Skip to content

[Snyk] Security upgrade sentry-rails from 5.10.0 to 5.11.0#3

Open
chrisallenlane wants to merge 1 commit intomainfrom
snyk-fix-4cb7dc83bd6796ca24655ff551d59834
Open

[Snyk] Security upgrade sentry-rails from 5.10.0 to 5.11.0#3
chrisallenlane wants to merge 1 commit intomainfrom
snyk-fix-4cb7dc83bd6796ca24655ff551d59834

Conversation

@chrisallenlane
Copy link
Copy Markdown

snyk-top-banner

Snyk has created this PR to fix 38 vulnerabilities in the rubygems dependencies of this project.

Snyk changed the following file(s):

  • Gemfile
⚠️ Warning
Failed to update the Gemfile.lock, please update manually before merging.

Vulnerabilities that will be fixed with an upgrade:

Issue Score
critical severity Arbitrary Code Injection
SNYK-RUBY-RACK-2848599
  191  
medium severity Web Cache Poisoning
SNYK-RUBY-RACK-1061917
  141  
high severity Improper Output Neutralization for Logs
SNYK-RUBY-RACK-8720151
  134  
high severity Allocation of Resources Without Limits or Throttling
SNYK-RUBY-RACK-10074187
  124  
high severity Relative Path Traversal
SNYK-RUBY-RACK-9398129
  124  
high severity Denial of Service (DoS)
SNYK-RUBY-RACK-3356639
  117  
high severity Denial of Service (DoS)
SNYK-RUBY-RACK-2848600
  115  
high severity Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-LOOFAH-3168317
  114  
high severity Uncontrolled Recursion
SNYK-RUBY-LOOFAH-3168649
  114  
high severity Denial of Service (DoS)
SNYK-RUBY-RACK-6274385
  114  
high severity Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-RAILSHTMLSANITIZER-3168646
  114  
medium severity Cross-site Scripting (XSS)
SNYK-RUBY-RAILSHTMLSANITIZER-3168647
  101  
medium severity Cross-site Scripting (XSS)
SNYK-RUBY-ACTIONVIEW-2803851
  95  
medium severity Cross-site Scripting (XSS)
SNYK-RUBY-RAILSHTMLSANITIZER-2935879
  88  
low severity Race Condition
SNYK-RUBY-RACK-10074188
  70  
medium severity Cross-site Scripting (XSS)
SNYK-RUBY-ACTIVESUPPORT-3360028
  66  
medium severity Cross-site Scripting (XSS)
SNYK-RUBY-LOOFAH-3168318
  66  
low severity Cross-site Scripting (XSS)
SNYK-RUBY-ACTIONPACK-8496389
  64  
medium severity Cross-site Scripting (XSS)
SNYK-RUBY-RAILSHTMLSANITIZER-3168316
  62  
medium severity Cross-site Scripting (XSS)
SNYK-RUBY-ACTIONPACK-2803847
  61  
medium severity Improper Input Validation
SNYK-RUBY-ACTIONPACK-7210237
  61  
medium severity Cross-site Scripting (XSS)
SNYK-RUBY-ACTIONPACK-5741907
  56  
medium severity Cross-site Scripting (XSS)
SNYK-RUBY-RAILSHTMLSANITIZER-3168648
  52  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-ACTIONPACK-8220162
  49  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-ACTIONPACK-8220268
  49  
medium severity Improper Output Neutralization for Logs
SNYK-RUBY-RACK-9058602
  49  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-ACTIONPACK-3237232
  46  
medium severity Exposure of Data Element to Wrong Session
SNYK-RUBY-ACTIONPACK-6274388
  46  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-ACTIVESUPPORT-3237242
  46  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-RACK-3237233
  46  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-RACK-3237240
  46  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-ACTIONPACK-3237231
  45  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-RACK-3237237
  45  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-RACK-3360233
  45  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-RACK-6274383
  45  
medium severity Regular Expression Denial of Service (ReDoS)
SNYK-RUBY-RACK-6274384
  45  
medium severity Information Exposure
SNYK-RUBY-ACTIVESUPPORT-5851458
  41  
medium severity Information Exposure
SNYK-RUBY-RAILTIES-5851410
  41  

Important

  • Check the changes in this PR to ensure they won't cause issues with your project.
  • Max score is 1000. Note that the real score may have changed since the PR was raised.
  • This PR was automatically created by Snyk using the credentials of a real user.

Note: You are seeing this because you or someone else with access to this repository has authorized Snyk to open fix PRs.

For more information:
🧐 View latest project report
📜 Customise PR templates
🛠 Adjust project settings
📚 Read about Snyk's upgrade logic


Learn how to fix vulnerabilities with free interactive lessons:

🦉 Cross-site Scripting (XSS)
🦉 Regular Expression Denial of Service (ReDoS)
🦉 Improper Input Validation
🦉 More lessons are available in Snyk Learn

The following vulnerabilities are fixed with an upgrade:
- https://snyk.io/vuln/SNYK-RUBY-RACK-2848599
- https://snyk.io/vuln/SNYK-RUBY-RACK-1061917
- https://snyk.io/vuln/SNYK-RUBY-RACK-8720151
- https://snyk.io/vuln/SNYK-RUBY-RACK-10074187
- https://snyk.io/vuln/SNYK-RUBY-RACK-9398129
- https://snyk.io/vuln/SNYK-RUBY-RACK-3356639
- https://snyk.io/vuln/SNYK-RUBY-RACK-2848600
- https://snyk.io/vuln/SNYK-RUBY-LOOFAH-3168317
- https://snyk.io/vuln/SNYK-RUBY-LOOFAH-3168649
- https://snyk.io/vuln/SNYK-RUBY-RACK-6274385
- https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-3168646
- https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-3168647
- https://snyk.io/vuln/SNYK-RUBY-ACTIONVIEW-2803851
- https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-2935879
- https://snyk.io/vuln/SNYK-RUBY-RACK-10074188
- https://snyk.io/vuln/SNYK-RUBY-ACTIVESUPPORT-3360028
- https://snyk.io/vuln/SNYK-RUBY-LOOFAH-3168318
- https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-8496389
- https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-3168316
- https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-2803847
- https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-7210237
- https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-5741907
- https://snyk.io/vuln/SNYK-RUBY-RAILSHTMLSANITIZER-3168648
- https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-8220162
- https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-8220268
- https://snyk.io/vuln/SNYK-RUBY-RACK-9058602
- https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-3237232
- https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-6274388
- https://snyk.io/vuln/SNYK-RUBY-ACTIVESUPPORT-3237242
- https://snyk.io/vuln/SNYK-RUBY-RACK-3237233
- https://snyk.io/vuln/SNYK-RUBY-RACK-3237240
- https://snyk.io/vuln/SNYK-RUBY-ACTIONPACK-3237231
- https://snyk.io/vuln/SNYK-RUBY-RACK-3237237
- https://snyk.io/vuln/SNYK-RUBY-RACK-3360233
- https://snyk.io/vuln/SNYK-RUBY-RACK-6274383
- https://snyk.io/vuln/SNYK-RUBY-RACK-6274384
- https://snyk.io/vuln/SNYK-RUBY-ACTIVESUPPORT-5851458
- https://snyk.io/vuln/SNYK-RUBY-RAILTIES-5851410
Copy link
Copy Markdown
Member

@ccutrer ccutrer left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The lockfile wasn't changed (via a bundle update --conservative sentry-rails), so this doesn't actually accomplish anything.

gem "rspec", "~> 3.0"
gem "pg"
gem "sentry-rails", "~> 5.10"
gem "sentry-rails", "~> 5.11", ">= 5.11.0"
Copy link
Copy Markdown
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The ">= 5.11.0" is superfluous

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

3 participants