{"push_id":1298959454,"size":14,"distinct_size":14,"ref":"refs/heads/master","head":"12280f3b863fd629ec038c809d43ce8dae04ff02","before":"7a3cf7e1e65b2759cf26ad7b718b079014353e5a","commits":[{"sha":"ec08baa18dfc27fcd68af5f20d584962ce18b949","author":{"name":"Daniel O'Connor","email":"4723576065a1e3329d34722e1c36bd80382cbec6@gmail.com"},"message":"Name: rest-client\nVersion: 1.7.2\nAdvisory: CVE-2015-3448\nCriticality: Unknown\nURL: http://www.osvdb.org/show/osvdb/117461\nTitle: Rest-Client Gem for Ruby logs password information in plaintext\nSolution: upgrade to >= 1.7.3","distinct":true,"url":"https://api.github.com/repos/openfarmcc/OpenFarm/commits/ec08baa18dfc27fcd68af5f20d584962ce18b949"},{"sha":"13d2fa313ce74828a25edb9f9440ad40368a5421","author":{"name":"Daniel O'Connor","email":"4723576065a1e3329d34722e1c36bd80382cbec6@gmail.com"},"message":"Name: rack-attack\nVersion: 4.2.0\nAdvisory: 132234\nCriticality: Unknown\nURL: https://github.com/kickstarter/rack-attack/releases/tag/v4.3.1\nTitle: rack-attack Gem for Ruby missing normalization before request path\nprocessing\nSolution: upgrade to >= 4.3.1","distinct":true,"url":"https://api.github.com/repos/openfarmcc/OpenFarm/commits/13d2fa313ce74828a25edb9f9440ad40368a5421"},{"sha":"98d891fdc49c76d20073260f189b27d5d0aef3fe","author":{"name":"Daniel O'Connor","email":"4723576065a1e3329d34722e1c36bd80382cbec6@gmail.com"},"message":"Name: nokogiri\nVersion: 1.6.6.1\nAdvisory: CVE-2015-1819\nCriticality: Unknown\nURL: https://github.com/sparklemotion/nokogiri/issues/1374\nTitle: Nokogiri gem contains several vulnerabilities in libxml2 and libxslt\nSolution: upgrade to ~> 1.6.6.4, >= 1.6.7.rc4\n\nName: nokogiri\nVersion: 1.6.6.1\nAdvisory: CVE-2015-8806\nCriticality: Unknown\nURL: https://github.com/sparklemotion/nokogiri/issues/1473\nTitle: Denial of service or RCE from libxml2 and libxslt\nSolution: upgrade to >= 1.6.8\n\nName: nokogiri\nVersion: 1.6.6.1\nAdvisory: CVE-2015-7499\nCriticality: Medium\nURL: https://groups.google.com/forum/#!topic/ruby-security-ann/Dy7YiKb_pMM\nTitle: Nokogiri gem contains a heap-based buffer overflow vulnerability in libxml2\nSolution: upgrade to >= 1.6.7.2\n\nName: nokogiri\nVersion: 1.6.6.1\nAdvisory: CVE-2015-5312\nCriticality: High\nURL: https://groups.google.com/forum/#!topic/ruby-security-ann/aSbgDiwb24s\nTitle: Nokogiri gem contains several vulnerabilities in libxml2\nSolution: upgrade to >= 1.6.7.1","distinct":true,"url":"https://api.github.com/repos/openfarmcc/OpenFarm/commits/98d891fdc49c76d20073260f189b27d5d0aef3fe"},{"sha":"b0eb86321fa9c2d96bf24f991c99ece08150a7d2","author":{"name":"Daniel O'Connor","email":"4723576065a1e3329d34722e1c36bd80382cbec6@gmail.com"},"message":"Name: paperclip\nVersion: 4.2.1\nAdvisory: CVE-2015-2963\nCriticality: Medium\nURL: https://robots.thoughtbot.com/paperclip-security-release\nTitle: Paperclip Gem for Ruby vulnerable to content type spoofing\nSolution: upgrade to >= 4.2.2","distinct":true,"url":"https://api.github.com/repos/openfarmcc/OpenFarm/commits/b0eb86321fa9c2d96bf24f991c99ece08150a7d2"},{"sha":"9249a79239405ad0082b61ac2527eba16c3943d5","author":{"name":"Daniel O'Connor","email":"4723576065a1e3329d34722e1c36bd80382cbec6@gmail.com"},"message":"Name: actionpack\nVersion: 4.1.9\nAdvisory: CVE-2015-7581\nCriticality: Unknown\nURL: https://groups.google.com/forum/#!topic/rubyonrails-security/dthJ5wL69JE\nTitle: Object leak vulnerability for wildcard controller routes in Action Pack\nSolution: upgrade to >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14\n\nName: actionpack\nVersion: 4.1.9\nAdvisory: CVE-2016-0751\nCriticality: Unknown\nURL: https://groups.google.com/forum/#!topic/rubyonrails-security/9oLY_FCzvoc\nTitle: Possible Object Leak and Denial of Service attack in Action Pack\nSolution: upgrade to ~> 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14, ~> 3.2.22.1\n\nName: actionpack\nVersion: 4.1.9\nAdvisory: CVE-2015-7576\nCriticality: Unknown\nURL: https://groups.google.com/forum/#!topic/rubyonrails-security/ANv0HDHEC3k\nTitle: Timing attack vulnerability in basic authentication in Action Controller.\nSolution: upgrade to ~> 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14, ~> 3.2.22.1\n\nName: actionpack\nVersion: 4.1.9\nAdvisory: CVE-2016-2098\nCriticality: Unknown\nURL: https://groups.google.com/forum/#!topic/rubyonrails-security/ly-IH-fxr_Q\nTitle: Possible remote code execution vulnerability in Action Pack\nSolution: upgrade to ~> 3.2.22.2, >= 4.2.5.2, ~> 4.2.5, >= 4.1.14.2, ~> 4.1.14\n\nName: actionview\nVersion: 4.1.9\nAdvisory: CVE-2016-2097\nCriticality: Unknown\nURL: https://groups.google.com/forum/#!topic/rubyonrails-security/ddY6HgqB2z4\nTitle: Possible Information Leak Vulnerability in Action View\nSolution: upgrade to ~> 3.2.22.2, >= 4.1.14.2, ~> 4.1.14\n\nName: actionview\nVersion: 4.1.9\nAdvisory: CVE-2016-0752\nCriticality: Unknown\nURL: https://groups.google.com/forum/#!topic/rubyonrails-security/335P1DcLG00\nTitle: Possible Information Leak Vulnerability in Action View\nSolution: upgrade to ~> 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14, ~> 3.2.22.1\n\nName: actionview\nVersion: 4.1.9\nAdvisory: CVE-2016-6316\nCriticality: Unknown\nURL: https://groups.google.com/forum/#!topic/rubyonrails-security/I-VWr034ouk\nTitle: Possible XSS Vulnerability in Action View\nSolution: upgrade to ~> 3.2.22.3, ~> 4.2.7.1, >= 5.0.0.1\n\nName: activemodel\nVersion: 4.1.9\nAdvisory: CVE-2016-0753\nCriticality: Unknown\nURL: https://groups.google.com/forum/#!topic/rubyonrails-security/6jQVC1geukQ\nTitle: Possible Input Validation Circumvention in Active Model\nSolution: upgrade to ~> 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14\n\nName: activerecord\nVersion: 4.1.9\nAdvisory: CVE-2015-7577\nCriticality: Unknown\nURL: https://groups.google.com/forum/#!topic/rubyonrails-security/cawsWcQ6c8g\nTitle: Nested attributes rejection proc bypass in Active Record\nSolution: upgrade to ~> 5.0.0.beta1.1, >= 4.2.5.1, ~> 4.2.5, >= 4.1.14.1, ~> 4.1.14, ~> 3.2.22.1\n\nName: activesupport\nVersion: 4.1.9\nAdvisory: CVE-2015-3227\nCriticality: Unknown\nURL: https://groups.google.com/forum/#!topic/rubyonrails-security/bahr2JLnxvk\nTitle: Possible Denial of Service attack in Active Support\nSolution: upgrade to >= 4.2.2, ~> 4.1.11, ~> 3.2.22\n\nName: activesupport\nVersion: 4.1.9\nAdvisory: CVE-2015-3226\nCriticality: Unknown\nURL: https://groups.google.com/forum/#!topic/ruby-security-ann/7VlB_pck3hU\nTitle: XSS Vulnerability in ActiveSupport::JSON.encode\nSolution: upgrade to >= 4.2.2, ~> 4.1.11","distinct":true,"url":"https://api.github.com/repos/openfarmcc/OpenFarm/commits/9249a79239405ad0082b61ac2527eba16c3943d5"},{"sha":"bf4b636fdac4bd30473b196c146fb393cd373494","author":{"name":"Daniel O'Connor","email":"4723576065a1e3329d34722e1c36bd80382cbec6@gmail.com"},"message":"Name: uglifier\nVersion: 2.7.0\nAdvisory: 126747\nCriticality: Unknown\nURL: https://github.com/mishoo/UglifyJS2/issues/751\nTitle: uglifier incorrectly handles non-boolean comparisons during minification\nSolution: upgrade to >= 2.7.2","distinct":true,"url":"https://api.github.com/repos/openfarmcc/OpenFarm/commits/bf4b636fdac4bd30473b196c146fb393cd373494"},{"sha":"fc18c2ca394df8ba67bf735a32f12a16983e59d3","author":{"name":"Daniel O'Connor","email":"4723576065a1e3329d34722e1c36bd80382cbec6@gmail.com"},"message":"Name: jquery-rails\nVersion: 3.1.2\nAdvisory: CVE-2015-1840\nCriticality: Medium\nURL: https://groups.google.com/forum/#!topic/ruby-security-ann/XIZPbobuwaY\nTitle: CSRF Vulnerability in jquery-rails\nSolution: upgrade to >= 4.0.4, ~> 3.1.3","distinct":true,"url":"https://api.github.com/repos/openfarmcc/OpenFarm/commits/fc18c2ca394df8ba67bf735a32f12a16983e59d3"},{"sha":"80b8d5940527df830ca824399b8c6f262ff87992","author":{"name":"Daniel O'Connor","email":"4723576065a1e3329d34722e1c36bd80382cbec6@gmail.com"},"message":"Name: devise\nVersion: 3.4.1\nAdvisory: CVE-2015-8314\nCriticality: Unknown\nURL: http://blog.plataformatec.com.br/2016/01/improve-remember-me-cookie-expiration-in-devise/\nTitle: Devise Gem for Ruby Unauthorized Access Using Remember Me Cookie\nSolution: upgrade to >= 3.5.4","distinct":true,"url":"https://api.github.com/repos/openfarmcc/OpenFarm/commits/80b8d5940527df830ca824399b8c6f262ff87992"},{"sha":"07cb0192a221d46c111ce7385e58c5e68884bef9","author":{"name":"Daniel O'Connor","email":"4723576065a1e3329d34722e1c36bd80382cbec6@gmail.com"},"message":"Downgrade devise to a secure version with fewer BC breaks","distinct":true,"url":"https://api.github.com/repos/openfarmcc/OpenFarm/commits/07cb0192a221d46c111ce7385e58c5e68884bef9"},{"sha":"e48f468c4ab59f56de5f4a0bc4fa75a2bfe63564","author":{"name":"Daniel O'Connor","email":"4723576065a1e3329d34722e1c36bd80382cbec6@gmail.com"},"message":"Devise 3.4.2: confirm! has been deprecated in favor of confirm.","distinct":true,"url":"https://api.github.com/repos/openfarmcc/OpenFarm/commits/e48f468c4ab59f56de5f4a0bc4fa75a2bfe63564"},{"sha":"8f7e3f7fa8f1898e59cbd1fcb50d29a4b49a02b5","author":{"name":"Daniel O'Connor","email":"4723576065a1e3329d34722e1c36bd80382cbec6@gmail.com"},"message":"[DEPRECATION] 'Rack::Attack.whitelist' is deprecated.  Please use 'safelist' instead.","distinct":true,"url":"https://api.github.com/repos/openfarmcc/OpenFarm/commits/8f7e3f7fa8f1898e59cbd1fcb50d29a4b49a02b5"},{"sha":"27b0805d1d755c8dcf5863ccc78f5f1eb90169c1","author":{"name":"Daniel O'Connor","email":"4723576065a1e3329d34722e1c36bd80382cbec6@gmail.com"},"message":"Upgrade to fix https://github.com/rspec/rspec-rails/issues/1532","distinct":true,"url":"https://api.github.com/repos/openfarmcc/OpenFarm/commits/27b0805d1d755c8dcf5863ccc78f5f1eb90169c1"},{"sha":"6283109676c88370245e242349b85d0c5fa48c55","author":{"name":"Daniel O'Connor","email":"4723576065a1e3329d34722e1c36bd80382cbec6@gmail.com"},"message":"WARNING: Using the `raise_error` matcher without providing a specific error or message risks false positives, since `raise_error` will match when Ruby raises a `NoMethodError`, `NameError` or `ArgumentError`, potentially allowing the expectation to pass without even executing the method you are intending to call. Actual error raised was #<OpenfarmErrors::NotAuthorized>","distinct":true,"url":"https://api.github.com/repos/openfarmcc/OpenFarm/commits/6283109676c88370245e242349b85d0c5fa48c55"},{"sha":"12280f3b863fd629ec038c809d43ce8dae04ff02","author":{"name":"Simon","email":"d7eee9f73ba985eece5e68629a954c4fa854c974@users.noreply.github.com"},"message":"Merge pull request #801 from CloCkWeRX/upgrade_gems\n\nUpgrade gems for security fixes","distinct":true,"url":"https://api.github.com/repos/openfarmcc/OpenFarm/commits/12280f3b863fd629ec038c809d43ce8dae04ff02"}]}
{"actor":{"display_login":"simonv3"}}