorkarounds \n----------- \nUse an XML parser that is not impacted by this problem, such as Nokogiri or \nLibXML.  You can change the processor like this: \n\n  ActiveSupport::XmlMini.backend = 'Nokogiri' \n\nIf you cannot change XML parsers, then adjust \n`RUBY_THREAD_MACHINE_STACK_SIZE`. \n\n\n##nokogiri\n## nokogiri (THREAT LEVEL: unknown)\n  \n> https://github.com/sparklemotion/nokogiri/pull/1087\n> upgrade to >= 1.6.3\n\nNokogiri Gem for JRuby contains a flaw that is triggered when handling a root\nelement in an XML document. This may allow a remote attacker to cause a\nconsumption of memory resources.\n\n\n##rack\n## rack (THREAT LEVEL: unknown)\n  \n> https://groups.google.com/forum/#!topic/ruby-security-ann/gcUbICUmKMc\n> upgrade to >= 1.6.2,~> 1.5.4,~> 1.4.6\n\nCarefully crafted requests can cause a `SystemStackError` and potentially \ncause a denial of service attack. \n\nAll users running an affected release should upgrade. \n\n\n##sprockets\n## sprockets (THREAT LEVEL: medium)\n  \n> https://groups.google.com/forum/#!topic/rubyonrails-security/doAVp0YaTqY\n> upgrade to ~> 2.0.5,~> 2.1.4,~> 2.2.3,~> 2.3.3,~> 2.4.6,~> 2.5.1,~> 2.7.1,~> 2.8.3,~> 2.9.4,~> 2.10.2,~> 2.11.3,~> 2.12.3,>= 3.0.0.beta.3\n\nSpecially crafted requests can be used to determine whether a file exists on\nthe filesystem that is outside an application's root directory.  The files\nwill not be served, but attackers can determine whether or not the file\nexists.\n\n\n##uglifier\n## uglifier (THREAT LEVEL: unknown)\n  \n> https://github.com/mishoo/UglifyJS2/issues/751\n> upgrade to >= 2.7.2\n\n\nThe upstream library for the Ruby uglifier gem, UglifyJS, is\naffected by a vulnerability that allows a specially crafted \nJavascript file to have altered functionality after minification.\n\nThis bug, found in UglifyJS versions 2.4.23 and earlier, was demonstrated\nto allow potentially malicious code to be hidden within secure code, \nand activated by the minification process.\n\nFor more information, consult: https://zyan.scripts.mit.edu/blog/backdooring-js/\n\n\n##actionpack\n## actionpack (THREAT LEVEL: medium)\n  \n> https://groups.google.com/forum/#!topic/rubyonrails-security/rMTQy4oRCGk\n> upgrade to ~> 3.2.21,~> 4.0.11.1,~> 4.0.12,~> 4.1.7.1,>= 4.1.8\n\nSpecially crafted requests can be used to determine whether a file exists on\nthe filesystem that is outside the Rails application's root directory.  The\nfiles will not be served, but attackers can determine whether or not the file\nexists.  This vulnerability is very similar to CVE-2014-7818, but the\nspecially crafted string is slightly different.\n\n\n##jquery-rails\n## jquery-rails (THREAT LEVEL: medium)\n  \n> https://groups.google.com/forum/#!topic/ruby-security-ann/XIZPbobuwaY\n> upgrade to >= 4.0.4,~> 3.1.3\n\nIn the scenario where an attacker might be able to control the href attribute\nof an anchor tag or the action attribute of a form tag that will trigger a\nPOST action, the attacker can set the href or action to\n\" https://attacker.com\" (note the leading space) that will be passed to\nJQuery, who will see this as a same origin request, and send the user's CSRF\ntoken to the attacker domain.\n\nTo work around this problem, change code that allows users to control the\nhref attribute of an anchor tag or the action attribute of a form tag to\nfilter the user parameters.\n\nFor example, code like this:\n\n  link_to params\n\nto code like this:\n\n  link_to filtered_params\n\n  def filtered_params\n    \\# Filter just the parameters that you trust\n  end\n\nSee also:\n- http://blog.honeybadger.io/understanding-the-rails-jquery-csrf-vulnerability-cve-2015-1840/\n\n\n##nokogiri\n## nokogiri (THREAT LEVEL: unknown)\n  \n> https://github.com/sparklemotion/nokogiri/issues/1374\n> upgrade to ~> 1.6.6.4,>= 1.6.7.rc4\n\nSeveral vulnerabilities were discovered in the libxml2 and libxslt libraries\nthat the Nokogiri gem depends on.\n\nCVE-2015-1819\nA denial of service flaw was found in the way libxml2 parsed XML\ndocuments. This flaw could cause an application that uses libxml2 to use an\nexcessive amount of memory.\n\nCVE-2015-7941\nlibxml2 does not properly stop parsing invalid input, which allows\ncontext-dependent attackers to cause a denial of service (out-of-bounds read\nand libxml2 crash) via crafted specially XML data.\n\nCVE-2015-7942\nThe xmlParseConditionalSections function in parser.c in libxml2\ndoes not properly skip intermediary entities when it stops parsing invalid\ninput, which allows context-dependent attackers to cause a denial of service\n(out-of-bounds read and crash) via crafted XML data.\n\nCVE-2015-7995\nThe xsltStylePreCompute function in preproc.c in libxslt 1.1.28 does not\ncheck whether the parent node is an element, which allows attackers to cause\na denial of service using a specially crafted XML document.\n\nCVE-2015-8035\nThe xz_decomp function in xzlib.c in libxml2 2.9.1 does not\nproperly detect compression errors, which allows context-dependent attackers\nto cause a denial of service (process hang) via crafted XML data.\n\nAnother vulnerability was discoverd in libxml2 that could cause parsing\nof unclosed comments to result in \"conditional jump or move depends on\nuninitialized value(s)\" and unsafe memory access. This issue does not have a\nCVE assigned yet. See related URLs for details. Patched in v1.6.7.rc4.\n\n\n##will_paginate\n## will_paginate (THREAT LEVEL: medium)\n  \n> http://osvdb.org/show/osvdb/101138\n> upgrade to >= 3.0.5\n\nwill_paginate Gem for Ruby contains a flaw that allows a cross-site scripting (XSS) attack. This flaw exists because the application does not validate certain unspecified input related to generated pagination links before returning it to the user. This may allow an attacker to create a specially crafted request that would execute arbitrary script code in a users browser within the trust relationship between their browser and the server.\n"}}