Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

🚨 [security] Update middleman: 4.3.6 → 4.3.11 (patch) #140

Closed
wants to merge 1 commit into from
Closed

🚨 [security] Update middleman: 4.3.6 → 4.3.11 (patch) #140

wants to merge 1 commit into from

Conversation

depfu[bot]
Copy link
Contributor

@depfu depfu bot commented Sep 16, 2020

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ middleman (4.3.6 → 4.3.11) · Repo · Changelog

↗️ activesupport (indirect, 5.0.7.2 → 5.2.4.4) · Repo · Changelog

Security Advisories 🚨

🚨 Potentially unintended unmarshalling of user-provided objects in MemCacheStore and RedisCacheStore

There is potentially unexpected behaviour in the MemCacheStore and RedisCacheStore where, when
untrusted user input is written to the cache store using the raw: true parameter, re-reading the result
from the cache can evaluate the user input as a Marshalled object instead of plain text. Vulnerable code looks like:

data = cache.fetch("demo", raw: true) { untrusted_string }

Versions Affected: rails < 5.2.5, rails < 6.0.4
Not affected: Applications not using MemCacheStore or RedisCacheStore. Applications that do not use the raw option when storing untrusted user input.
Fixed Versions: rails >= 5.2.4.3, rails >= 6.0.3.1

Impact

Unmarshalling of untrusted user input can have impact up to and including RCE. At a minimum,
this vulnerability allows an attacker to inject untrusted Ruby objects into a web application.

In addition to upgrading to the latest versions of Rails, developers should ensure that whenever
they are calling Rails.cache.fetch they are using consistent values of the raw parameter for both
reading and writing, especially in the case of the RedisCacheStore which does not, prior to these changes,
detect if data was serialized using the raw option upon deserialization.

Workarounds

It is recommended that application developers apply the suggested patch or upgrade to the latest release as
soon as possible. If this is not possible, we recommend ensuring that all user-provided strings cached using
the raw argument should be double-checked to ensure that they conform to the expected format.

Release Notes

5.2.4.4 (from changelog)

  • No changes.

5.2.4.3 (from changelog)

  • [CVE-2020-8165] Deprecate Marshal.load on raw cache read in RedisCacheStore

  • [CVE-2020-8165] Avoid Marshal.load on raw cache value in MemCacheStore

5.2.4.1 (from changelog)

  • No changes.

5.2.4 (from changelog)

  • Make ActiveSupport::Logger Fiber-safe. Fixes #36752.

    Use Fiber.current.__id__ in ActiveSupport::Logger#local_level= in order to make log level local to Ruby Fibers in addition to Threads.

    Example:

    logger = ActiveSupport::Logger.new(STDOUT)
logger.level = 1
p "Main is debug? #{logger.debug?}"

    Fiber.new {
    
logger.local_level = 0
    
p "Thread is debug? #{logger.debug?}"
    
}.resume
    

    p "Main is debug? #{logger.debug?}"

    Before:

    Main is debug? false
Thread is debug? true
Main is debug? true

    After:

    Main is debug? false
Thread is debug? true
Main is debug? false

    Alexander Varnin

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ backports (indirect, 3.16.1 → 3.18.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by 28 commits:

↗️ concurrent-ruby (indirect, 1.1.6 → 1.1.7) · Repo · Changelog

Release Notes

1.1.7 (from changelog)

concurrent-ruby:

  • (#879) Consider falsy value on Concurrent::Map#compute_if_absent for fast non-blocking path
  • (#876) Reset Async queue on forking, makes Async fork-safe
  • (#856) Avoid running problematic code in RubyThreadLocalVar on MRI that occasionally results in segfault
  • (#853) Introduce ThreadPoolExecutor without a Queue

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 42 commits:

↗️ dotenv (indirect, 2.7.5 → 2.7.6) · Repo · Changelog

Release Notes

2.7.6

2.7.6 - July 11, 2020

  • Add a Dotenv::Railtie.overload method #403
  • Support for more Rails versions #404
  • Fix template handling of blank lines and comments #413
  • Fix for dotenv-rails Rake task environment allocation#405

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 10 commits:

↗️ fastimage (indirect, 2.1.7 → 2.2.0) · Repo

Commits

See the full diff on Github. The new version differs by 18 commits:

↗️ ffi (indirect, 1.12.2 → 1.13.1) · Repo · Changelog

Release Notes

1.13.1 (from changelog)

Changed:

  • Revert use of ucrtbase.dll as default C library on Windows-MINGW. ucrtbase.dll is still used on MSWIN target. #790
  • Test for ffi_prep_closure_loc() to make sure we can use this function. This fixes incorrect use of system libffi on MacOS Mojave (10.14). #787
  • Update types.conf on x86_64-dragonflybsd

1.13.0 (from changelog)

Added:

  • Add TruffleRuby support. Almost all specs are running on TruffleRuby and succeed. #768
  • Add ruby source files to the java gem. This allows to ship the Ruby library code per platform java gem and add it as a default gem to JRuby. #763
  • Add FFI::Platform::LONG_DOUBLE_SIZE
  • Add bounds checks for writing to an inline char[] . #756
  • Add long double as callback return value. #771
  • Update type definitions and add types from stdint.h and stddef.h on i386-windows, x86_64-windows, x86_64-darwin, x86_64-linux, arm-linux, powerpc-linux. #749
  • Add new type definitions for powerpc-openbsd and sparcv9-openbsd. #775, #778

Changed:

  • Raise required ruby version to >= 2.3.
  • Lots of cleanups and improvements in library, specs and benchmarks.
  • Fix a lot of compiler warnings at the C-extension
  • Fix several install issues on MacOS:
    • Look for libffi in SDK paths, since recent versions of macOS removed it from /usr/include . #757
    • Fix error ld: library not found for -lgcc_s.10.4
    • Don't built for i386 architecture as it is deprecated
  • Several fixes for MSVC build on Windows. #779
  • Use ucrtbase.dll as default C library on Windows instead of old msvcrt.dll. #779
  • Update builtin libffi to fix a Powerpc issue with parameters of type long
  • Allow unmodified sourcing of (the ruby code of) this gem in JRuby and TruffleRuby as a default gem. #747
  • Improve check to detect if a module has a #find_type method suitable for FFI. This fixes compatibility with stdlib mkmf . #776

Removed:

  • Reject callback with :string return type at definition, because it didn't work so far and is not save to use. #751, #782

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ kramdown (indirect, 1.17.0 → 2.3.0) · Repo · Changelog

Security Advisories 🚨

🚨 Unintended read access in kramdown gem

The kramdown gem before 2.3.0 for Ruby processes the template option inside
Kramdown documents by default, which allows unintended read access (such as
template="/etc/passwd") or unintended embedded Ruby code execution (such as a
string that begins with template="string://<%= `). NOTE: kramdown is used in
Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

↗️ middleman-cli (indirect, 4.3.6 → 4.3.11)

Sorry, we couldn't find anything useful about this release.

↗️ middleman-core (indirect, 4.3.6 → 4.3.11)

Sorry, we couldn't find anything useful about this release.

↗️ minitest (indirect, 5.14.0 → 5.14.2) · Repo · Changelog

Release Notes

5.14.2 (from changelog)

  • 1 bug fix:

    • Bumped ruby version to include 3.0 (trunk).

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 10 commits:

↗️ parallel (indirect, 1.19.1 → 1.19.2) · Repo

Commits

See the full diff on Github. The new version differs by 6 commits:

↗️ public_suffix (indirect, 4.0.3 → 4.0.6) · Repo · Changelog

Release Notes

4.0.6 (from changelog)

Changed

  • Updated definitions.

4.0.5 (from changelog)

Changed

  • Updated definitions.

4.0.4 (from changelog)

Changed

  • Updated definitions.

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 26 commits:

↗️ rack (indirect, 2.2.2 → 2.2.3) · Repo · Changelog

Security Advisories 🚨

🚨 Percent-encoded cookies can be used to overwrite existing prefixed cookie names

It is possible to forge a secure or host-only cookie prefix in Rack using
an arbitrary cookie write by using URL encoding (percent-encoding) on the
name of the cookie. This could result in an application that is dependent on
this prefix to determine if a cookie is safe to process being manipulated
into processing an insecure or cross-origin request.
This vulnerability has been assigned the CVE identifier CVE-2020-8184.

Versions Affected: rack < 2.2.3, rack < 2.1.4
Not affected: Applications which do not rely on __Host- and __Secure- prefixes to determine if a cookie is safe to process
Fixed Versions: rack >= 2.2.3, rack >= 2.1.4

Impact

An attacker may be able to trick a vulnerable application into processing an
insecure (non-SSL) or cross-origin request if they can gain the ability to write
arbitrary cookies that are sent to the application.

Workarounds

If your application is impacted but you cannot upgrade to the released versions or apply
the provided patch, this issue can be temporarily addressed by adding the following workaround:

module Rack
  module Utils
    module_function def parse_cookies_header(header)
      return {} unless header
      header.split(/[;] */n).each_with_object({}) do |cookie, cookies|
        next if cookie.empty?
        key, value = cookie.split('=', 2)
        cookies[key] = (unescape(value) rescue value) unless cookies.key?(key)
      end
    end
  end
end
Commits

See the full diff on Github. The new version differs by 2 commits:

↗️ rb-fsevent (indirect, 0.10.3 → 0.10.4) · Repo

Release Notes

0.10.4

  • Remove bundler development dependency #85

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 3 commits:

↗️ sassc (indirect, 2.2.1 → 2.4.0) · Repo

Commits

See the full diff on Github. The new version differs by 34 commits:

↗️ tzinfo (indirect, 1.2.6 → 1.2.7) · Repo · Changelog

Release Notes

1.2.7

  • Fixed 'wrong number of arguments' errors when running on JRuby 9.0. #114.
  • Fixed warnings when running on Ruby 2.8. #112.

TZInfo v1.2.7 on RubyGems.org

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by 19 commits:

🆕 rexml (added, 3.2.4)

Depfu Status

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands
@​depfu rebase
Rebases against your default branch and redoes this update
@​depfu recreate
Recreates this PR, overwriting any edits that you've made to it
@​depfu merge
Merges this PR once your tests are passing and conflicts are resolved
@​depfu close
Closes this PR and deletes the branch
@​depfu reopen
Restores the branch and reopens this PR (if it's closed)
@​depfu pause
Ignores all future updates for this dependency and closes this PR
@​depfu pause [minor|major]
Ignores all future minor/major updates for this dependency and closes this PR
@​depfu resume
Future versions of this dependency will create PRs again (leaves this PR as is)

@depfu depfu bot added the depfu label Sep 16, 2020
@depfu depfu bot mentioned this pull request Sep 16, 2020
Closed
@grdw grdw closed this Jun 24, 2024
@grdw grdw deleted the depfu/update/middleman-4.3.11 branch June 24, 2024 12:43
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Reviewers
No reviews
Assignees
No one assigned
Labels
depfu
Projects
None yet
Milestone
No milestone
Development

Successfully merging this pull request may close these issues.
1 participant
@grdw