Fedora 33: 2020-4dd34860a3 Moderate: rubygem-activerecord Fixes

Implements the ActiveRecord pattern (Fowler, PoEAA) for ORM. It ties database

tables and classes together for business objects, like Customer or

Subscription, that can find, save, and destroy themselves without resorting to

manual SQL.

Upgrade to Ruby on Rails 6.0.3.3. Fixes CVEs: #1877568 #1831529 #1852381

* Tue Sep 22 2020 Pavel Valena - 1:6.0.3.3-1

- Update to activerecord 6.0.3.3.

Resolves: rhbz#1877501

[ 1 ] Bug #1831529 - CVE-2020-5267 rubygem-actionview: views that use the `j` or `escape_javascript` methods are susceptible to XSS attacks [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1831529

[ 2 ] Bug #1852381 - CVE-2020-8185 rubygem-rails: untrusted users able to run pending migrations in production [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1852381

[ 3 ] Bug #1877568 - CVE-2020-15169 rubygem-actionview: rubygem-activeview: Cross-site scripting in translation helpers [fedora-all]

https://bugzilla.redhat.com/show_bug.cgi?id=1877568

su -c 'dnf upgrade --advisory FEDORA-2020-4dd34860a3' at the command

line. For more information, refer to the dnf documentation available at

https://dnf.readthedocs.io/en/latest/command_ref.html

All packages are signed with the Fedora Project GPG key. More details on the

GPG keys used by the Fedora Project can be found at

https://fedoraproject.org/security/

package-announce mailing list -- package-announce@lists.fedoraproject.org

To unsubscribe send an email to package-announce-leave@lists.fedoraproject.org

Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/

List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines

List Archives: https://lists.fedoraproject.org/archives/list/package-announce@lists.fedoraproject.org/