Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[Security] Bump ffi from 1.1.5 to 1.9.24 #21

Open
wants to merge 1 commit into
base: master
Choose a base branch
from

Conversation

dependabot-preview[bot]
Copy link

Bumps ffi from 1.1.5 to 1.9.24. This update includes a security fix.

Vulnerabilities fixed

Sourced from The Ruby Advisory Database.

ruby-ffi DDL loading issue on Windows OS ruby-ffi version 1.9.23 and earlier has a DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String This vulnerability appears to have been fixed in v1.9.24 and later.

Patched versions: >= 1.9.24 Unaffected versions: none

Changelog

Sourced from ffi's changelog.

1.9.24 / 2018-06-02

Security Note:

This update addresses vulnerability CVE-2018-1000201: DLL loading issue which can be hijacked on Windows OS, when a Symbol is used as DLL name instead of a String. Found by Matthew Bush.

Added:

  • Added a CHANGELOG file
  • Add mips64(eb) support, and mips r6 support. (#601)

Changed:

  • Update libffi to latest changes on master.
  • Don't search in hardcoded /usr paths on Windows.
  • Don't treat Symbol args different to Strings in ffi_lib.
  • Make sure size_t is defined in Thread.c. Fixes #609

1.9.23 / 2018-02-25

Changed:

  • Fix unnecessary rebuild of configure in darwin multi arch. Fixes #605

1.9.22 / 2018-02-22

Changed:

  • Update libffi to latest changes on master.
  • Update detection of system libffi to match new requirements. Fixes #617
  • Prefer bundled libffi over system libffi on Mac OS.
  • Do closures via libffi. This removes ClosurePool and fixes compat with PaX. #540
  • Use a more deterministic gem packaging.
  • Fix unnecessary update of autoconf files at gem install.

1.9.21 / 2018-02-06

Added:

  • Ruby-2.5 support by Windows binary gems. Fixes #598
  • Add missing win64 types.
  • Added support for Bitmask. (#573)
  • Add support for MSYS2 (#572) and Sparc64 Linux. (#574)

Changed:

  • Fix read_string to not throw an error on length 0.
  • Don't use absolute paths for sh and env. Fixes usage on Adroid #528
  • Use Ruby implementation for which for better compat with Windows. Fixes #315
Commits
  • 4e1051a Run rspec with dots output only
  • e70b13d Fix integer parameter range specs
  • 55ae232 Fix several specs where raise_error was called without class
  • 8821d4f Specify error class for several raise_error calls
  • bf48d44 Fix missing C declarations causing compiler warnings
  • f569788 Replace symlinks for mips r6 with plain files
  • fedbae0 Update CHANGELOG
  • a4d4d19 Merge branch 'master' of github.com:ffi/ffi
  • 45d8803 Add a CHANGELOG file
  • 2ff1d8f Bump VERSION to 1.9.24
  • Additional commits viewable in compare view

Dependabot compatibility score

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.


Note: This repo was added to Dependabot recently, so you'll receive a maximum of 5 PRs for your first few update runs. Once an update run creates fewer than 5 PRs we'll remove that limit.

You can always request more updates by clicking Bump now in your Dependabot dashboard.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

  • @dependabot rebase will rebase this PR
  • @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
  • @dependabot merge will merge this PR after your CI passes on it
  • @dependabot squash and merge will squash and merge this PR after your CI passes on it
  • @dependabot cancel merge will cancel a previously requested merge and block automerging
  • @dependabot reopen will reopen this PR if it is closed
  • @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
  • @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
  • @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
  • @dependabot use these labels will set the current labels as the default for future PRs for this repo and language
  • @dependabot use these reviewers will set the current reviewers as the default for future PRs for this repo and language
  • @dependabot use these assignees will set the current assignees as the default for future PRs for this repo and language
  • @dependabot use this milestone will set the current milestone as the default for future PRs for this repo and language
  • @dependabot badge me will comment on this PR with code to add a "Dependabot enabled" badge to your readme

Additionally, you can set the following in your Dependabot dashboard:

  • Update frequency (including time of day and day of week)
  • Pull request limits (per update run and/or open at any time)
  • Out-of-range updates (receive only lockfile updates, if desired)
  • Security updates (receive only security updates, if desired)

Bumps [ffi](https://github.com/ffi/ffi) from 1.1.5 to 1.9.24. **This update includes a security fix.**
- [Release notes](https://github.com/ffi/ffi/releases)
- [Changelog](https://github.com/ffi/ffi/blob/master/CHANGELOG.md)
- [Commits](ffi/ffi@1.1.5...1.9.24)

Signed-off-by: dependabot-preview[bot] <[email protected]>
@dependabot-preview dependabot-preview bot added dependencies Pull requests that update a dependency file security Pull requests that address a security vulnerability labels Nov 18, 2020
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
dependencies Pull requests that update a dependency file security Pull requests that address a security vulnerability
Projects
None yet
Development

Successfully merging this pull request may close these issues.

0 participants