#712 (https://trello.com/c/CbleNB3C/712-qae18-security-timing-attack…

…-affecting-rack-protection-gem) - Upgrade `rack-protection` gem version to fix timing attack vulnerability issue.
bitzesty · Aug 7, 2018 · d612be2 · d612be2
1 parent 4adce2e
commit d612be2
Show file tree

Hide file tree

Showing 2 changed files with 3 additions and 1 deletion.
diff --git a/Gemfile b/Gemfile
@@ -87,6 +87,7 @@ gem 'vigilion-rails', '~> 1.0.5'
 gem "sidekiq", "~> 4.1.1"
 gem "sidekiq-cron", "~> 0.4.2"
 gem 'sinatra', require: nil
+gem "rack-protection", "1.5.5" # Sinatra's dependency
 
 # Redis
 gem 'redis-rails'

diff --git a/Gemfile.lock b/Gemfile.lock
@@ -684,6 +684,7 @@ DEPENDENCIES
   pusher
   quiet_assets
   rack-mini-profiler (>= 0.10.1)
+  rack-protection (= 1.5.5)
   rack-ssl-enforcer
   rails (= 4.2.10)
   rails-html-sanitizer (~> 1.0.4)
@@ -719,4 +720,4 @@ RUBY VERSION
    ruby 2.5.0p0
 
 BUNDLED WITH
-   1.16.2
+   1.16.3