{"action":"created","issue":{"url":"https://api.github.com/repos/openSUSE/open-build-service/issues/6384","repository_url":"https://api.github.com/repos/openSUSE/open-build-service","labels_url":"https://api.github.com/repos/openSUSE/open-build-service/issues/6384/labels{/name}","comments_url":"https://api.github.com/repos/openSUSE/open-build-service/issues/6384/comments","events_url":"https://api.github.com/repos/openSUSE/open-build-service/issues/6384/events","html_url":"https://github.com/openSUSE/open-build-service/pull/6384","id":385182545,"node_id":"MDExOlB1bGxSZXF1ZXN0MjM0MjA5MzU1","number":6384,"title":"🚨 [security] [src/api] Update rails: 5.2.1 → 5.2.1.1 (minor)","user":{"login":"depfu[bot]","id":23717796,"node_id":"MDM6Qm90MjM3MTc3OTY=","avatar_url":"https://avatars3.githubusercontent.com/in/715?v=4","gravatar_id":"","url":"https://api.github.com/users/depfu%5Bbot%5D","html_url":"https://github.com/apps/depfu","followers_url":"https://api.github.com/users/depfu%5Bbot%5D/followers","following_url":"https://api.github.com/users/depfu%5Bbot%5D/following{/other_user}","gists_url":"https://api.github.com/users/depfu%5Bbot%5D/gists{/gist_id}","starred_url":"https://api.github.com/users/depfu%5Bbot%5D/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/depfu%5Bbot%5D/subscriptions","organizations_url":"https://api.github.com/users/depfu%5Bbot%5D/orgs","repos_url":"https://api.github.com/users/depfu%5Bbot%5D/repos","events_url":"https://api.github.com/users/depfu%5Bbot%5D/events{/privacy}","received_events_url":"https://api.github.com/users/depfu%5Bbot%5D/received_events","type":"Bot","site_admin":false},"labels":[{"id":867348466,"node_id":"MDU6TGFiZWw4NjczNDg0NjY=","url":"https://api.github.com/repos/openSUSE/open-build-service/labels/depfu","name":"depfu","color":"0000ff","default":false}],"state":"closed","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":3,"created_at":"2018-11-28T09:46:35Z","updated_at":"2018-11-28T09:59:21Z","closed_at":"2018-11-28T09:58:39Z","author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/openSUSE/open-build-service/pulls/6384","html_url":"https://github.com/openSUSE/open-build-service/pull/6384","diff_url":"https://github.com/openSUSE/open-build-service/pull/6384.diff","patch_url":"https://github.com/openSUSE/open-build-service/pull/6384.patch"},"body":"\n\n\n<hr>\n\n🚨 <b>Your version of rails has known security vulnerabilities</b> 🚨\n\nAdvisory: CVE-2018-16476\nDisclosed: November 27, 2018\nURL: [https://groups.google.com/forum/#!topic/rubyonrails-security/FL4dSdzr2zw](https://groups.google.com/forum/#!topic/rubyonrails-security/FL4dSdzr2zw)\n\n<details>\n<summary>ActiveJob/ActiveStorage vulnerabilities</summary>\n<blockquote>\n  <p>There is a vulnerability in Active Job. This vulnerability has been<br>\nassigned the CVE identifier CVE-2018-16476.</p>\n<p>Versions Affected: &gt;= 4.2.0<br>\nNot affected: &lt; 4.2.0<br>\nFixed Versions: 4.2.11, 5.0.7.1, 5.1.6.1, 5.2.1.1</p>\n<h2>Impact</h2>\n<p>Carefully crafted user input can cause Active Job to deserialize it using GlobalId<br>\nand allow an attacker to have access to information that they should not have.</p>\n<p>Vulnerable code will look something like this:</p>\n<pre><code>MyJob.perform_later(user_input)\n</code></pre>\n<p>All users running an affected release should either upgrade or use one of the<br>\nworkarounds immediately.</p>\n<hr>\n<p>There is a vulnerability in Active Storage. This vulnerability has been<br>\nassigned the CVE identifier CVE-2018-16477.</p>\n<p>Versions Affected:  &gt;= 5.2.0<br>\nNot affected:       &lt; 5.2.0<br>\nFixed Versions:     5.2.1.1</p>\n<h2>Impact</h2>\n<p>Signed download URLs generated by <code>ActiveStorage</code> for Google Cloud Storage<br>\nservice and Disk service include <code>content-disposition</code> and <code>content-type</code><br>\nparameters that an attacker can modify. This can be used to upload specially<br>\ncrafted HTML files and have them served and executed inline. Combined with<br>\nother techniques such as cookie bombing and specially crafted AppCache manifests,<br>\nan attacker can gain access to private signed URLs within a specific storage path.</p>\n<p>Vulnerable apps are those using either GCS or the Disk service in production.<br>\nOther storage services such as S3 or Azure aren't affected.</p>\n<p>All users running an affected release should either upgrade or use one of the<br>\nworkarounds immediately. For those using GCS, it's also recommended to run the<br>\nfollowing to update existing blobs:</p>\n<pre><code>ActiveStorage::Blob.find_each do |blob|\n  blob.send :update_service_metadata\nend\n</code></pre>\n</blockquote>\n</details>\n<br>\n🚨 <b>We recommend to merge and deploy this update as soon as possible!</b> 🚨\n<hr>\n\n\nHere is everything you need to know about this update. Please take a good look at what changed and the test results before merging this pull request.\n\n### What changed?\n\n\n#### ✳️ rails (5.2.1 → 5.2.1.1) · [Repo](http://github.com/rails/rails)\n\n\n<details>\n<summary>Commits</summary>\n<p><a href=\"https://github.com/rails/rails/compare/fc5dd0b85189811062c85520fd70de8389b55aeb...96dee0e7e5a8dd6ce42999b13d0bd0623073e229\">See the full diff on Github</a>. The new version differs by 2 commits:</p>\n\n<ul>\n<li><a href=\"https://github.com/rails/rails/commit/96dee0e7e5a8dd6ce42999b13d0bd0623073e229\"><code>Preparing for 5.2.1.1 release</code></a></li>\n<li><a href=\"https://github.com/rails/rails/commit/970b0d754be7c71a760d9b807eea32297fd838e3\"><code>Do not deserialize GlobalID objects that were not generated by Active Job</code></a></li>\n</ul>\n</details>\n\n\n\n#### ↗️ actioncable (_indirect_, 5.2.1 → 5.2.1.1) · [Repo](https://github.com/rails/rails) · [Changelog](https://github.com/rails/rails/blob/v5.2.1.1/actioncable/CHANGELOG.md)\n\n\n<details>\n<summary>Commits</summary>\n<p><a href=\"https://github.com/rails/rails/compare/fc5dd0b85189811062c85520fd70de8389b55aeb...96dee0e7e5a8dd6ce42999b13d0bd0623073e229\">See the full diff on Github</a>. The new version differs by 2 commits:</p>\n\n<ul>\n<li><a href=\"https://github.com/rails/rails/commit/96dee0e7e5a8dd6ce42999b13d0bd0623073e229\"><code>Preparing for 5.2.1.1 release</code></a></li>\n<li><a href=\"https://github.com/rails/rails/commit/970b0d754be7c71a760d9b807eea32297fd838e3\"><code>Do not deserialize GlobalID objects that were not generated by Active Job</code></a></li>\n</ul>\n</details>\n\n\n\n#### ↗️ actionmailer (_indirect_, 5.2.1 → 5.2.1.1) · [Repo](https://github.com/rails/rails) · [Changelog](https://github.com/rails/rails/blob/v5.2.1.1/actionmailer/CHANGELOG.md)\n\n\n<details>\n<summary>Commits</summary>\n<p><a href=\"https://github.com/rails/rails/compare/fc5dd0b85189811062c85520fd70de8389b55aeb...96dee0e7e5a8dd6ce42999b13d0bd0623073e229\">See the full diff on Github</a>. The new version differs by 2 commits:</p>\n\n<ul>\n<li><a href=\"https://github.com/rails/rails/commit/96dee0e7e5a8dd6ce42999b13d0bd0623073e229\"><code>Preparing for 5.2.1.1 release</code></a></li>\n<li><a href=\"https://github.com/rails/rails/commit/970b0d754be7c71a760d9b807eea32297fd838e3\"><code>Do not deserialize GlobalID objects that were not generated by Active Job</code></a></li>\n</ul>\n</details>\n\n\n\n#### ↗️ actionpack (_indirect_, 5.2.1 → 5.2.1.1) · [Repo](https://github.com/rails/rails) · [Changelog](https://github.com/rails/rails/blob/v5.2.1.1/actionpack/CHANGELOG.md)\n\n\n<details>\n<summary>Commits</summary>\n<p><a href=\"https://github.com/rails/rails/compare/fc5dd0b85189811062c85520fd70de8389b55aeb...96dee0e7e5a8dd6ce42999b13d0bd0623073e229\">See the full diff on Github</a>. The new version differs by 2 commits:</p>\n\n<ul>\n<li><a href=\"https://github.com/rails/rails/commit/96dee0e7e5a8dd6ce42999b13d0bd0623073e229\"><code>Preparing for 5.2.1.1 release</code></a></li>\n<li><a href=\"https://github.com/rails/rails/commit/970b0d754be7c71a760d9b807eea32297fd838e3\"><code>Do not deserialize GlobalID objects that were not generated by Active Job</code></a></li>\n</ul>\n</details>\n\n\n\n#### ↗️ actionview (_indirect_, 5.2.1 → 5.2.1.1) · [Repo](https://github.com/rails/rails) · [Changelog](https://github.com/rails/rails/blob/v5.2.1.1/actionview/CHANGELOG.md)\n\n\n<details>\n<summary>Commits</summary>\n<p><a href=\"https://github.com/rails/rails/compare/fc5dd0b85189811062c85520fd70de8389b55aeb...96dee0e7e5a8dd6ce42999b13d0bd0623073e229\">See the full diff on Github</a>. The new version differs by 2 commits:</p>\n\n<ul>\n<li><a href=\"https://github.com/rails/rails/commit/96dee0e7e5a8dd6ce42999b13d0bd0623073e229\"><code>Preparing for 5.2.1.1 release</code></a></li>\n<li><a href=\"https://github.com/rails/rails/commit/970b0d754be7c71a760d9b807eea32297fd838e3\"><code>Do not deserialize GlobalID objects that were not generated by Active Job</code></a></li>\n</ul>\n</details>\n\n\n\n#### ↗️ activejob (_indirect_, 5.2.1 → 5.2.1.1) · [Repo](https://github.com/rails/rails) · [Changelog](https://github.com/rails/rails/blob/v5.2.1.1/activejob/CHANGELOG.md)\n\n\n<details>\n<summary>Commits</summary>\n<p><a href=\"https://github.com/rails/rails/compare/fc5dd0b85189811062c85520fd70de8389b55aeb...96dee0e7e5a8dd6ce42999b13d0bd0623073e229\">See the full diff on Github</a>. The new version differs by 2 commits:</p>\n\n<ul>\n<li><a href=\"https://github.com/rails/rails/commit/96dee0e7e5a8dd6ce42999b13d0bd0623073e229\"><code>Preparing for 5.2.1.1 release</code></a></li>\n<li><a href=\"https://github.com/rails/rails/commit/970b0d754be7c71a760d9b807eea32297fd838e3\"><code>Do not deserialize GlobalID objects that were not generated by Active Job</code></a></li>\n</ul>\n</details>\n\n\n\n#### ↗️ activemodel (_indirect_, 5.2.1 → 5.2.1.1) · [Repo](https://github.com/rails/rails) · [Changelog](https://github.com/rails/rails/blob/v5.2.1.1/activemodel/CHANGELOG.md)\n\n\n<details>\n<summary>Commits</summary>\n<p><a href=\"https://github.com/rails/rails/compare/fc5dd0b85189811062c85520fd70de8389b55aeb...96dee0e7e5a8dd6ce42999b13d0bd0623073e229\">See the full diff on Github</a>. The new version differs by 2 commits:</p>\n\n<ul>\n<li><a href=\"https://github.com/rails/rails/commit/96dee0e7e5a8dd6ce42999b13d0bd0623073e229\"><code>Preparing for 5.2.1.1 release</code></a></li>\n<li><a href=\"https://github.com/rails/rails/commit/970b0d754be7c71a760d9b807eea32297fd838e3\"><code>Do not deserialize GlobalID objects that were not generated by Active Job</code></a></li>\n</ul>\n</details>\n\n\n\n#### ↗️ activerecord (_indirect_, 5.2.1 → 5.2.1.1) · [Repo](https://github.com/rails/rails) · [Changelog](https://github.com/rails/rails/blob/v5.2.1.1/activerecord/CHANGELOG.md)\n\n\n<details>\n<summary>Commits</summary>\n<p><a href=\"https://github.com/rails/rails/compare/fc5dd0b85189811062c85520fd70de8389b55aeb...96dee0e7e5a8dd6ce42999b13d0bd0623073e229\">See the full diff on Github</a>. The new version differs by 2 commits:</p>\n\n<ul>\n<li><a href=\"https://github.com/rails/rails/commit/96dee0e7e5a8dd6ce42999b13d0bd0623073e229\"><code>Preparing for 5.2.1.1 release</code></a></li>\n<li><a href=\"https://github.com/rails/rails/commit/970b0d754be7c71a760d9b807eea32297fd838e3\"><code>Do not deserialize GlobalID objects that were not generated by Active Job</code></a></li>\n</ul>\n</details>\n\n\n\n#### ↗️ activestorage (_indirect_, 5.2.1 → 5.2.1.1) · [Repo](https://github.com/rails/activestorage)\n\n\n\nSorry, we couldn't find anything useful about this release.\n\n\n#### ↗️ activesupport (_indirect_, 5.2.1 → 5.2.1.1) · [Repo](https://github.com/rails/rails) · [Changelog](https://github.com/rails/rails/blob/v5.2.1.1/activesupport/CHANGELOG.md)\n\n\n<details>\n<summary>Commits</summary>\n<p><a href=\"https://github.com/rails/rails/compare/fc5dd0b85189811062c85520fd70de8389b55aeb...96dee0e7e5a8dd6ce42999b13d0bd0623073e229\">See the full diff on Github</a>. The new version differs by 2 commits:</p>\n\n<ul>\n<li><a href=\"https://github.com/rails/rails/commit/96dee0e7e5a8dd6ce42999b13d0bd0623073e229\"><code>Preparing for 5.2.1.1 release</code></a></li>\n<li><a href=\"https://github.com/rails/rails/commit/970b0d754be7c71a760d9b807eea32297fd838e3\"><code>Do not deserialize GlobalID objects that were not generated by Active Job</code></a></li>\n</ul>\n</details>\n\n\n\n#### ↗️ railties (_indirect_, 5.2.1 → 5.2.1.1) · [Repo](https://github.com/rails/rails) · [Changelog](https://github.com/rails/rails/blob/v5.2.1.1/railties/CHANGELOG.md)\n\n\n<details>\n<summary>Commits</summary>\n<p><a href=\"https://github.com/rails/rails/compare/fc5dd0b85189811062c85520fd70de8389b55aeb...96dee0e7e5a8dd6ce42999b13d0bd0623073e229\">See the full diff on Github</a>. The new version differs by 2 commits:</p>\n\n<ul>\n<li><a href=\"https://github.com/rails/rails/commit/96dee0e7e5a8dd6ce42999b13d0bd0623073e229\"><code>Preparing for 5.2.1.1 release</code></a></li>\n<li><a href=\"https://github.com/rails/rails/commit/970b0d754be7c71a760d9b807eea32297fd838e3\"><code>Do not deserialize GlobalID objects that were not generated by Active Job</code></a></li>\n</ul>\n</details>\n\n\n\n\n---\n![Depfu Status](https://depfu.com/badges/3c5817c5855d9da3eabf1b71d64c46c1/stats.svg)\n\n[Depfu](https://depfu.com) will automatically keep this PR conflict-free, as long as you don't add any commits to this branch yourself. You can also trigger a rebase manually by commenting with `@depfu rebase`.\n\n<details><summary>All Depfu comment commands</summary>\n<blockquote><dl>\n<dt>@​depfu rebase</dt><dd>Rebases against your default branch and redoes this update</dd>\n<dt>@​depfu merge</dt><dd>Merges this PR once your tests are passing and conflicts are resolved</dd>\n<dt>@​depfu reopen</dt><dd>Restores the branch and reopens this PR (if it's closed)</dd>\n<dt>@​depfu pause</dt><dd>Ignores all future updates for this dependency and closes this PR</dd>\n<dt>@​depfu pause [minor|major]</dt><dd>Ignores all future minor/major updates for this dependency and closes this PR</dd>\n<dt>@​depfu resume</dt><dd>Future versions of this dependency will create PRs again (leaves this PR as is)</dd>\n</dl></blockquote>\n</details>\n\n"},"comment":{"url":"https://api.github.com/repos/openSUSE/open-build-service/issues/comments/442388768","html_url":"https://github.com/openSUSE/open-build-service/pull/6384#issuecomment-442388768","issue_url":"https://api.github.com/repos/openSUSE/open-build-service/issues/6384","id":442388768,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0MjM4ODc2OA==","user":{"login":"Ana06","id":16052290,"node_id":"MDQ6VXNlcjE2MDUyMjkw","avatar_url":"https://avatars3.githubusercontent.com/u/16052290?v=4","gravatar_id":"","url":"https://api.github.com/users/Ana06","html_url":"https://github.com/Ana06","followers_url":"https://api.github.com/users/Ana06/followers","following_url":"https://api.github.com/users/Ana06/following{/other_user}","gists_url":"https://api.github.com/users/Ana06/gists{/gist_id}","starred_url":"https://api.github.com/users/Ana06/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/Ana06/subscriptions","organizations_url":"https://api.github.com/users/Ana06/orgs","repos_url":"https://api.github.com/users/Ana06/repos","events_url":"https://api.github.com/users/Ana06/events{/privacy}","received_events_url":"https://api.github.com/users/Ana06/received_events","type":"User","site_admin":false},"created_at":"2018-11-28T09:59:21Z","updated_at":"2018-11-28T09:59:21Z","author_association":"MEMBER","body":"And I was also slowlier than @depfu[bot] closing this :unamused: "}}
{"actor":{"display_login":"Ana06"}}