🚨 [security] [ruby] Update all of rails: 6.1.3.2 → 6.1.4.3 (patch) #254

depfu · 2021-12-15T00:13:28Z

🚨 Your current dependencies have known security vulnerabilities 🚨

This dependency update fixes known security vulnerabilities. Please see the details below and assess their impact carefully. We recommend to merge and deploy this as soon as possible!

Here is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.

What changed?

✳️ capybara (3.35.3 → 3.36.0) · Repo · Changelog

Release Notes

3.36.0 (from changelog)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

✳️ rails (6.1.3.2 → 6.1.4.3) · Repo

Release Notes

6.1.4

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actioncable (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

Release Notes

6.1.4.2 (from changelog)

6.1.4.1 (from changelog)

6.1.4 (from changelog)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actionmailbox (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

↗️ actionmailer (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

Release Notes

6.1.4.2 (from changelog)

6.1.4.1 (from changelog)

6.1.4 (from changelog)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actionpack (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

Security Advisories 🚨

🚨 Possible Open Redirect in Host Authorization Middleware

🚨 Possible Open Redirect in Host Authorization Middleware

There is a possible open redirect vulnerability in the Host Authorization
middleware in Action Pack. This vulnerability has been assigned the CVE
identifier CVE-2021-22942.

Versions Affected: >= 6.0.0.
Not affected: < 6.0.0
Fixed Versions: 6.1.4.1, 6.0.4.1

Impact

Specially crafted “X-Forwarded-Host” headers in combination with certain
“allowed host” formats can cause the Host Authorization middleware in
Action Pack to redirect users to a malicious website.

Impacted applications will have allowed hosts with a leading dot.
For example, configuration files that look like this:

config.hosts <<  '.EXAMPLE.com'

When an allowed host contains a leading dot, a specially crafted
Host header can be used to redirect to a malicious website.

This vulnerability is similar to CVE-2021-22881, but CVE-2021-22881 did not
take in to account domain name case sensitivity.

Releases

The fixed releases are available at the normal locations.

Workarounds

In the case a patch can’t be applied, the following monkey patch can be
used in an initializer:

module ActionDispatch
  class HostAuthorization
    HOSTNAME = /[a-z0-9.-]+|\[[a-f0-9]*:[a-f0-9.:]+\]/i
    VALID_ORIGIN_HOST = /\A(#{HOSTNAME})(?::\d+)?\z/
    VALID_FORWARDED_HOST = /(?:\A|,[ ]?)(#{HOSTNAME})(?::\d+)?\z/
<span class="pl-k">private</span>
  <span class="pl-k">def</span> <span class="pl-en">authorized?</span><span class="pl-kos">(</span><span class="pl-s1">request</span><span class="pl-kos">)</span>
    <span class="pl-s1">origin_host</span> <span class="pl-c1">=</span>
      <span class="pl-s1">request</span><span class="pl-kos">.</span><span class="pl-en">get_header</span><span class="pl-kos">(</span><span class="pl-s">"HTTP_HOST"</span><span class="pl-kos">)</span>&amp;.<span class="pl-en">slice</span><span class="pl-kos">(</span><span class="pl-c1">VALID_ORIGIN_HOST</span><span class="pl-kos">,</span> <span class="pl-c1">1</span><span class="pl-kos">)</span> || <span class="pl-s">""</span>
    <span class="pl-s1">forwarded_host</span> <span class="pl-c1">=</span>
      <span class="pl-s1">request</span><span class="pl-kos">.</span><span class="pl-en">x_forwarded_host</span>&amp;.<span class="pl-en">slice</span><span class="pl-kos">(</span><span class="pl-c1">VALID_FORWARDED_HOST</span><span class="pl-kos">,</span> <span class="pl-c1">1</span><span class="pl-kos">)</span> || <span class="pl-s">""</span>
    <span class="pl-c1">@permissions</span><span class="pl-kos">.</span><span class="pl-en">allows?</span><span class="pl-kos">(</span><span class="pl-s1">origin_host</span><span class="pl-kos">)</span> &amp;&amp;
      <span class="pl-kos">(</span><span class="pl-s1">forwarded_host</span><span class="pl-kos">.</span><span class="pl-en">blank?</span> || <span class="pl-c1">@permissions</span><span class="pl-kos">.</span><span class="pl-en">allows?</span><span class="pl-kos">(</span><span class="pl-s1">forwarded_host</span><span class="pl-kos">)</span><span class="pl-kos">)</span>
  <span class="pl-k">end</span>

end

end

Release Notes

6.1.4.2 (from changelog)

6.1.4.1 (from changelog)

6.1.4 (from changelog)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actiontext (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

Release Notes

6.1.4.2 (from changelog)

6.1.4.1 (from changelog)

6.1.4 (from changelog)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ actionview (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

Release Notes

6.1.4.2 (from changelog)

6.1.4.1 (from changelog)

6.1.4 (from changelog)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activejob (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

Release Notes

6.1.4.2 (from changelog)

6.1.4.1 (from changelog)

6.1.4 (from changelog)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activemodel (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

Release Notes

6.1.4.2 (from changelog)

6.1.4.1 (from changelog)

6.1.4 (from changelog)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activerecord (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

Release Notes

6.1.4.2 (from changelog)

6.1.4.1 (from changelog)

6.1.4 (from changelog)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activestorage (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

Release Notes

6.1.4.2 (from changelog)

6.1.4.1 (from changelog)

6.1.4 (from changelog)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ activesupport (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

Release Notes

6.1.4.2 (from changelog)

6.1.4.1 (from changelog)

6.1.4 (from changelog)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ concurrent-ruby (indirect, 1.1.8 → 1.1.9) · Repo · Changelog

Release Notes

1.1.9 (from changelog)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ globalid (indirect, 0.4.2 → 1.0.0) · Repo · Changelog

Release Notes

1.0.0

0.6.0

0.5.2

0.5.1

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ i18n (indirect, 1.8.10 → 1.8.11) · Repo · Changelog

Release Notes

1.8.11

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ loofah (indirect, 2.9.1 → 2.13.0) · Repo · Changelog

Release Notes

2.13.0

2.12.0

2.11.0

2.10.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ marcel (indirect, 1.0.1 → 1.0.2) · Repo

Release Notes

1.0.2

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ mini_mime (indirect, 1.0.3 → 1.1.2) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ nio4r (indirect, 2.5.7 → 2.5.8) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ racc (indirect, 1.5.2 → 1.6.0) · Repo · Changelog

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ rails-html-sanitizer (indirect, 1.3.0 → 1.4.2) · Repo · Changelog

Release Notes

1.4.2

1.4.1

1.4.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ railties (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

Release Notes

6.1.4.2 (from changelog)

6.1.4.1 (from changelog)

6.1.4 (from changelog)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ rake (indirect, 13.0.3 → 13.0.6) · Repo · Changelog

Release Notes

13.0.6 (from changelog)

13.0.5 (from changelog)

13.0.4 (from changelog)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ regexp_parser (indirect, 2.1.1 → 2.2.0) · Repo · Changelog

Release Notes

2.2.0 (from changelog)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ sprockets-rails (indirect, 3.2.2 → 3.4.2) · Repo · Changelog

Release Notes

3.4.2

3.4.1

3.4.0

3.3.0

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ websocket-driver (indirect, 0.7.3 → 0.7.5) · Repo · Changelog

Release Notes

0.7.5 (from changelog)

0.7.4 (from changelog)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

↗️ zeitwerk (indirect, 2.4.2 → 2.5.1) · Repo · Changelog

Release Notes

2.5.1 (from changelog)

2.5.0 (from changelog)

Does any of this look wrong? Please let us know.

Commits

See the full diff on Github. The new version differs by more commits than we can show here.

🆕 matrix (added, 0.4.2)

Depfu will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with @depfu rebase.

All Depfu comment commands

Update all of rails to version 6.1.4.3

0447159

depfu bot added dependencies Pull requests that update a dependency file depfu labels Dec 15, 2021

depfu bot mentioned this pull request Dec 15, 2021

🚨 [security] [ruby] Update all of rails: 6.1.3.2 → 6.1.4.1 (patch) #234

Closed

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

🚨 [security] [ruby] Update all of rails: 6.1.3.2 → 6.1.4.3 (patch) #254

🚨 [security] [ruby] Update all of rails: 6.1.3.2 → 6.1.4.3 (patch) #254

depfu bot commented Dec 15, 2021 •

edited

Loading

🚨 [security] [ruby] Update all of rails: 6.1.3.2 → 6.1.4.3 (patch) #254

Are you sure you want to change the base?

🚨 [security] [ruby] Update all of rails: 6.1.3.2 → 6.1.4.3 (patch) #254

Conversation

depfu bot commented Dec 15, 2021 • edited Loading

What changed?

✳️ capybara (3.35.3 → 3.36.0) · Repo · Changelog

3.36.0 (from changelog)

✳️ rails (6.1.3.2 → 6.1.4.3) · Repo

↗️ actioncable (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

6.1.4.2 (from changelog)

6.1.4.1 (from changelog)

6.1.4 (from changelog)

↗️ actionmailbox (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

↗️ actionmailer (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

6.1.4.2 (from changelog)

6.1.4.1 (from changelog)

6.1.4 (from changelog)

↗️ actionpack (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

Releases

Patches

Impact

Releases

Workarounds

6.1.4.2 (from changelog)

6.1.4.1 (from changelog)

6.1.4 (from changelog)

↗️ actiontext (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

6.1.4.2 (from changelog)

6.1.4.1 (from changelog)

6.1.4 (from changelog)

↗️ actionview (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

6.1.4.2 (from changelog)

6.1.4.1 (from changelog)

6.1.4 (from changelog)

↗️ activejob (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

6.1.4.2 (from changelog)

6.1.4.1 (from changelog)

6.1.4 (from changelog)

↗️ activemodel (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

6.1.4.2 (from changelog)

6.1.4.1 (from changelog)

6.1.4 (from changelog)

↗️ activerecord (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

6.1.4.2 (from changelog)

6.1.4.1 (from changelog)

6.1.4 (from changelog)

↗️ activestorage (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

6.1.4.2 (from changelog)

6.1.4.1 (from changelog)

6.1.4 (from changelog)

↗️ activesupport (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

6.1.4.2 (from changelog)

6.1.4.1 (from changelog)

6.1.4 (from changelog)

↗️ concurrent-ruby (indirect, 1.1.8 → 1.1.9) · Repo · Changelog

1.1.9 (from changelog)

↗️ globalid (indirect, 0.4.2 → 1.0.0) · Repo · Changelog

↗️ i18n (indirect, 1.8.10 → 1.8.11) · Repo · Changelog

↗️ loofah (indirect, 2.9.1 → 2.13.0) · Repo · Changelog

↗️ marcel (indirect, 1.0.1 → 1.0.2) · Repo

↗️ mini_mime (indirect, 1.0.3 → 1.1.2) · Repo · Changelog

↗️ nio4r (indirect, 2.5.7 → 2.5.8) · Repo · Changelog

↗️ racc (indirect, 1.5.2 → 1.6.0) · Repo · Changelog

↗️ rails-html-sanitizer (indirect, 1.3.0 → 1.4.2) · Repo · Changelog

↗️ railties (indirect, 6.1.3.2 → 6.1.4.3) · Repo · Changelog

6.1.4.2 (from changelog)

6.1.4.1 (from changelog)

6.1.4 (from changelog)

↗️ rake (indirect, 13.0.3 → 13.0.6) · Repo · Changelog

13.0.6 (from changelog)

13.0.5 (from changelog)

13.0.4 (from changelog)

↗️ regexp_parser (indirect, 2.1.1 → 2.2.0) · Repo · Changelog

2.2.0 (from changelog)

↗️ sprockets-rails (indirect, 3.2.2 → 3.4.2) · Repo · Changelog

↗️ websocket-driver (indirect, 0.7.3 → 0.7.5) · Repo · Changelog

0.7.5 (from changelog)

0.7.4 (from changelog)

↗️ zeitwerk (indirect, 2.4.2 → 2.5.1) · Repo · Changelog

depfu bot commented Dec 15, 2021 •

edited

Loading