{"action":"created","issue":{"url":"https://api.github.com/repos/phusion/traveling-ruby/issues/60","labels_url":"https://api.github.com/repos/phusion/traveling-ruby/issues/60/labels{/name}","comments_url":"https://api.github.com/repos/phusion/traveling-ruby/issues/60/comments","events_url":"https://api.github.com/repos/phusion/traveling-ruby/issues/60/events","html_url":"https://github.com/phusion/traveling-ruby/issues/60","id":119243138,"number":60,"title":"Security vulnerability in Ruby 2.2.2 and Nokogiri <1.6.6.4. Bump and rebuild needed.","user":{"login":"Nowaker","id":611746,"avatar_url":"https://avatars.githubusercontent.com/u/611746?v=3","gravatar_id":"","url":"https://api.github.com/users/Nowaker","html_url":"https://github.com/Nowaker","followers_url":"https://api.github.com/users/Nowaker/followers","following_url":"https://api.github.com/users/Nowaker/following{/other_user}","gists_url":"https://api.github.com/users/Nowaker/gists{/gist_id}","starred_url":"https://api.github.com/users/Nowaker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Nowaker/subscriptions","organizations_url":"https://api.github.com/users/Nowaker/orgs","repos_url":"https://api.github.com/users/Nowaker/repos","events_url":"https://api.github.com/users/Nowaker/events{/privacy}","received_events_url":"https://api.github.com/users/Nowaker/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"milestone":null,"comments":10,"created_at":"2015-11-27T20:21:03Z","updated_at":"2016-01-12T18:59:11Z","closed_at":null,"body":"There's a security vulnerability in the latest Traveling Ruby. http://traveling-ruby.s3-us-west-2.amazonaws.com/list.html doesn't list any version with Ruby 2.2.3 and Nokogiri 1.6.6.4.\r\n\r\n## MULTIPLE VULNERABILITIES IN LIBXML2, LIBXSLT\r\nThe vendored libxml2 and libxslt libraries have multiple vulnerabilities: CVE-2015-1819 CVE-2015-7941_1 CVE-2015-7941_2 CVE-2015-7942 CVE-2015-7942-2 CVE-2015-8035 CVE-2015-7995\r\n\r\nAffected versions: All versions prior to 1.6.6.3\r\nFixed versions: 1.6.6.3, 1.6.7.rc4\r\nSolution: Upgrade to latest version.\r\nSources: https://groups.google.com/forum/#!topic/nokogiri-talk/gEpHWo2xLCE \r\nhttps://github.com/sparklemotion/nokogiri/blob/v1.6.6.x/CHANGELOG.rdoc#1663--2015-11-16 \r\nhttps://github.com/sparklemotion/nokogiri/commit/ac6106f1e641d50b27752c52b355e01d03ae8829 \r\nhttps://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.rdoc#167rc4--2015-11-22 \r\nhttps://github.com/sparklemotion/nokogiri/commit/ee52b7be5b47e1029af98f6b7eb6df7fc5ffd359 \r\n\r\n## UNSAFE PARSING OF UNCLOSED COMMENTS\r\nParsing an unclosed comment can result in Conditional jump or move depends on uninitialised value(s) and unsafe memory access.\r\n\r\nAffected versions: All versions prior to 1.6.6.4\r\nFixed versions: 1.6.6.4, 1.6.7.rc4\r\nSolution: Upgrade to latest version.\r\nCredit: Florian Weingarten, Francois Chagnon\r\nSources: https://groups.google.com/forum/#!topic/nokogiri-talk/nFl0mfcJpbk \r\nhttps://github.com/sparklemotion/nokogiri/blob/v1.6.6.x/CHANGELOG.rdoc#1664--2015-11-19 \r\nhttps://github.com/sparklemotion/nokogiri/commit/3ab1b2339f7bb3a00590c8d288a24a9dbfe5aec4 \r\nhttps://github.com/sparklemotion/nokogiri/blob/master/CHANGELOG.rdoc#167rc4--2015-11-22 \r\nhttps://github.com/sparklemotion/nokogiri/commit/0948e9fa38c949661983a33752fdcb94a453e272 \r\n\r\n## Ruby 2.2.3 Released\r\n\r\nWe are pleased to announce the release of Ruby 2.2.3. This is a TEENY version release of the stable 2.2 series.\r\n\r\nThis release includes the security fix for a RubyGems domain name verification vulnerability.\r\n\r\n- [CVE-2015-3900 Request hijacking vulnerability in RubyGems 2.4.6 and earlier](http://blog.rubygems.org/2015/05/14/CVE-2015-3900.html)\r\n\r\nThere are also some bugfixes. See ChangeLog for details."},"comment":{"url":"https://api.github.com/repos/phusion/traveling-ruby/issues/comments/171015847","html_url":"https://github.com/phusion/traveling-ruby/issues/60#issuecomment-171015847","issue_url":"https://api.github.com/repos/phusion/traveling-ruby/issues/60","id":171015847,"user":{"login":"kwartel","id":3989063,"avatar_url":"https://avatars.githubusercontent.com/u/3989063?v=3","gravatar_id":"","url":"https://api.github.com/users/kwartel","html_url":"https://github.com/kwartel","followers_url":"https://api.github.com/users/kwartel/followers","following_url":"https://api.github.com/users/kwartel/following{/other_user}","gists_url":"https://api.github.com/users/kwartel/gists{/gist_id}","starred_url":"https://api.github.com/users/kwartel/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kwartel/subscriptions","organizations_url":"https://api.github.com/users/kwartel/orgs","repos_url":"https://api.github.com/users/kwartel/repos","events_url":"https://api.github.com/users/kwartel/events{/privacy}","received_events_url":"https://api.github.com/users/kwartel/received_events","type":"User","site_admin":false},"created_at":"2016-01-12T18:59:11Z","updated_at":"2016-01-12T18:59:11Z","body":"I haven't tested it properly and I actually want to make a pull request which can be added right away. Like I said, I can provide you binaries right away.\r\n\r\nYou can also build them yourself using my branch, since you actually just need to install docker on a linux machine, clone the repo, cd into the linux folder and run `rake`, wait 15 minutes and you have your binaries."}}