Actions
Bug #16469
closed
Triage github security alerts
Status:
Closed
Priority:
Normal
Assigned To:
Category:
API
Target version:
Story points:
-
Related issues
Updated by Peter Amstutz almost 4 years ago
- Status changed from New to In Progress
Updated by Lucas Di Pentima almost 4 years ago
I believe we don't need to do anything at this time, because:
- CVE-2020-8164 (Possible Strong Parameters Bypass in ActionPack): I haven't found any occurrence of code using
each,each_pairoreach_valueonparams. - CVE-2020-8166 (Ability to forge per-form CSRF tokens in Rails): Is a low severity issue and no workarounds are offered, just to upgrade whenever possible.
- CVE-2020-8165 (Unintended unmarshalling in ActiveSupport): Is about MemCacheStore and RedisCacheStore, which we don't use.
Updated by Peter Amstutz almost 4 years ago
- Related to Bug #16470: Update to Rails 5.2 added
Updated by Lucas Di Pentima almost 4 years ago
- Status changed from In Progress to Closed
We'll be updating rails to at least 5.2 soon.
Actions