Require nokogiri ~> 1.8.2 due to vulnerability in libxml2 #96
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
vvassiliouk
force-pushed
the
airbnb/vvassiliouk/require-nokogiri-1.8.2
branch
3 times, most recently
from
4a16697 to
a8837fe
Compare
ljharb
approved these changes
Jul 10, 2018
CHANGELOG.md
Outdated
| @@ -1,3 +1,6 @@ | |||
| # 0.11.12 | |||
There was a problem hiding this comment.
typically version numbers aren't bumped in PRs; but rather on a commit directly to master. nbd tho
vvassiliouk
force-pushed
the
airbnb/vvassiliouk/require-nokogiri-1.8.2
branch
from
a8837fe to
ab3723e
Compare
noggi
approved these changes
Jul 12, 2018
darnaut
approved these changes
Jul 12, 2018
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
The version of libxml2 packaged with Nokogiri contains a vulnerability. Nokogiri has mitigated these issue by upgrading to libxml 2.9.6 in version 1.8.2
It was discovered that libxml2 incorrecty handled certain files. An attacker could use this issue with specially constructed XML data to cause libxml2 to consume resources, leading to a denial of service.
More info from Nokogiri repo: sparklemotion/nokogiri#1714
We're also requiring ruby version >= 2.1 due to nokogiri