update changelog

tenderlove · tenderlove · commit 0ad524ab6e35 · 2020-05-15T16:35:58.000-07:00
diff --git a/actionpack/CHANGELOG.md b/actionpack/CHANGELOG.md
@@ -1,3 +1,7 @@
+*   [CVE-2020-8166] HMAC raw CSRF token before masking it, so it cannot be used to reconstruct a per-form token
+
+*   [CVE-2020-8164] Return self when calling #each, #each_pair, and #each_value instead of the raw @parameters hash
+
 ## Rails 6.0.3 (May 06, 2020) ##
 
 *   Include child session assertion count in ActionDispatch::IntegrationTest
diff --git a/actionview/CHANGELOG.md b/actionview/CHANGELOG.md
@@ -1,3 +1,5 @@
+*   [CVE-2020-8167] Check that request is same-origin prior to including CSRF token in XHRs
+
 ## Rails 6.0.3 (May 06, 2020) ##
 
 *   annotated_source_code returns an empty array so TemplateErrors without a
diff --git a/activestorage/CHANGELOG.md b/activestorage/CHANGELOG.md
@@ -1,3 +1,5 @@
+*   [CVE-2020-8162] Include Content-Length in signature for ActiveStorage direct upload
+
 ## Rails 6.0.3 (May 06, 2020) ##
 
 *   No changes.
diff --git a/activesupport/CHANGELOG.md b/activesupport/CHANGELOG.md
@@ -1,3 +1,7 @@
+*   [CVE-2020-8165] Deprecate Marshal.load on raw cache read in RedisCacheStore
+
+*   [CVE-2020-8165] Avoid Marshal.load on raw cache value in MemCacheStore
+
 ## Rails 6.0.3 (May 06, 2020) ##
 
 *   `Array#to_sentence` no longer returns a frozen string.

Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,5 @@`
	`1`	`+* [CVE-2020-8167] Check that request is same-origin prior to including CSRF token in XHRs`
	`2`	`+`
`1`	`3`	`## Rails 6.0.3 (May 06, 2020) ##`
`2`	`4`
`3`	`5`	`* annotated_source_code returns an empty array so TemplateErrors without a`
Original file line number	Diff line number	Diff line change
`@@ -1,3 +1,5 @@`
	`1`	`+* [CVE-2020-8162] Include Content-Length in signature for ActiveStorage direct upload`
	`2`	`+`
`1`	`3`	`## Rails 6.0.3 (May 06, 2020) ##`
`2`	`4`
`3`	`5`	`* No changes.`