New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Bump activerecord to address CVE-2016-6317 #476

Merged

gabrielpoca merged 1 commit into master from vk-bump-activerecord

Mar 30, 2018

Contributor

Koronen commented Mar 20, 2018

As reported by bundler-audit:

Name: activerecord
Version: 4.2.6
Advisory: CVE-2016-6317
Criticality: Unknown
URL: https://groups.google.com/forum/#!topic/rubyonrails-security/rgO20zYW33s
Title: Unsafe Query Generation Risk in Active Record
Solution: upgrade to >= 4.2.7.1

Ref: https://github.com/rails/rails/blob/v4.2.10/activemodel/CHANGELOG.md#rails-4210-september-27-2017
Ref: https://github.com/rails/rails/blob/v4.2.10/activerecord/CHANGELOG.md#rails-4210-september-27-2017
Ref: https://github.com/rails/rails/blob/v4.2.10/activesupport/CHANGELOG.md#rails-4210-september-27-2017


          Bump activerecord to address CVE-2016-6317

ca45534

As reported by `bundler-audit`:

> Name: activerecord
> Version: 4.2.6
> Advisory: CVE-2016-6317
> Criticality: Unknown
> URL: https://groups.google.com/forum/#!topic/rubyonrails-security/rgO20zYW33s
> Title: Unsafe Query Generation Risk in Active Record
> Solution: upgrade to >= 4.2.7.1

Ref:
<https://github.com/rails/rails/blob/v4.2.10/activemodel/CHANGELOG.md#rails-4210-september-27-2017>
Ref:
<https://github.com/rails/rails/blob/v4.2.10/activerecord/CHANGELOG.md#rails-4210-september-27-2017>
Ref:
<https://github.com/rails/rails/blob/v4.2.10/activesupport/CHANGELOG.md#rails-4210-september-27-2017>

gabrielpoca merged commit 2bfc7f3 into master

Koronen deleted the vk-bump-activerecord branch

March 31, 2018 16:16

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet