GithubHelp home page GithubHelp logo

joshnewton31080 / sample_rails_app Goto Github PK

View Code? Open in Web Editor NEW

This project forked from jetbrains/sample_rails_app

0.0 0.0 0.0 484 KB

The main sample app for the Ruby on Rails Tutorial, 6th Edition

License: Other

Ruby 72.77% JavaScript 3.88% CSS 0.62% HTML 17.31% Dockerfile 0.65% SCSS 4.72% Procfile 0.05%

sample_rails_app's Introduction

Ruby on Rails Tutorial sample application

This is a fork of the Ruby on Rails Tutorial application by Michael Hartl. We created this project to help you try RubyMine features. To get started with the app, follow the step-by-step tutorial or check out our YouTube channel.

Getting started

To get started with the app, first clone the repo and cd into the directory:

$ git clone https://github.com/JetBrains/sample_rails_app.git 
$ cd sample_rails_app

Then install the needed gems (while skipping any gems needed only in production):

$ bundle install --without production

Install JavaScript dependencies:

$ yarn install

Next, migrate the database:

$ rails db:migrate

Finally, run the test suite to verify that everything is working correctly:

$ rails test

If the test suite passes, you'll be ready to run the app in a local server:

$ rails server

Help page

For general help on the Rails Tutorial, see the Rails Tutorial Help page.

License

All source code in the Ruby on Rails Tutorial is available jointly under the MIT License and the Beerware License. See LICENSE.md for details.

sample_rails_app's People

Contributors

mhartl avatar zykovanna avatar joshbnewton31080 avatar andreyaksenov avatar mend-for-github-com[bot] avatar

sample_rails_app's Issues

sass-rails-6.0.0.gem: 17 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - sass-rails-6.0.0.gem

Path to dependency file: /Gemfile.lock

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in Remediation Available
CVE-2022-30123 High 9.8 rack-2.2.3.gem Transitive N/A ❌
WS-2022-0089 High 8.8 nokogiri-1.11.3-x86_64-darwin.gem Transitive N/A ❌
CVE-2022-29181 High 8.2 nokogiri-1.11.3-x86_64-darwin.gem Transitive N/A ❌
CVE-2021-22885 High 7.5 actionpack-6.1.3.1.gem Transitive N/A ❌
CVE-2022-24836 High 7.5 nokogiri-1.11.3-x86_64-darwin.gem Transitive N/A ❌
CVE-2021-22902 High 7.5 actionpack-6.1.3.1.gem Transitive N/A ❌
CVE-2021-41098 High 7.5 nokogiri-1.11.3-x86_64-darwin.gem Transitive N/A ❌
CVE-2021-22904 High 7.5 actionpack-6.1.3.1.gem Transitive N/A ❌
CVE-2022-30122 High 7.5 rack-2.2.3.gem Transitive N/A ❌
CVE-2021-22942 Medium 6.1 actionpack-6.1.3.1.gem Transitive N/A ❌
CVE-2021-22903 Medium 6.1 actionpack-6.1.3.1.gem Transitive N/A ❌
CVE-2022-22577 Medium 6.1 actionpack-6.1.3.1.gem Transitive N/A ❌
CVE-2022-27777 Medium 6.1 actionview-6.1.3.1.gem Transitive N/A ❌
CVE-2021-44528 Medium 6.1 actionpack-6.1.3.1.gem Transitive N/A ❌
CVE-2022-23634 Medium 5.9 actionpack-6.1.3.1.gem Transitive N/A ❌
CVE-2022-23633 Medium 5.9 actionpack-6.1.3.1.gem Transitive N/A ❌
CVE-2022-32209 Medium 5.5 rails-html-sanitizer-1.3.0.gem Transitive N/A ❌

Details

CVE-2022-30123

Vulnerable Library - rack-2.2.3.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.3.gem

Dependency Hierarchy:

  • sass-rails-6.0.0.gem (Root Library)
    • sassc-rails-2.1.2.gem
      • sprockets-4.0.2.gem
        • ❌ rack-2.2.3.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

There is a possible shell escape sequence injection vulnerability in the Lint and CommonLogger components of Rack before 2.0.9.1,2.1.4.1,2.2.3.1

Publish Date: 2022-05-03

URL: CVE-2022-30123

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wq4h-7r42-5hrr

Release Date: 2022-05-03

Fix Resolution: rack - 2.0.9.1,2.1.4.1,2.2.3.1

WS-2022-0089

Vulnerable Library - nokogiri-1.11.3-x86_64-darwin.gem

Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for reading, writing, modifying, and querying documents. It is fast and standards-compliant by relying on native parsers like libxml2 (C) and xerces (Java).

Library home page: https://rubygems.org/gems/nokogiri-1.11.3-x86_64-darwin.gem

Dependency Hierarchy:

  • sass-rails-6.0.0.gem (Root Library)
    • sassc-rails-2.1.2.gem
      • sprockets-rails-3.2.2.gem
        • actionpack-6.1.3.1.gem
          • rails-dom-testing-2.0.3.gem
            • ❌ nokogiri-1.11.3-x86_64-darwin.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Nokogiri before version 1.13.2 is vulnerable.

Publish Date: 2022-03-01

URL: WS-2022-0089

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-fq42-c5rg-92c2

Release Date: 2022-03-01

Fix Resolution: nokogiri - v1.13.2

CVE-2022-29181

Vulnerable Library - nokogiri-1.11.3-x86_64-darwin.gem

Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for reading, writing, modifying, and querying documents. It is fast and standards-compliant by relying on native parsers like libxml2 (C) and xerces (Java).

Library home page: https://rubygems.org/gems/nokogiri-1.11.3-x86_64-darwin.gem

Dependency Hierarchy:

  • sass-rails-6.0.0.gem (Root Library)
    • sassc-rails-2.1.2.gem
      • sprockets-rails-3.2.2.gem
        • actionpack-6.1.3.1.gem
          • rails-dom-testing-2.0.3.gem
            • ❌ nokogiri-1.11.3-x86_64-darwin.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a String by calling #to_s or equivalent.

Publish Date: 2022-05-20

URL: CVE-2022-29181

CVSS 3 Score Details (8.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29181

Release Date: 2022-05-20

Fix Resolution: nokogiri - 1.13.6

CVE-2021-22885

Vulnerable Library - actionpack-6.1.3.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-6.1.3.1.gem

Dependency Hierarchy:

  • sass-rails-6.0.0.gem (Root Library)
    • sassc-rails-2.1.2.gem
      • sprockets-rails-3.2.2.gem
        • ❌ actionpack-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the redirect_to or polymorphic_urlhelper with untrusted user input.

Publish Date: 2021-05-27

URL: CVE-2021-22885

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hjg4-8q5f-x6fm

Release Date: 2021-05-27

Fix Resolution: actionpack - 5.2.4.6,5.2.6,6.0.3.7,6.1.3.2

CVE-2022-24836

Vulnerable Library - nokogiri-1.11.3-x86_64-darwin.gem

Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for reading, writing, modifying, and querying documents. It is fast and standards-compliant by relying on native parsers like libxml2 (C) and xerces (Java).

Library home page: https://rubygems.org/gems/nokogiri-1.11.3-x86_64-darwin.gem

Dependency Hierarchy:

  • sass-rails-6.0.0.gem (Root Library)
    • sassc-rails-2.1.2.gem
      • sprockets-rails-3.2.2.gem
        • actionpack-6.1.3.1.gem
          • rails-dom-testing-2.0.3.gem
            • ❌ nokogiri-1.11.3-x86_64-darwin.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri < v1.13.4 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri >= 1.13.4. There are no known workarounds for this issue.

Publish Date: 2022-04-11

URL: CVE-2022-24836

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-crjr-9rc5-ghw8

Release Date: 2022-04-11

Fix Resolution: nokogiri - 1.13.4

CVE-2021-22902

Vulnerable Library - actionpack-6.1.3.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-6.1.3.1.gem

Dependency Hierarchy:

  • sass-rails-6.0.0.gem (Root Library)
    • sassc-rails-2.1.2.gem
      • sprockets-rails-3.2.2.gem
        • ❌ actionpack-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine.

Publish Date: 2021-06-11

URL: CVE-2021-22902

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-06-11

Fix Resolution: actionpack - 6.0.3.7,6.1.3.2

CVE-2021-41098

Vulnerable Library - nokogiri-1.11.3-x86_64-darwin.gem

Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for reading, writing, modifying, and querying documents. It is fast and standards-compliant by relying on native parsers like libxml2 (C) and xerces (Java).

Library home page: https://rubygems.org/gems/nokogiri-1.11.3-x86_64-darwin.gem

Dependency Hierarchy:

  • sass-rails-6.0.0.gem (Root Library)
    • sassc-rails-2.1.2.gem
      • sprockets-rails-3.2.2.gem
        • actionpack-6.1.3.1.gem
          • rails-dom-testing-2.0.3.gem
            • ❌ nokogiri-1.11.3-x86_64-darwin.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser, Nokogiri::XML::SAX::PushParser, and Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser. JRuby users should upgrade to Nokogiri v1.12.5 or later to receive a patch for this issue. There are no workarounds available for v1.12.4 or earlier. CRuby users are not affected.

Publish Date: 2021-09-27

URL: CVE-2021-41098

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41098

Release Date: 2021-09-27

Fix Resolution: nokogiri - 1.12.5

CVE-2021-22904

Vulnerable Library - actionpack-6.1.3.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-6.1.3.1.gem

Dependency Hierarchy:

  • sass-rails-6.0.0.gem (Root Library)
    • sassc-rails-2.1.2.gem
      • sprockets-rails-3.2.2.gem
        • ❌ actionpack-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses authenticate_or_request_with_http_token or authenticate_with_http_token for request authentication.

Publish Date: 2021-06-11

URL: CVE-2021-22904

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-06-11

Fix Resolution: actionpack - 5.2.4.6,5.2.6,6.0.3.7,6.1.3.2

CVE-2022-30122

Vulnerable Library - rack-2.2.3.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.3.gem

Dependency Hierarchy:

  • sass-rails-6.0.0.gem (Root Library)
    • sassc-rails-2.1.2.gem
      • sprockets-4.0.2.gem
        • ❌ rack-2.2.3.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

There is a possible denial of service vulnerability in the multipart parsing component of Rack before 2.0.9.1,2.1.4.1,2.2.3.1

Publish Date: 2022-05-03

URL: CVE-2022-30122

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hxqx-xwvh-44m2

Release Date: 2022-05-03

Fix Resolution: rack - 2.0.9.1,2.1.4.1,2.2.3.1

CVE-2021-22942

Vulnerable Library - actionpack-6.1.3.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-6.1.3.1.gem

Dependency Hierarchy:

  • sass-rails-6.0.0.gem (Root Library)
    • sassc-rails-2.1.2.gem
      • sprockets-rails-3.2.2.gem
        • ❌ actionpack-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect users to a malicious website.

Publish Date: 2021-10-18

URL: CVE-2021-22942

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-22942

Release Date: 2021-10-18

Fix Resolution: actionpack - 6.0.4.1,6.1.4.1

CVE-2021-22903

Vulnerable Library - actionpack-6.1.3.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-6.1.3.1.gem

Dependency Hierarchy:

  • sass-rails-6.0.0.gem (Root Library)
    • sassc-rails-2.1.2.gem
      • sprockets-rails-3.2.2.gem
        • ❌ actionpack-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. This is similar to CVE-2021-22881. Strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, config.hosts << "sub.example.com" to permit a request with a Host header value of sub-example.com.

Publish Date: 2021-06-11

URL: CVE-2021-22903

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-06-11

Fix Resolution: actionpack - 6.1.3.2

CVE-2022-22577

Vulnerable Library - actionpack-6.1.3.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-6.1.3.1.gem

Dependency Hierarchy:

  • sass-rails-6.0.0.gem (Root Library)
    • sassc-rails-2.1.2.gem
      • sprockets-rails-3.2.2.gem
        • ❌ actionpack-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses.

Publish Date: 2022-05-26

URL: CVE-2022-22577

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-mm33-5vfq-3mm3

Release Date: 2022-01-05

Fix Resolution: actionpack - 5.2.7.1,6.0.4.8,6.1.5.1,7.0.2.4

CVE-2022-27777

Vulnerable Library - actionview-6.1.3.1.gem

Simple, battle-tested conventions and helpers for building web pages.

Library home page: https://rubygems.org/gems/actionview-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionview-6.1.3.1.gem

Dependency Hierarchy:

  • sass-rails-6.0.0.gem (Root Library)
    • sassc-rails-2.1.2.gem
      • sprockets-rails-3.2.2.gem
        • actionpack-6.1.3.1.gem
          • ❌ actionview-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes.

Publish Date: 2022-05-26

URL: CVE-2022-27777

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-ch3h-j2vf-95pv

Release Date: 2022-03-24

Fix Resolution: actionview - 5.2.7.1,6.0.4.8,6.1.5.1,7.0.2.4

CVE-2021-44528

Vulnerable Library - actionpack-6.1.3.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-6.1.3.1.gem

Dependency Hierarchy:

  • sass-rails-6.0.0.gem (Root Library)
    • sassc-rails-2.1.2.gem
      • sprockets-rails-3.2.2.gem
        • ❌ actionpack-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.

Publish Date: 2022-01-10

URL: CVE-2021-44528

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qphc-hf5q-v8fc

Release Date: 2022-01-10

Fix Resolution: actionpack - 6.0.4.2,6.1.4.2

CVE-2022-23634

Vulnerable Library - actionpack-6.1.3.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-6.1.3.1.gem

Dependency Hierarchy:

  • sass-rails-6.0.0.gem (Root Library)
    • sassc-rails-2.1.2.gem
      • sprockets-rails-3.2.2.gem
        • ❌ actionpack-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Puma is a Ruby/Rack web server built for parallelism. Prior to puma version 5.6.2, puma may not always call close on the response body. Rails, prior to version 7.0.2.2, depended on the response body being closed in order for its CurrentAttributes implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails or Puma version fixes the vulnerability.

Publish Date: 2022-02-11

URL: CVE-2022-23634

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wh98-p28r-vrc9

Release Date: 2022-02-11

Fix Resolution: puma - 4.3.11, 5.6.2; actionpack - 5.2.6.2, 6.0.4.6, 6.1.4.6, 7.0.2.2

CVE-2022-23633

Vulnerable Library - actionpack-6.1.3.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-6.1.3.1.gem

Dependency Hierarchy:

  • sass-rails-6.0.0.gem (Root Library)
    • sassc-rails-2.1.2.gem
      • sprockets-rails-3.2.2.gem
        • ❌ actionpack-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.

Publish Date: 2022-02-11

URL: CVE-2022-23633

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wh98-p28r-vrc9

Release Date: 2022-02-11

Fix Resolution: 5.2.6.2, 6.0.4.6, 6.1.4.6, 7.0.2.2

CVE-2022-32209

Vulnerable Library - rails-html-sanitizer-1.3.0.gem

HTML sanitization for Rails applications

Library home page: https://rubygems.org/gems/rails-html-sanitizer-1.3.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rails-html-sanitizer-1.3.0.gem

Dependency Hierarchy:

  • sass-rails-6.0.0.gem (Root Library)
    • sassc-rails-2.1.2.gem
      • sprockets-rails-3.2.2.gem
        • actionpack-6.1.3.1.gem
          • ❌ rails-html-sanitizer-1.3.0.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A possible XSS vulnerability has been discovered in rails-html-sanitizer before 1.4.3. This allows an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both select and style elements. Code is only impacted if allowed tags are being overridden. This may be done via application configuration.

Publish Date: 2022-06-02

URL: CVE-2022-32209

CVSS 3 Score Details (5.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://hackerone.com/reports/1530898

Release Date: 2022-06-02

Fix Resolution: rails-html-sanitizer - 1.4.3

webpacker-4.2.2.tgz: 57 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - webpacker-4.2.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/postcss/package.json

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (webpacker version) Remediation Possible**
CVE-2023-26136 Critical 9.8 tough-cookie-2.5.0.tgz Transitive 5.2.2 ✅
CVE-2022-37601 Critical 9.8 loader-utils-1.2.3.tgz Transitive 4.3.0 ✅
CVE-2021-44906 Critical 9.8 minimist-1.2.0.tgz Transitive 4.3.0 ✅
CVE-2021-3918 Critical 9.8 json-schema-0.2.3.tgz Transitive 4.3.0 ✅
CVE-2020-7788 Critical 9.8 ini-1.3.5.tgz Transitive 4.3.0 ✅
CVE-2020-7774 Critical 9.8 y18n-3.2.1.tgz Transitive 4.3.0 ✅
CVE-2022-46175 High 8.8 detected in multiple dependencies Transitive 4.3.0 ✅
CVE-2021-37713 High 8.6 tar-2.2.2.tgz Transitive 5.2.2 ✅
CVE-2021-37712 High 8.6 tar-2.2.2.tgz Transitive 5.2.2 ✅
CVE-2021-37701 High 8.6 tar-2.2.2.tgz Transitive 5.2.2 ✅
CVE-2021-32804 High 8.1 tar-2.2.2.tgz Transitive 5.2.2 ✅
CVE-2021-32803 High 8.1 tar-2.2.2.tgz Transitive 5.2.2 ✅
CVE-2020-7660 High 8.1 serialize-javascript-2.1.2.tgz Transitive 4.3.0 ✅
CVE-2020-13822 High 7.7 elliptic-6.5.2.tgz Transitive 4.3.0 ✅
WS-2021-0152 High 7.5 color-string-1.5.3.tgz Transitive 4.3.0 ✅
WS-2020-0042 High 7.5 acorn-6.4.0.tgz Transitive 4.3.0 ✅
CVE-2023-46234 High 7.5 browserify-sign-4.0.4.tgz Transitive 4.3.0 ✅
CVE-2022-37603 High 7.5 loader-utils-1.2.3.tgz Transitive 4.3.0 ✅
CVE-2022-3517 High 7.5 minimatch-3.0.4.tgz Transitive N/A* ❌
CVE-2022-25883 High 7.5 detected in multiple dependencies Transitive N/A* ❌
CVE-2022-25858 High 7.5 terser-4.6.3.tgz Transitive 4.3.0 ✅
CVE-2022-25758 High 7.5 scss-tokenizer-0.2.3.tgz Transitive 5.2.2 ✅
CVE-2022-24999 High 7.5 qs-6.5.2.tgz Transitive 4.3.0 ✅
CVE-2021-3807 High 7.5 ansi-regex-4.1.0.tgz Transitive 4.3.0 ✅
CVE-2021-3803 High 7.5 nth-check-1.0.2.tgz Transitive N/A* ❌
CVE-2021-33623 High 7.5 trim-newlines-1.0.0.tgz Transitive 5.2.2 ✅
CVE-2021-29059 High 7.5 is-svg-3.0.0.tgz Transitive 4.3.0 ✅
CVE-2021-28092 High 7.5 is-svg-3.0.0.tgz Transitive 4.3.0 ✅
CVE-2021-27290 High 7.5 detected in multiple dependencies Transitive 4.3.0 ✅
CVE-2021-23382 High 7.5 postcss-7.0.26.tgz Transitive 4.3.0 ✅
CVE-2021-23343 High 7.5 path-parse-1.0.6.tgz Transitive 4.3.0 ✅
CVE-2018-11499 High 7.3 node-sass-4.13.1.tgz Transitive 4.3.0 ✅
CVE-2020-28498 Medium 6.8 elliptic-6.5.2.tgz Transitive 4.3.0 ✅
CVE-2024-28863 Medium 6.5 tar-2.2.2.tgz Transitive N/A* ❌
CVE-2019-6286 Medium 6.5 node-sass-4.13.1.tgz Transitive N/A* ❌
CVE-2019-6284 Medium 6.5 node-sass-4.13.1.tgz Transitive 5.2.2 ✅
CVE-2019-6283 Medium 6.5 node-sass-4.13.1.tgz Transitive N/A* ❌
CVE-2019-18797 Medium 6.5 node-sass-4.13.1.tgz Transitive 4.3.0 ✅
CVE-2018-20821 Medium 6.5 node-sass-4.13.1.tgz Transitive N/A* ❌
CVE-2018-20190 Medium 6.5 node-sass-4.13.1.tgz Transitive N/A* ❌
CVE-2018-19838 Medium 6.5 node-sass-4.13.1.tgz Transitive 4.3.0 ✅
CVE-2018-19837 Medium 6.5 node-sass-4.13.1.tgz Transitive 4.3.0 ✅
CVE-2023-28155 Medium 6.1 request-2.88.2.tgz Transitive N/A* ❌
WS-2019-0424 Medium 5.9 elliptic-6.5.2.tgz Transitive 4.3.0 ✅
CVE-2020-7598 Medium 5.6 minimist-1.2.0.tgz Transitive 4.3.0 ✅
CVE-2018-19827 Medium 5.6 node-sass-4.13.1.tgz Transitive N/A* ❌
CVE-2018-11696 Medium 5.6 node-sass-4.13.1.tgz Transitive 4.3.0 ✅
CVE-2018-11694 Medium 5.6 node-sass-4.13.1.tgz Transitive N/A* ❌
CVE-2021-29060 Medium 5.3 color-string-1.5.3.tgz Transitive 4.3.0 ✅
CVE-2021-23368 Medium 5.3 postcss-7.0.26.tgz Transitive 4.3.0 ✅
CVE-2021-23364 Medium 5.3 browserslist-4.8.7.tgz Transitive 4.3.0 ✅
CVE-2021-23362 Medium 5.3 hosted-git-info-2.8.5.tgz Transitive 4.3.0 ✅
CVE-2020-7608 Medium 5.3 detected in multiple dependencies Transitive 4.3.0 ✅
CVE-2020-24025 Medium 5.3 node-sass-4.13.1.tgz Transitive 5.2.2 ✅
CVE-2018-11697 Medium 4.8 node-sass-4.13.1.tgz Transitive 4.3.0 ✅
CVE-2018-19839 Low 3.7 node-sass-4.13.1.tgz Transitive N/A* ❌
CVE-2018-19797 Low 3.7 node-sass-4.13.1.tgz Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

Partial details (18 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2023-26136

Vulnerable Library - tough-cookie-2.5.0.tgz

RFC6265 Cookies and Cookie Jar for node.js

Library home page: https://registry.npmjs.org/tough-cookie/-/tough-cookie-2.5.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tough-cookie/package.json

Dependency Hierarchy:

  • webpacker-4.2.2.tgz (Root Library)
    • node-sass-4.13.1.tgz
      • request-2.88.2.tgz
        • ❌ tough-cookie-2.5.0.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Versions of the package tough-cookie before 4.1.3 are vulnerable to Prototype Pollution due to improper handling of Cookies when using CookieJar in rejectPublicSuffixes=false mode. This issue arises from the manner in which the objects are initialized.

Publish Date: 2023-07-01

URL: CVE-2023-26136

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-26136

Release Date: 2023-07-01

Fix Resolution (tough-cookie): 4.1.3

Direct dependency fix Resolution (@rails/webpacker): 5.2.2

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-37601

Vulnerable Library - loader-utils-1.2.3.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy:

  • webpacker-4.2.2.tgz (Root Library)
    • webpack-cli-3.3.11.tgz
      • ❌ loader-utils-1.2.3.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Prototype pollution vulnerability in function parseQuery in parseQuery.js in webpack loader-utils 2.0.0 via the name variable in parseQuery.js.

Publish Date: 2022-10-12

URL: CVE-2022-37601

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-76p3-8jx3-jpfq

Release Date: 2022-10-12

Fix Resolution (loader-utils): 1.4.1

Direct dependency fix Resolution (@rails/webpacker): 4.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-44906

Vulnerable Library - minimist-1.2.0.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-1.2.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/minimist/package.json

Dependency Hierarchy:

  • webpacker-4.2.2.tgz (Root Library)
    • webpack-cli-3.3.11.tgz
      • loader-utils-1.2.3.tgz
        • json5-1.0.1.tgz
          • ❌ minimist-1.2.0.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-xvch-5gv4-984h

Release Date: 2022-03-17

Fix Resolution (minimist): 1.2.6

Direct dependency fix Resolution (@rails/webpacker): 4.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-3918

Vulnerable Library - json-schema-0.2.3.tgz

JSON Schema validation and specifications

Library home page: https://registry.npmjs.org/json-schema/-/json-schema-0.2.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/json-schema/package.json

Dependency Hierarchy:

  • webpacker-4.2.2.tgz (Root Library)
    • node-sass-4.13.1.tgz
      • request-2.88.2.tgz
        • http-signature-1.2.0.tgz
          • jsprim-1.4.1.tgz
            • ❌ json-schema-0.2.3.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

json-schema is vulnerable to Improperly Controlled Modification of Object Prototype Attributes ('Prototype Pollution')

Publish Date: 2021-11-13

URL: CVE-2021-3918

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-3918

Release Date: 2021-11-13

Fix Resolution (json-schema): 0.4.0

Direct dependency fix Resolution (@rails/webpacker): 4.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-7788

Vulnerable Library - ini-1.3.5.tgz

An ini encoder/decoder for node

Library home page: https://registry.npmjs.org/ini/-/ini-1.3.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ini/package.json

Dependency Hierarchy:

  • webpacker-4.2.2.tgz (Root Library)
    • webpack-cli-3.3.11.tgz
      • global-modules-2.0.0.tgz
        • global-prefix-3.0.0.tgz
          • ❌ ini-1.3.5.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

This affects the package ini before 1.3.6. If an attacker submits a malicious INI file to an application that parses it with ini.parse, they will pollute the prototype on the application. This can be exploited further depending on the context.

Publish Date: 2020-12-11

URL: CVE-2020-7788

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7788

Release Date: 2020-12-11

Fix Resolution (ini): 1.3.6

Direct dependency fix Resolution (@rails/webpacker): 4.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-7774

Vulnerable Library - y18n-3.2.1.tgz

the bare-bones internationalization library used by yargs

Library home page: https://registry.npmjs.org/y18n/-/y18n-3.2.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/y18n/package.json

Dependency Hierarchy:

  • webpacker-4.2.2.tgz (Root Library)
    • node-sass-4.13.1.tgz
      • sass-graph-2.2.4.tgz
        • yargs-7.1.0.tgz
          • ❌ y18n-3.2.1.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

Publish Date: 2020-11-17

URL: CVE-2020-7774

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1654

Release Date: 2020-11-17

Fix Resolution (y18n): 3.2.2

Direct dependency fix Resolution (@rails/webpacker): 4.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-46175

Vulnerable Libraries - json5-1.0.1.tgz, json5-2.1.1.tgz

json5-1.0.1.tgz

JSON for humans.

Library home page: https://registry.npmjs.org/json5/-/json5-1.0.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/json5/package.json

Dependency Hierarchy:

  • webpacker-4.2.2.tgz (Root Library)
    • webpack-cli-3.3.11.tgz
      • loader-utils-1.2.3.tgz
        • ❌ json5-1.0.1.tgz (Vulnerable Library)

json5-2.1.1.tgz

JSON for humans.

Library home page: https://registry.npmjs.org/json5/-/json5-2.1.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/json5/package.json

Dependency Hierarchy:

  • webpacker-4.2.2.tgz (Root Library)
    • core-7.8.4.tgz
      • ❌ json5-2.1.1.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

JSON5 is an extension to the popular JSON file format that aims to be easier to write and maintain by hand (e.g. for config files). The parse method of the JSON5 library before and including versions 1.0.1 and 2.2.1 does not restrict parsing of keys named __proto__, allowing specially crafted strings to pollute the prototype of the resulting object. This vulnerability pollutes the prototype of the object returned by JSON5.parse and not the global Object prototype, which is the commonly understood definition of Prototype Pollution. However, polluting the prototype of a single object can have significant security impact for an application if the object is later used in trusted operations. This vulnerability could allow an attacker to set arbitrary and unexpected keys on the object returned from JSON5.parse. The actual impact will depend on how applications utilize the returned object and how they filter unwanted keys, but could include denial of service, cross-site scripting, elevation of privilege, and in extreme cases, remote code execution. JSON5.parse should restrict parsing of __proto__ keys when parsing JSON strings to objects. As a point of reference, the JSON.parse method included in JavaScript ignores __proto__ keys. Simply changing JSON5.parse to JSON.parse in the examples above mitigates this vulnerability. This vulnerability is patched in json5 versions 1.0.2, 2.2.2, and later.

Publish Date: 2022-12-24

URL: CVE-2022-46175

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-46175

Release Date: 2022-12-24

Fix Resolution (json5): 1.0.2

Direct dependency fix Resolution (@rails/webpacker): 4.3.0

Fix Resolution (json5): 1.0.2

Direct dependency fix Resolution (@rails/webpacker): 4.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-37713

Vulnerable Library - tar-2.2.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tar/package.json

Dependency Hierarchy:

  • webpacker-4.2.2.tgz (Root Library)
    • node-sass-4.13.1.tgz
      • node-gyp-3.8.0.tgz
        • ❌ tar-2.2.2.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be outside of the extraction target directory is not extracted. This is, in part, accomplished by sanitizing absolute paths of entries within the archive, skipping archive entries that contain .. path portions, and resolving the sanitized paths against the extraction target directory. This logic was insufficient on Windows systems when extracting tar files that contained a path that was not an absolute path, but specified a drive letter different from the extraction target, such as C:some\path. If the drive letter does not match the extraction target, for example D:\extraction\dir, then the result of path.resolve(extractionDirectory, entryPath) would resolve against the current working directory on the C: drive, rather than the extraction target directory. Additionally, a .. portion of the path could occur immediately after the drive letter, such as C:../foo, and was not properly sanitized by the logic that checked for .. within the normalized and split portions of the path. This only affects users of node-tar on Windows systems. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. There is no reasonable way to work around this issue without performing the same path normalization procedures that node-tar now does. Users are encouraged to upgrade to the latest patched versions of node-tar, rather than attempt to sanitize paths themselves.

Publish Date: 2021-08-31

URL: CVE-2021-37713

CVSS 3 Score Details (8.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5955-9wpr-37jh

Release Date: 2021-08-31

Fix Resolution (tar): 4.4.18

Direct dependency fix Resolution (@rails/webpacker): 5.2.2

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-37712

Vulnerable Library - tar-2.2.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tar/package.json

Dependency Hierarchy:

  • webpacker-4.2.2.tgz (Root Library)
    • node-sass-4.13.1.tgz
      • node-gyp-3.8.0.tgz
        • ❌ tar-2.2.2.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.18, 5.0.10, and 6.1.9 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with names containing unicode values that normalized to the same value. Additionally, on Windows systems, long path portions would resolve to the same file system entities as their 8.3 "short path" counterparts. A specially crafted tar archive could thus include a directory with one form of the path, followed by a symbolic link with a different string that resolves to the same file system entity, followed by a file using the first form. By first creating a directory, and then replacing that directory with a symlink that had a different apparent name that resolved to the same entry in the filesystem, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. These issues were addressed in releases 4.4.18, 5.0.10 and 6.1.9. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-qq89-hq3f-393p.

Publish Date: 2021-08-31

URL: CVE-2021-37712

CVSS 3 Score Details (8.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qq89-hq3f-393p

Release Date: 2021-08-31

Fix Resolution (tar): 4.4.18

Direct dependency fix Resolution (@rails/webpacker): 5.2.2

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-37701

Vulnerable Library - tar-2.2.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tar/package.json

Dependency Hierarchy:

  • webpacker-4.2.2.tgz (Root Library)
    • node-sass-4.13.1.tgz
      • node-gyp-3.8.0.tgz
        • ❌ tar-2.2.2.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 4.4.16, 5.0.8, and 6.1.7 has an arbitrary file creation/overwrite and arbitrary code execution vulnerability. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory, where the symlink and directory names in the archive entry used backslashes as a path separator on posix systems. The cache checking logic used both \ and / characters as path separators, however \ is a valid filename character on posix systems. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. Additionally, a similar confusion could arise on case-insensitive filesystems. If a tar archive contained a directory at FOO, followed by a symbolic link named foo, then on case-insensitive file systems, the creation of the symbolic link would remove the directory from the filesystem, but not from the internal directory cache, as it would not be treated as a cache hit. A subsequent file entry within the FOO directory would then be placed in the target of the symbolic link, thinking that the directory had already been created. These issues were addressed in releases 4.4.16, 5.0.8 and 6.1.7. The v3 branch of node-tar has been deprecated and did not receive patches for these issues. If you are still using a v3 release we recommend you update to a more recent version of node-tar. If this is not possible, a workaround is available in the referenced GHSA-9r2w-394v-53qc.

Publish Date: 2021-08-31

URL: CVE-2021-37701

CVSS 3 Score Details (8.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-9r2w-394v-53qc

Release Date: 2021-08-31

Fix Resolution (tar): 4.4.16

Direct dependency fix Resolution (@rails/webpacker): 5.2.2

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-32804

Vulnerable Library - tar-2.2.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tar/package.json

Dependency Hierarchy:

  • webpacker-4.2.2.tgz (Root Library)
    • node-sass-4.13.1.tgz
      • node-gyp-3.8.0.tgz
        • ❌ tar-2.2.2.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 6.1.1, 5.0.6, 4.4.14, and 3.3.2 has a arbitrary File Creation/Overwrite vulnerability due to insufficient absolute path sanitization. node-tar aims to prevent extraction of absolute file paths by turning absolute paths into relative paths when the preservePaths flag is not set to true. This is achieved by stripping the absolute path root from any absolute file paths contained in a tar file. For example /home/user/.bashrc would turn into home/user/.bashrc. This logic was insufficient when file paths contained repeated path roots such as ////home/user/.bashrc. node-tar would only strip a single path root from such paths. When given an absolute file path with repeating path roots, the resulting path (e.g. ///home/user/.bashrc) would still resolve to an absolute path, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.2, 4.4.14, 5.0.6 and 6.1.1. Users may work around this vulnerability without upgrading by creating a custom onentry method which sanitizes the entry.path or a filter method which removes entries with absolute paths. See referenced GitHub Advisory for details. Be aware of CVE-2021-32803 which fixes a similar bug in later versions of tar.

Publish Date: 2021-08-03

URL: CVE-2021-32804

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3jfq-g458-7qm9

Release Date: 2021-08-03

Fix Resolution (tar): 3.2.2

Direct dependency fix Resolution (@rails/webpacker): 5.2.2

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-32803

Vulnerable Library - tar-2.2.2.tgz

tar for node

Library home page: https://registry.npmjs.org/tar/-/tar-2.2.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/tar/package.json

Dependency Hierarchy:

  • webpacker-4.2.2.tgz (Root Library)
    • node-sass-4.13.1.tgz
      • node-gyp-3.8.0.tgz
        • ❌ tar-2.2.2.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

The npm package "tar" (aka node-tar) before versions 6.1.2, 5.0.7, 4.4.15, and 3.2.3 has an arbitrary File Creation/Overwrite vulnerability via insufficient symlink protection. node-tar aims to guarantee that any file whose location would be modified by a symbolic link is not extracted. This is, in part, achieved by ensuring that extracted directories are not symlinks. Additionally, in order to prevent unnecessary stat calls to determine whether a given path is a directory, paths are cached when directories are created. This logic was insufficient when extracting tar files that contained both a directory and a symlink with the same name as the directory. This order of operations resulted in the directory being created and added to the node-tar directory cache. When a directory is present in the directory cache, subsequent calls to mkdir for that directory are skipped. However, this is also where node-tar checks for symlinks occur. By first creating a directory, and then replacing that directory with a symlink, it was thus possible to bypass node-tar symlink checks on directories, essentially allowing an untrusted tar file to symlink into an arbitrary location and subsequently extracting arbitrary files into that location, thus allowing arbitrary file creation and overwrite. This issue was addressed in releases 3.2.3, 4.4.15, 5.0.7 and 6.1.2.

Publish Date: 2021-08-03

URL: CVE-2021-32803

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-r628-mhmh-qjhw

Release Date: 2021-08-03

Fix Resolution (tar): 3.2.3

Direct dependency fix Resolution (@rails/webpacker): 5.2.2

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-7660

Vulnerable Library - serialize-javascript-2.1.2.tgz

Serialize JavaScript to a superset of JSON that includes regular expressions and functions.

Library home page: https://registry.npmjs.org/serialize-javascript/-/serialize-javascript-2.1.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/serialize-javascript/package.json

Dependency Hierarchy:

  • webpacker-4.2.2.tgz (Root Library)
    • compression-webpack-plugin-3.1.0.tgz
      • ❌ serialize-javascript-2.1.2.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

serialize-javascript prior to 3.1.0 allows remote attackers to inject arbitrary code via the function "deleteFunctions" within "index.js".

Publish Date: 2020-06-01

URL: CVE-2020-7660

CVSS 3 Score Details (8.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-7660

Release Date: 2020-06-08

Fix Resolution (serialize-javascript): 3.1.0

Direct dependency fix Resolution (@rails/webpacker): 4.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-13822

Vulnerable Library - elliptic-6.5.2.tgz

EC cryptography

Library home page: https://registry.npmjs.org/elliptic/-/elliptic-6.5.2.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/elliptic/package.json

Dependency Hierarchy:

  • webpacker-4.2.2.tgz (Root Library)
    • webpack-4.41.6.tgz
      • node-libs-browser-2.2.1.tgz
        • crypto-browserify-3.12.0.tgz
          • browserify-sign-4.0.4.tgz
            • ❌ elliptic-6.5.2.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

The Elliptic package 6.5.2 for Node.js allows ECDSA signature malleability via variations in encoding, leading '\0' bytes, or integer overflows. This could conceivably have a security-relevant impact if an application relied on a single canonical signature.

Publish Date: 2020-06-04

URL: CVE-2020-13822

CVSS 3 Score Details (7.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-07-02

Fix Resolution (elliptic): 6.5.3

Direct dependency fix Resolution (@rails/webpacker): 4.3.0

⛑️ Automatic Remediation will be attempted for this issue.

WS-2021-0152

Vulnerable Library - color-string-1.5.3.tgz

Parser and generator for CSS color strings

Library home page: https://registry.npmjs.org/color-string/-/color-string-1.5.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/color-string/package.json

Dependency Hierarchy:

  • webpacker-4.2.2.tgz (Root Library)
    • optimize-css-assets-webpack-plugin-5.0.3.tgz
      • cssnano-4.1.10.tgz
        • cssnano-preset-default-4.0.7.tgz
          • postcss-colormin-4.0.3.tgz
            • color-3.1.2.tgz
              • ❌ color-string-1.5.3.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Regular Expression Denial of Service (ReDoS) was found in color-string before 1.5.5.

Publish Date: 2021-03-12

URL: WS-2021-0152

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-03-12

Fix Resolution (color-string): 1.5.5

Direct dependency fix Resolution (@rails/webpacker): 4.3.0

⛑️ Automatic Remediation will be attempted for this issue.

WS-2020-0042

Vulnerable Library - acorn-6.4.0.tgz

ECMAScript parser

Library home page: https://registry.npmjs.org/acorn/-/acorn-6.4.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/acorn/package.json

Dependency Hierarchy:

  • webpacker-4.2.2.tgz (Root Library)
    • webpack-4.41.6.tgz
      • ❌ acorn-6.4.0.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

acorn is vulnerable to REGEX DoS. A regex of the form /[x-\ud800]/u causes the parser to enter an infinite loop. attackers may leverage the vulnerability leading to a Denial of Service since the string is not valid UTF16 and it results in it being sanitized before reaching the parser.

Publish Date: 2020-03-01

URL: WS-2020-0042

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-6chw-6frg-f759

Release Date: 2020-03-01

Fix Resolution (acorn): 6.4.1

Direct dependency fix Resolution (@rails/webpacker): 4.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-46234

Vulnerable Library - browserify-sign-4.0.4.tgz

adds node crypto signing for browsers

Library home page: https://registry.npmjs.org/browserify-sign/-/browserify-sign-4.0.4.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/browserify-sign/package.json

Dependency Hierarchy:

  • webpacker-4.2.2.tgz (Root Library)
    • webpack-4.41.6.tgz
      • node-libs-browser-2.2.1.tgz
        • crypto-browserify-3.12.0.tgz
          • ❌ browserify-sign-4.0.4.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

browserify-sign is a package to duplicate the functionality of node's crypto public key functions, much of this is based on Fedor Indutny's work on indutny/tls.js. An upper bound check issue in dsaVerify function allows an attacker to construct signatures that can be successfully verified by any public key, thus leading to a signature forgery attack. All places in this project that involve DSA verification of user-input signatures will be affected by this vulnerability. This issue has been patched in version 4.2.2.

Publish Date: 2023-10-26

URL: CVE-2023-46234

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-x9w5-v3q2-3rhw

Release Date: 2023-10-26

Fix Resolution (browserify-sign): 4.2.2

Direct dependency fix Resolution (@rails/webpacker): 4.3.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-37603

Vulnerable Library - loader-utils-1.2.3.tgz

utils for webpack loaders

Library home page: https://registry.npmjs.org/loader-utils/-/loader-utils-1.2.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/loader-utils/package.json

Dependency Hierarchy:

  • webpacker-4.2.2.tgz (Root Library)
    • webpack-cli-3.3.11.tgz
      • ❌ loader-utils-1.2.3.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A Regular expression denial of service (ReDoS) flaw was found in Function interpolateName in interpolateName.js in webpack loader-utils 2.0.0 via the url variable in interpolateName.js.

Publish Date: 2022-10-14

URL: CVE-2022-37603

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3rfm-jhwj-7488

Release Date: 2022-10-14

Fix Resolution (loader-utils): 1.4.2

Direct dependency fix Resolution (@rails/webpacker): 4.3.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

puma-5.2.2.gem: 5 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - puma-5.2.2.gem

Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications. Puma is intended for use in both development and production environments. It's great for highly concurrent Ruby implementations such as Rubinius and JRuby as well as as providing process worker support to support CRuby well.

Library home page: https://rubygems.org/gems/puma-5.2.2.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /2.7.0/cache/puma-5.2.2.gem

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (puma version) Remediation Possible**
CVE-2023-40175 Critical 9.8 puma-5.2.2.gem Direct puma - 5.6.7,6.3.1 ✅
CVE-2024-21647 High 7.5 puma-5.2.2.gem Direct puma - 5.6.8,6.4.2 ✅
CVE-2021-29509 High 7.5 puma-5.2.2.gem Direct puma - 4.3.8,5.3.1 ✅
CVE-2022-23634 Medium 5.9 puma-5.2.2.gem Direct puma - 4.3.11, 5.6.2; actionpack - 5.2.6.2, 6.0.4.6, 6.1.4.6, 7.0.2.2 ✅
CVE-2021-41136 Low 3.7 puma-5.2.2.gem Direct puma - 4.3.9, 5.5.1 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-40175

Vulnerable Library - puma-5.2.2.gem

Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications. Puma is intended for use in both development and production environments. It's great for highly concurrent Ruby implementations such as Rubinius and JRuby as well as as providing process worker support to support CRuby well.

Library home page: https://rubygems.org/gems/puma-5.2.2.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /2.7.0/cache/puma-5.2.2.gem

Dependency Hierarchy:

  • ❌ puma-5.2.2.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is highly dependent on the nature of the web site using puma is. This could be caused by either incorrect parsing of trailing fields in chunked transfer encoding bodies or by parsing of blank/zero-length Content-Length headers. Both issues have been addressed and this vulnerability has been fixed in versions 6.3.1 and 5.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Publish Date: 2023-08-18

URL: CVE-2023-40175

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-40175

Release Date: 2023-08-18

Fix Resolution: puma - 5.6.7,6.3.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-21647

Vulnerable Library - puma-5.2.2.gem

Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications. Puma is intended for use in both development and production environments. It's great for highly concurrent Ruby implementations such as Rubinius and JRuby as well as as providing process worker support to support CRuby well.

Library home page: https://rubygems.org/gems/puma-5.2.2.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /2.7.0/cache/puma-5.2.2.gem

Dependency Hierarchy:

  • ❌ puma-5.2.2.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. This vulnerability has been fixed in versions 6.4.2 and 5.6.8.

Publish Date: 2024-01-08

URL: CVE-2024-21647

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-21647

Release Date: 2024-01-08

Fix Resolution: puma - 5.6.8,6.4.2

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-29509

Vulnerable Library - puma-5.2.2.gem

Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications. Puma is intended for use in both development and production environments. It's great for highly concurrent Ruby implementations such as Rubinius and JRuby as well as as providing process worker support to support CRuby well.

Library home page: https://rubygems.org/gems/puma-5.2.2.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /2.7.0/cache/puma-5.2.2.gem

Dependency Hierarchy:

  • ❌ puma-5.2.2.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Puma is a concurrent HTTP 1.1 server for Ruby/Rack applications. The fix for CVE-2019-16770 was incomplete. The original fix only protected existing connections that had already been accepted from having their requests starved by greedy persistent-connections saturating all threads in the same process. However, new connections may still be starved by greedy persistent-connections saturating all threads in all processes in the cluster. A puma server which received more concurrent keep-alive connections than the server had threads in its threadpool would service only a subset of connections, denying service to the unserved connections. This problem has been fixed in puma 4.3.8 and 5.3.1. Setting queue_requests false also fixes the issue. This is not advised when using puma without a reverse proxy, such as nginx or apache, because you will open yourself to slow client attacks (e.g. slowloris). The fix is very small and a git patch is available for those using unsupported versions of Puma.

Publish Date: 2021-05-11

URL: CVE-2021-29509

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q28m-8xjw-8vr5

Release Date: 2021-05-11

Fix Resolution: puma - 4.3.8,5.3.1

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-23634

Vulnerable Library - puma-5.2.2.gem

Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications. Puma is intended for use in both development and production environments. It's great for highly concurrent Ruby implementations such as Rubinius and JRuby as well as as providing process worker support to support CRuby well.

Library home page: https://rubygems.org/gems/puma-5.2.2.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /2.7.0/cache/puma-5.2.2.gem

Dependency Hierarchy:

  • ❌ puma-5.2.2.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Puma is a Ruby/Rack web server built for parallelism. Prior to puma version 5.6.2, puma may not always call close on the response body. Rails, prior to version 7.0.2.2, depended on the response body being closed in order for its CurrentAttributes implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails or Puma version fixes the vulnerability.

Publish Date: 2022-02-11

URL: CVE-2022-23634

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wh98-p28r-vrc9

Release Date: 2022-02-11

Fix Resolution: puma - 4.3.11, 5.6.2; actionpack - 5.2.6.2, 6.0.4.6, 6.1.4.6, 7.0.2.2

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-41136

Vulnerable Library - puma-5.2.2.gem

Puma is a simple, fast, threaded, and highly concurrent HTTP 1.1 server for Ruby/Rack applications. Puma is intended for use in both development and production environments. It's great for highly concurrent Ruby implementations such as Rubinius and JRuby as well as as providing process worker support to support CRuby well.

Library home page: https://rubygems.org/gems/puma-5.2.2.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /2.7.0/cache/puma-5.2.2.gem

Dependency Hierarchy:

  • ❌ puma-5.2.2.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Puma is a HTTP 1.1 server for Ruby/Rack applications. Prior to versions 5.5.1 and 4.3.9, using puma with a proxy which forwards HTTP header values which contain the LF character could allow HTTP request smugggling. A client could smuggle a request through a proxy, causing the proxy to send a response back to another unknown client. The only proxy which has this behavior, as far as the Puma team is aware of, is Apache Traffic Server. If the proxy uses persistent connections and the client adds another request in via HTTP pipelining, the proxy may mistake it as the first request's body. Puma, however, would see it as two requests, and when processing the second request, send back a response that the proxy does not expect. If the proxy has reused the persistent connection to Puma to send another request for a different client, the second response from the first client will be sent to the second client. This vulnerability was patched in Puma 5.5.1 and 4.3.9. As a workaround, do not use Apache Traffic Server with puma.

Publish Date: 2021-10-12

URL: CVE-2021-41136

CVSS 3 Score Details (3.7)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-48w2-rm65-62xx

Release Date: 2021-10-12

Fix Resolution: puma - 4.3.9, 5.5.1

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

jquery-3.4.1.tgz: 2 vulnerabilities (highest severity is: 6.1)

Vulnerable Library - jquery-3.4.1.tgz

JavaScript library for DOM operations

Library home page: https://registry.npmjs.org/jquery/-/jquery-3.4.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jquery/package.json

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (jquery version) Remediation Possible**
CVE-2020-11023 Medium 6.1 jquery-3.4.1.tgz Direct 3.5.0 ✅
CVE-2020-11022 Medium 6.1 jquery-3.4.1.tgz Direct 3.5.0 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2020-11023

Vulnerable Library - jquery-3.4.1.tgz

JavaScript library for DOM operations

Library home page: https://registry.npmjs.org/jquery/-/jquery-3.4.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jquery/package.json

Dependency Hierarchy:

  • ❌ jquery-3.4.1.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6,https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440

Release Date: 2020-04-29

Fix Resolution: 3.5.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-11022

Vulnerable Library - jquery-3.4.1.tgz

JavaScript library for DOM operations

Library home page: https://registry.npmjs.org/jquery/-/jquery-3.4.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/jquery/package.json

Dependency Hierarchy:

  • ❌ jquery-3.4.1.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022

Release Date: 2020-04-29

Fix Resolution: 3.5.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

webpack-dev-server-3.10.3.tgz: 39 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - webpack-dev-server-3.10.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ajv/package.json

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (webpack-dev-server version) Remediation Possible**
CVE-2023-42282 Critical 9.8 ip-1.1.5.tgz Transitive 3.11.0 ✅
CVE-2022-0691 Critical 9.8 url-parse-1.4.7.tgz Transitive 3.11.0 ✅
CVE-2021-44906 Critical 9.8 minimist-0.0.8.tgz Transitive 3.11.0 ✅
CVE-2020-7774 Critical 9.8 y18n-4.0.0.tgz Transitive 3.11.0 ✅
CVE-2022-1650 Critical 9.3 eventsource-1.0.7.tgz Transitive 3.11.0 ✅
CVE-2024-29415 Critical 9.1 ip-1.1.5.tgz Transitive N/A* ❌
CVE-2022-0686 Critical 9.1 url-parse-1.4.7.tgz Transitive 3.11.0 ✅
CVE-2021-43138 High 7.8 async-2.6.3.tgz Transitive 3.11.0 ✅
WS-2020-0091 High 7.5 http-proxy-1.18.0.tgz Transitive 3.11.0 ✅
CVE-2022-25883 High 7.5 detected in multiple dependencies Transitive 4.0.0 ✅
CVE-2022-24999 High 7.5 qs-6.7.0.tgz Transitive 3.11.0 ✅
CVE-2022-24772 High 7.5 node-forge-0.9.0.tgz Transitive 4.7.3 ✅
CVE-2022-24771 High 7.5 node-forge-0.9.0.tgz Transitive 4.7.3 ✅
CVE-2021-3807 High 7.5 ansi-regex-3.0.0.tgz Transitive 3.11.0 ✅
CVE-2021-23424 High 7.5 ansi-html-0.0.7.tgz Transitive 3.11.3 ✅
CVE-2020-7662 High 7.5 websocket-extensions-0.1.3.tgz Transitive 3.11.0 ✅
CVE-2020-28469 High 7.5 glob-parent-3.1.0.tgz Transitive 4.0.0 ✅
CVE-2020-8203 High 7.4 lodash-4.17.15.tgz Transitive 3.11.0 ✅
CVE-2020-7720 High 7.3 node-forge-0.9.0.tgz Transitive 3.11.0 ✅
CVE-2021-23337 High 7.2 lodash-4.17.15.tgz Transitive 3.11.0 ✅
WS-2022-0008 Medium 6.6 node-forge-0.9.0.tgz Transitive 4.7.3 ✅
CVE-2024-28849 Medium 6.5 follow-redirects-1.10.0.tgz Transitive N/A* ❌
CVE-2022-0155 Medium 6.5 follow-redirects-1.10.0.tgz Transitive 3.11.0 ✅
CVE-2021-23386 Medium 6.5 dns-packet-1.3.1.tgz Transitive 3.11.0 ✅
CVE-2023-26159 Medium 6.1 follow-redirects-1.10.0.tgz Transitive 3.11.0 ✅
CVE-2022-0122 Medium 6.1 node-forge-0.9.0.tgz Transitive 4.7.3 ✅
CVE-2022-0536 Medium 5.9 follow-redirects-1.10.0.tgz Transitive 3.11.0 ✅
CVE-2020-7598 Medium 5.6 minimist-0.0.8.tgz Transitive 3.11.0 ✅
CVE-2020-15366 Medium 5.6 ajv-6.11.0.tgz Transitive 3.11.0 ✅
CVE-2022-24773 Medium 5.3 node-forge-0.9.0.tgz Transitive 4.7.3 ✅
CVE-2022-0639 Medium 5.3 url-parse-1.4.7.tgz Transitive 3.11.0 ✅
CVE-2022-0512 Medium 5.3 url-parse-1.4.7.tgz Transitive 3.11.0 ✅
CVE-2021-3664 Medium 5.3 url-parse-1.4.7.tgz Transitive 3.11.0 ✅
CVE-2021-32640 Medium 5.3 ws-6.2.1.tgz Transitive 3.11.0 ✅
CVE-2021-27515 Medium 5.3 url-parse-1.4.7.tgz Transitive 3.11.0 ✅
CVE-2020-7693 Medium 5.3 sockjs-0.3.19.tgz Transitive 3.11.0 ✅
CVE-2020-7608 Medium 5.3 yargs-parser-11.1.1.tgz Transitive 3.11.0 ✅
CVE-2020-28500 Medium 5.3 lodash-4.17.15.tgz Transitive 3.11.0 ✅
CVE-2017-16137 Low 3.7 debug-4.1.1.tgz Transitive 3.11.0 ✅

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

Partial details (23 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2023-42282

Vulnerable Library - ip-1.1.5.tgz

[![](https://badge.fury.io/js/ip.svg)](https://www.npmjs.com/package/ip)

Library home page: https://registry.npmjs.org/ip/-/ip-1.1.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ip/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • ❌ ip-1.1.5.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

The ip package before 1.1.9 for Node.js might allow SSRF because some IP addresses (such as 0x7f.1) are improperly categorized as globally routable via isPublic.

Publish Date: 2024-02-08

URL: CVE-2023-42282

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-78xj-cgh5-2h22

Release Date: 2024-02-08

Fix Resolution (ip): 1.1.9

Direct dependency fix Resolution (webpack-dev-server): 3.11.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-0691

Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/url-parse/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • sockjs-client-1.4.0.tgz
      • ❌ url-parse-1.4.7.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.9.

Publish Date: 2022-02-21

URL: CVE-2022-0691

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0691

Release Date: 2022-02-21

Fix Resolution (url-parse): 1.5.9

Direct dependency fix Resolution (webpack-dev-server): 3.11.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-44906

Vulnerable Library - minimist-0.0.8.tgz

parse argument options

Library home page: https://registry.npmjs.org/minimist/-/minimist-0.0.8.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/mkdirp/node_modules/minimist/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • portfinder-1.0.25.tgz
      • mkdirp-0.5.1.tgz
        • ❌ minimist-0.0.8.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Minimist <=1.2.5 is vulnerable to Prototype Pollution via file index.js, function setKey() (lines 69-95).

Publish Date: 2022-03-17

URL: CVE-2021-44906

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-xvch-5gv4-984h

Release Date: 2022-03-17

Fix Resolution (minimist): 0.2.4

Direct dependency fix Resolution (webpack-dev-server): 3.11.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-7774

Vulnerable Library - y18n-4.0.0.tgz

the bare-bones internationalization library used by yargs

Library home page: https://registry.npmjs.org/y18n/-/y18n-4.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/y18n/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • yargs-12.0.5.tgz
      • ❌ y18n-4.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

The package y18n before 3.2.2, 4.0.1 and 5.0.5, is vulnerable to Prototype Pollution.

Publish Date: 2020-11-17

URL: CVE-2020-7774

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1654

Release Date: 2020-11-17

Fix Resolution (y18n): 4.0.1

Direct dependency fix Resolution (webpack-dev-server): 3.11.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-1650

Vulnerable Library - eventsource-1.0.7.tgz

W3C compliant EventSource client for Node.js and browser (polyfill)

Library home page: https://registry.npmjs.org/eventsource/-/eventsource-1.0.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/eventsource/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • sockjs-client-1.4.0.tgz
      • ❌ eventsource-1.0.7.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Improper Removal of Sensitive Information Before Storage or Transfer in GitHub repository eventsource/eventsource prior to v2.0.2.

Publish Date: 2022-05-12

URL: CVE-2022-1650

CVSS 3 Score Details (9.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2022-05-12

Fix Resolution (eventsource): 1.1.1

Direct dependency fix Resolution (webpack-dev-server): 3.11.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-29415

Vulnerable Library - ip-1.1.5.tgz

[![](https://badge.fury.io/js/ip.svg)](https://www.npmjs.com/package/ip)

Library home page: https://registry.npmjs.org/ip/-/ip-1.1.5.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ip/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • ❌ ip-1.1.5.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

The ip package through 2.0.1 for Node.js might allow SSRF because some IP addresses (such as 127.1, 01200034567, 012.1.2.3, 000:0:0000::01, and ::fFFf:127.0.0.1) are improperly categorized as globally routable via isPublic. NOTE: this issue exists because of an incomplete fix for CVE-2023-42282.

Publish Date: 2024-05-27

URL: CVE-2024-29415

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

CVE-2022-0686

Vulnerable Library - url-parse-1.4.7.tgz

Small footprint URL parser that works seamlessly across Node.js and browser environments

Library home page: https://registry.npmjs.org/url-parse/-/url-parse-1.4.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/url-parse/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • sockjs-client-1.4.0.tgz
      • ❌ url-parse-1.4.7.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Authorization Bypass Through User-Controlled Key in NPM url-parse prior to 1.5.8.

Publish Date: 2022-02-20

URL: CVE-2022-0686

CVSS 3 Score Details (9.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-0686

Release Date: 2022-02-20

Fix Resolution (url-parse): 1.5.8

Direct dependency fix Resolution (webpack-dev-server): 3.11.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-43138

Vulnerable Library - async-2.6.3.tgz

Higher-order functions and common patterns for asynchronous code

Library home page: https://registry.npmjs.org/async/-/async-2.6.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/async/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • portfinder-1.0.25.tgz
      • ❌ async-2.6.3.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

In Async before 2.6.4 and 3.x before 3.2.2, a malicious user can obtain privileges via the mapValues() method, aka lib/internal/iterator.js createObjectIterator prototype pollution.

Publish Date: 2022-04-06

URL: CVE-2021-43138

CVSS 3 Score Details (7.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Local
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-43138

Release Date: 2022-04-06

Fix Resolution (async): 2.6.4

Direct dependency fix Resolution (webpack-dev-server): 3.11.0

⛑️ Automatic Remediation will be attempted for this issue.

WS-2020-0091

Vulnerable Library - http-proxy-1.18.0.tgz

HTTP proxying for the masses

Library home page: https://registry.npmjs.org/http-proxy/-/http-proxy-1.18.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/http-proxy/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • http-proxy-middleware-0.19.1.tgz
      • ❌ http-proxy-1.18.0.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Versions of http-proxy prior to 1.18.1 are vulnerable to Denial of Service. An HTTP request with a long body triggers an ERR_HTTP_HEADERS_SENT unhandled exception that crashes the proxy server. This is only possible when the proxy server sets headers in the proxy request using the proxyReq.setHeader function.

Publish Date: 2020-05-14

URL: WS-2020-0091

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1486

Release Date: 2020-05-14

Fix Resolution (http-proxy): 1.18.1

Direct dependency fix Resolution (webpack-dev-server): 3.11.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-25883

Vulnerable Libraries - semver-6.3.0.tgz, semver-5.7.1.tgz

semver-6.3.0.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-6.3.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/webpack-dev-server/node_modules/semver/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • ❌ semver-6.3.0.tgz (Vulnerable Library)

semver-5.7.1.tgz

The semantic version parser used by npm.

Library home page: https://registry.npmjs.org/semver/-/semver-5.7.1.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/semver/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • yargs-12.0.5.tgz
      • os-locale-3.1.0.tgz
        • execa-1.0.0.tgz
          • cross-spawn-6.0.5.tgz
            • ❌ semver-5.7.1.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Versions of the package semver before 7.5.2 are vulnerable to Regular Expression Denial of Service (ReDoS) via the function new Range, when untrusted user data is provided as a range.

Publish Date: 2023-06-21

URL: CVE-2022-25883

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-c2qf-rxjj-qqgw

Release Date: 2023-06-21

Fix Resolution (semver): 6.3.1

Direct dependency fix Resolution (webpack-dev-server): 4.0.0

Fix Resolution (semver): 6.3.1

Direct dependency fix Resolution (webpack-dev-server): 4.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24999

Vulnerable Library - qs-6.7.0.tgz

A querystring parser that supports nesting and arrays, with a depth limit

Library home page: https://registry.npmjs.org/qs/-/qs-6.7.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/qs/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • express-4.17.1.tgz
      • ❌ qs-6.7.0.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

qs before 6.10.3, as used in Express before 4.17.3 and other products, allows attackers to cause a Node process hang for an Express application because an __ proto__ key can be used. In many typical Express use cases, an unauthenticated remote attacker can place the attack payload in the query string of the URL that is used to visit the application, such as a[proto]=b&a[proto]&a[length]=100000000. The fix was backported to qs 6.9.7, 6.8.3, 6.7.3, 6.6.1, 6.5.3, 6.4.1, 6.3.3, and 6.2.4 (and therefore Express 4.17.3, which has "deps: [email protected]" in its release description, is not vulnerable).

Publish Date: 2022-11-26

URL: CVE-2022-24999

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2022-24999

Release Date: 2022-11-26

Fix Resolution (qs): 6.7.3

Direct dependency fix Resolution (webpack-dev-server): 3.11.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24772

Vulnerable Library - node-forge-0.9.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.9.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • selfsigned-1.10.7.tgz
      • ❌ node-forge-0.9.0.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code does not check for tailing garbage bytes after decoding a DigestInfo ASN.1 structure. This can allow padding bytes to be removed and garbage data added to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24772

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24772

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (webpack-dev-server): 4.7.3

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2022-24771

Vulnerable Library - node-forge-0.9.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.9.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • selfsigned-1.10.7.tgz
      • ❌ node-forge-0.9.0.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Forge (also called node-forge) is a native implementation of Transport Layer Security in JavaScript. Prior to version 1.3.0, RSA PKCS#1 v1.5 signature verification code is lenient in checking the digest algorithm structure. This can allow a crafted structure that steals padding bytes and uses unchecked portion of the PKCS#1 encoded message to forge a signature when a low public exponent is being used. The issue has been addressed in node-forge version 1.3.0. There are currently no known workarounds.

Publish Date: 2022-03-18

URL: CVE-2022-24771

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-24771

Release Date: 2022-03-18

Fix Resolution (node-forge): 1.3.0

Direct dependency fix Resolution (webpack-dev-server): 4.7.3

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-3807

Vulnerable Library - ansi-regex-3.0.0.tgz

Regular expression for matching ANSI escape codes

Library home page: https://registry.npmjs.org/ansi-regex/-/ansi-regex-3.0.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ansi-regex/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • yargs-12.0.5.tgz
      • string-width-2.1.1.tgz
        • strip-ansi-4.0.0.tgz
          • ❌ ansi-regex-3.0.0.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

ansi-regex is vulnerable to Inefficient Regular Expression Complexity

Publish Date: 2021-09-17

URL: CVE-2021-3807

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/5b3cf33b-ede0-4398-9974-800876dfd994/

Release Date: 2021-09-17

Fix Resolution (ansi-regex): 3.0.1

Direct dependency fix Resolution (webpack-dev-server): 3.11.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-23424

Vulnerable Library - ansi-html-0.0.7.tgz

An elegant lib that converts the chalked (ANSI) text to HTML.

Library home page: https://registry.npmjs.org/ansi-html/-/ansi-html-0.0.7.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/ansi-html/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • ❌ ansi-html-0.0.7.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

This affects all versions of package ansi-html. If an attacker provides a malicious string, it will get stuck processing the input for an extremely long time.

Publish Date: 2021-08-18

URL: CVE-2021-23424

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2021-23424

Release Date: 2021-08-18

Fix Resolution (ansi-html): 0.0.8

Direct dependency fix Resolution (webpack-dev-server): 3.11.3

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-7662

Vulnerable Library - websocket-extensions-0.1.3.tgz

Generic extension manager for WebSocket connections

Library home page: https://registry.npmjs.org/websocket-extensions/-/websocket-extensions-0.1.3.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/websocket-extensions/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • sockjs-0.3.19.tgz
      • faye-websocket-0.10.0.tgz
        • websocket-driver-0.7.3.tgz
          • ❌ websocket-extensions-0.1.3.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

websocket-extensions npm module prior to 0.1.4 allows Denial of Service (DoS) via Regex Backtracking. The extension parser may take quadratic time when parsing a header containing an unclosed string parameter value whose content is a repeating two-byte sequence of a backslash and some other character. This could be abused by an attacker to conduct Regex Denial Of Service (ReDoS) on a single-threaded server by providing a malicious payload with the Sec-WebSocket-Extensions header.

Publish Date: 2020-06-02

URL: CVE-2020-7662

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-g78m-2chm-r7qv

Release Date: 2020-06-02

Fix Resolution (websocket-extensions): 0.1.4

Direct dependency fix Resolution (webpack-dev-server): 3.11.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-28469

Vulnerable Library - glob-parent-3.1.0.tgz

Strips glob magic from a string to provide the parent directory path

Library home page: https://registry.npmjs.org/glob-parent/-/glob-parent-3.1.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/glob-parent/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • chokidar-2.1.8.tgz
      • ❌ glob-parent-3.1.0.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

This affects the package glob-parent before 5.1.2. The enclosure regex used to check for strings ending in enclosure containing path separator.

Publish Date: 2021-06-03

URL: CVE-2020-28469

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-28469

Release Date: 2021-06-03

Fix Resolution (glob-parent): 5.1.2

Direct dependency fix Resolution (webpack-dev-server): 4.0.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-8203

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • portfinder-1.0.25.tgz
      • async-2.6.3.tgz
        • ❌ lodash-4.17.15.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Prototype pollution attack when using _.zipObjectDeep in lodash before 4.17.20.

Publish Date: 2020-07-15

URL: CVE-2020-8203

CVSS 3 Score Details (7.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.npmjs.com/advisories/1523

Release Date: 2020-07-15

Fix Resolution (lodash): 4.17.19

Direct dependency fix Resolution (webpack-dev-server): 3.11.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2020-7720

Vulnerable Library - node-forge-0.9.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.9.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • selfsigned-1.10.7.tgz
      • ❌ node-forge-0.9.0.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

The package node-forge before 0.10.0 is vulnerable to Prototype Pollution via the util.setPath function. Note: Version 0.10.0 is a breaking change removing the vulnerable functions.

Publish Date: 2020-09-01

URL: CVE-2020-7720

CVSS 3 Score Details (7.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-09-01

Fix Resolution (node-forge): 0.10.0

Direct dependency fix Resolution (webpack-dev-server): 3.11.0

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2021-23337

Vulnerable Library - lodash-4.17.15.tgz

Lodash modular utilities.

Library home page: https://registry.npmjs.org/lodash/-/lodash-4.17.15.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/lodash/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • portfinder-1.0.25.tgz
      • async-2.6.3.tgz
        • ❌ lodash-4.17.15.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Lodash versions prior to 4.17.21 are vulnerable to Command Injection via the template function.

Publish Date: 2021-02-15

URL: CVE-2021-23337

CVSS 3 Score Details (7.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-35jh-r3h4-6jhm

Release Date: 2021-02-15

Fix Resolution (lodash): 4.17.21

Direct dependency fix Resolution (webpack-dev-server): 3.11.0

⛑️ Automatic Remediation will be attempted for this issue.

WS-2022-0008

Vulnerable Library - node-forge-0.9.0.tgz

JavaScript implementations of network transports, cryptography, ciphers, PKI, message digests, and various utilities.

Library home page: https://registry.npmjs.org/node-forge/-/node-forge-0.9.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/node-forge/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • selfsigned-1.10.7.tgz
      • ❌ node-forge-0.9.0.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

The forge.debug API had a potential prototype pollution issue if called with untrusted input. The API was only used for internal debug purposes in a safe way and never documented or advertised. It is suspected that uses of this API, if any exist, would likely not have used untrusted inputs in a vulnerable way.

Publish Date: 2022-01-08

URL: WS-2022-0008

CVSS 3 Score Details (6.6)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: High
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5rrq-pxf6-6jx5

Release Date: 2022-01-08

Fix Resolution (node-forge): 1.0.0

Direct dependency fix Resolution (webpack-dev-server): 4.7.3

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-28849

Vulnerable Library - follow-redirects-1.10.0.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • http-proxy-middleware-0.19.1.tgz
      • http-proxy-1.18.0.tgz
        • ❌ follow-redirects-1.10.0.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

follow-redirects is an open source, drop-in replacement for Node's http and https modules that automatically follows redirects. In affected versions follow-redirects only clears authorization header during cross-domain redirect, but keep the proxy-authentication header which contains credentials too. This vulnerability may lead to credentials leak, but has been addressed in version 1.15.6. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Publish Date: 2024-03-14

URL: CVE-2024-28849

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cxjh-pqwp-8mfp

Release Date: 2024-03-14

Fix Resolution: follow-redirects - 1.15.6

CVE-2022-0155

Vulnerable Library - follow-redirects-1.10.0.tgz

HTTP and HTTPS modules that follow redirects.

Library home page: https://registry.npmjs.org/follow-redirects/-/follow-redirects-1.10.0.tgz

Path to dependency file: /package.json

Path to vulnerable library: /node_modules/follow-redirects/package.json

Dependency Hierarchy:

  • webpack-dev-server-3.10.3.tgz (Root Library)
    • http-proxy-middleware-0.19.1.tgz
      • http-proxy-1.18.0.tgz
        • ❌ follow-redirects-1.10.0.tgz (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

follow-redirects is vulnerable to Exposure of Private Personal Information to an Unauthorized Actor

Publish Date: 2022-01-10

URL: CVE-2022-0155

CVSS 3 Score Details (6.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://huntr.dev/bounties/fc524e4b-ebb6-427d-ab67-a64181020406/

Release Date: 2022-01-10

Fix Resolution (follow-redirects): 1.14.7

Direct dependency fix Resolution (webpack-dev-server): 3.11.0

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

rspec-rails-5.0.1.gem: 16 vulnerabilities (highest severity is: 8.8) - autoclosed

Vulnerable Library - rspec-rails-5.0.1.gem

Path to dependency file: /Gemfile.lock

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (rspec-rails version) Remediation Available
WS-2022-0089 High 8.8 nokogiri-1.11.3-x86_64-darwin.gem Transitive N/A* ❌
CVE-2022-29181 High 8.2 nokogiri-1.11.3-x86_64-darwin.gem Transitive N/A* ❌
CVE-2021-22885 High 7.5 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2022-24836 High 7.5 nokogiri-1.11.3-x86_64-darwin.gem Transitive N/A* ❌
CVE-2021-22902 High 7.5 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2021-41098 High 7.5 nokogiri-1.11.3-x86_64-darwin.gem Transitive N/A* ❌
CVE-2021-22904 High 7.5 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2021-22942 Medium 6.1 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2021-22903 Medium 6.1 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2022-22577 Medium 6.1 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2022-27777 Medium 6.1 actionview-6.1.3.1.gem Transitive N/A* ❌
CVE-2021-44528 Medium 6.1 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2022-32209 Medium 6.1 rails-html-sanitizer-1.3.0.gem Transitive N/A* ❌
CVE-2022-23634 Medium 5.9 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2022-23633 Medium 5.9 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2022-3704 Medium 5.4 actionpack-6.1.3.1.gem Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

WS-2022-0089

Vulnerable Library - nokogiri-1.11.3-x86_64-darwin.gem

Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for reading, writing, modifying, and querying documents. It is fast and standards-compliant by relying on native parsers like libxml2 (C) and xerces (Java).

Library home page: https://rubygems.org/gems/nokogiri-1.11.3-x86_64-darwin.gem

Dependency Hierarchy:

  • rspec-rails-5.0.1.gem (Root Library)
    • actionpack-6.1.3.1.gem
      • actionview-6.1.3.1.gem
        • rails-dom-testing-2.0.3.gem
          • ❌ nokogiri-1.11.3-x86_64-darwin.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Nokogiri before version 1.13.2 is vulnerable.

Publish Date: 2022-03-01

URL: WS-2022-0089

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-fq42-c5rg-92c2

Release Date: 2022-03-01

Fix Resolution: nokogiri - v1.13.2

CVE-2022-29181

Vulnerable Library - nokogiri-1.11.3-x86_64-darwin.gem

Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for reading, writing, modifying, and querying documents. It is fast and standards-compliant by relying on native parsers like libxml2 (C) and xerces (Java).

Library home page: https://rubygems.org/gems/nokogiri-1.11.3-x86_64-darwin.gem

Dependency Hierarchy:

  • rspec-rails-5.0.1.gem (Root Library)
    • actionpack-6.1.3.1.gem
      • actionview-6.1.3.1.gem
        • rails-dom-testing-2.0.3.gem
          • ❌ nokogiri-1.11.3-x86_64-darwin.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a String by calling #to_s or equivalent.

Publish Date: 2022-05-20

URL: CVE-2022-29181

CVSS 3 Score Details (8.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29181

Release Date: 2022-05-20

Fix Resolution: nokogiri - 1.13.6

CVE-2021-22885

Vulnerable Library - actionpack-6.1.3.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-6.1.3.1.gem

Dependency Hierarchy:

  • rspec-rails-5.0.1.gem (Root Library)
    • ❌ actionpack-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A possible information disclosure / unintended method execution vulnerability in Action Pack >= 2.0.0 when using the redirect_to or polymorphic_urlhelper with untrusted user input.

Publish Date: 2021-05-27

URL: CVE-2021-22885

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hjg4-8q5f-x6fm

Release Date: 2021-05-27

Fix Resolution: actionpack - 5.2.4.6,5.2.6,6.0.3.7,6.1.3.2

CVE-2022-24836

Vulnerable Library - nokogiri-1.11.3-x86_64-darwin.gem

Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for reading, writing, modifying, and querying documents. It is fast and standards-compliant by relying on native parsers like libxml2 (C) and xerces (Java).

Library home page: https://rubygems.org/gems/nokogiri-1.11.3-x86_64-darwin.gem

Dependency Hierarchy:

  • rspec-rails-5.0.1.gem (Root Library)
    • actionpack-6.1.3.1.gem
      • actionview-6.1.3.1.gem
        • rails-dom-testing-2.0.3.gem
          • ❌ nokogiri-1.11.3-x86_64-darwin.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri < v1.13.4 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri >= 1.13.4. There are no known workarounds for this issue.

Publish Date: 2022-04-11

URL: CVE-2022-24836

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-crjr-9rc5-ghw8

Release Date: 2022-04-11

Fix Resolution: nokogiri - 1.13.4

CVE-2021-22902

Vulnerable Library - actionpack-6.1.3.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-6.1.3.1.gem

Dependency Hierarchy:

  • rspec-rails-5.0.1.gem (Root Library)
    • ❌ actionpack-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

The actionpack ruby gem (a framework for handling and responding to web requests in Rails) before 6.0.3.7, 6.1.3.2 suffers from a possible denial of service vulnerability in the Mime type parser of Action Dispatch. Carefully crafted Accept headers can cause the mime type parser in Action Dispatch to do catastrophic backtracking in the regular expression engine.

Publish Date: 2021-06-11

URL: CVE-2021-22902

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-06-11

Fix Resolution: actionpack - 6.0.3.7,6.1.3.2

CVE-2021-41098

Vulnerable Library - nokogiri-1.11.3-x86_64-darwin.gem

Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for reading, writing, modifying, and querying documents. It is fast and standards-compliant by relying on native parsers like libxml2 (C) and xerces (Java).

Library home page: https://rubygems.org/gems/nokogiri-1.11.3-x86_64-darwin.gem

Dependency Hierarchy:

  • rspec-rails-5.0.1.gem (Root Library)
    • actionpack-6.1.3.1.gem
      • actionview-6.1.3.1.gem
        • rails-dom-testing-2.0.3.gem
          • ❌ nokogiri-1.11.3-x86_64-darwin.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Nokogiri is a Rubygem providing HTML, XML, SAX, and Reader parsers with XPath and CSS selector support. In Nokogiri v1.12.4 and earlier, on JRuby only, the SAX parser resolves external entities by default. Users of Nokogiri on JRuby who parse untrusted documents using any of these classes are affected: Nokogiri::XML::SAX::Parse, Nokogiri::HTML4::SAX::Parser or its alias Nokogiri::HTML::SAX::Parser, Nokogiri::XML::SAX::PushParser, and Nokogiri::HTML4::SAX::PushParser or its alias Nokogiri::HTML::SAX::PushParser. JRuby users should upgrade to Nokogiri v1.12.5 or later to receive a patch for this issue. There are no workarounds available for v1.12.4 or earlier. CRuby users are not affected.

Publish Date: 2021-09-27

URL: CVE-2021-41098

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-41098

Release Date: 2021-09-27

Fix Resolution: nokogiri - 1.12.5

CVE-2021-22904

Vulnerable Library - actionpack-6.1.3.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-6.1.3.1.gem

Dependency Hierarchy:

  • rspec-rails-5.0.1.gem (Root Library)
    • ❌ actionpack-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

The actionpack ruby gem before 6.1.3.2, 6.0.3.7, 5.2.4.6, 5.2.6 suffers from a possible denial of service vulnerability in the Token Authentication logic in Action Controller due to a too permissive regular expression. Impacted code uses authenticate_or_request_with_http_token or authenticate_with_http_token for request authentication.

Publish Date: 2021-06-11

URL: CVE-2021-22904

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-06-11

Fix Resolution: actionpack - 5.2.4.6,5.2.6,6.0.3.7,6.1.3.2

CVE-2021-22942

Vulnerable Library - actionpack-6.1.3.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-6.1.3.1.gem

Dependency Hierarchy:

  • rspec-rails-5.0.1.gem (Root Library)
    • ❌ actionpack-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A possible open redirect vulnerability in the Host Authorization middleware in Action Pack >= 6.0.0 that could allow attackers to redirect users to a malicious website.

Publish Date: 2021-10-18

URL: CVE-2021-22942

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=2021-22942

Release Date: 2021-10-18

Fix Resolution: actionpack - 6.0.4.1,6.1.4.1

CVE-2021-22903

Vulnerable Library - actionpack-6.1.3.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-6.1.3.1.gem

Dependency Hierarchy:

  • rspec-rails-5.0.1.gem (Root Library)
    • ❌ actionpack-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

The actionpack ruby gem before 6.1.3.2 suffers from a possible open redirect vulnerability. Specially crafted Host headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website. This is similar to CVE-2021-22881. Strings in config.hosts that do not have a leading dot are converted to regular expressions without proper escaping. This causes, for example, config.hosts << "sub.example.com" to permit a request with a Host header value of sub-example.com.

Publish Date: 2021-06-11

URL: CVE-2021-22903

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-06-11

Fix Resolution: actionpack - 6.1.3.2

CVE-2022-22577

Vulnerable Library - actionpack-6.1.3.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-6.1.3.1.gem

Dependency Hierarchy:

  • rspec-rails-5.0.1.gem (Root Library)
    • ❌ actionpack-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

An XSS Vulnerability in Action Pack >= 5.2.0 and < 5.2.0 that could allow an attacker to bypass CSP for non HTML like responses.

Publish Date: 2022-05-26

URL: CVE-2022-22577

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-mm33-5vfq-3mm3

Release Date: 2022-05-26

Fix Resolution: actionpack - 5.2.7.1,6.0.4.8,6.1.5.1,7.0.2.4

CVE-2022-27777

Vulnerable Library - actionview-6.1.3.1.gem

Simple, battle-tested conventions and helpers for building web pages.

Library home page: https://rubygems.org/gems/actionview-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionview-6.1.3.1.gem

Dependency Hierarchy:

  • rspec-rails-5.0.1.gem (Root Library)
    • actionpack-6.1.3.1.gem
      • ❌ actionview-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A XSS Vulnerability in Action View tag helpers >= 5.2.0 and < 5.2.0 which would allow an attacker to inject content if able to control input into specific attributes.

Publish Date: 2022-05-26

URL: CVE-2022-27777

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-ch3h-j2vf-95pv

Release Date: 2022-05-26

Fix Resolution: actionview - 5.2.7.1,6.0.4.8,6.1.5.1,7.0.2.4

CVE-2021-44528

Vulnerable Library - actionpack-6.1.3.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-6.1.3.1.gem

Dependency Hierarchy:

  • rspec-rails-5.0.1.gem (Root Library)
    • ❌ actionpack-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A open redirect vulnerability exists in Action Pack >= 6.0.0 that could allow an attacker to craft a "X-Forwarded-Host" headers in combination with certain "allowed host" formats can cause the Host Authorization middleware in Action Pack to redirect users to a malicious website.

Publish Date: 2022-01-10

URL: CVE-2021-44528

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-qphc-hf5q-v8fc

Release Date: 2022-01-10

Fix Resolution: actionpack - 6.0.4.2,6.1.4.2

CVE-2022-32209

Vulnerable Library - rails-html-sanitizer-1.3.0.gem

HTML sanitization for Rails applications

Library home page: https://rubygems.org/gems/rails-html-sanitizer-1.3.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rails-html-sanitizer-1.3.0.gem

Dependency Hierarchy:

  • rspec-rails-5.0.1.gem (Root Library)
    • actionpack-6.1.3.1.gem
      • ❌ rails-html-sanitizer-1.3.0.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Possible XSS Vulnerability in Rails::Html::SanitizerThere is a possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer.This vulnerability has been assigned the CVE identifier CVE-2022-32209.Versions Affected: ALLNot affected: NONEFixed Versions: v1.4.3## ImpactA possible XSS vulnerability with certain configurations of Rails::Html::Sanitizer may allow an attacker to inject content if the application developer has overridden the sanitizer's allowed tags to allow both select and style elements.Code is only impacted if allowed tags are being overridden. This may be done via application configuration:ruby# In config/application.rbconfig.action_view.sanitized_allowed_tags = ["select", "style"]see https://guides.rubyonrails.org/configuring.html#configuring-action-viewOr it may be done with a :tags option to the Action View helper sanitize:<%= sanitize @comment.body, tags: ["select", "style"] %>see https://api.rubyonrails.org/classes/ActionView/Helpers/SanitizeHelper.html#method-i-sanitizeOr it may be done with Rails::Html::SafeListSanitizer directly:ruby# class-level optionRails::Html::SafeListSanitizer.allowed_tags = ["select", "style"]orruby# instance-level optionRails::Html::SafeListSanitizer.new.sanitize(@article.body, tags: ["select", "style"])All users overriding the allowed tags by any of the above mechanisms to include both "select" and "style" should either upgrade or use one of the workarounds immediately.## ReleasesThe FIXED releases are available at the normal locations.## WorkaroundsRemove either select or style from the overridden allowed tags.## CreditsThis vulnerability was responsibly reported by windshock.

Publish Date: 2022-06-24

URL: CVE-2022-32209

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://discuss.rubyonrails.org/t/cve-2022-32209-possible-xss-vulnerability-in-rails-sanitizer/80800

Release Date: 2022-06-24

Fix Resolution: rails-html-sanitizer - 1.4.3

CVE-2022-23634

Vulnerable Library - actionpack-6.1.3.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-6.1.3.1.gem

Dependency Hierarchy:

  • rspec-rails-5.0.1.gem (Root Library)
    • ❌ actionpack-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Puma is a Ruby/Rack web server built for parallelism. Prior to puma version 5.6.2, puma may not always call close on the response body. Rails, prior to version 7.0.2.2, depended on the response body being closed in order for its CurrentAttributes implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails or Puma version fixes the vulnerability.

Publish Date: 2022-02-11

URL: CVE-2022-23634

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wh98-p28r-vrc9

Release Date: 2022-02-11

Fix Resolution: puma - 4.3.11, 5.6.2; actionpack - 5.2.6.2, 6.0.4.6, 6.1.4.6, 7.0.2.2

CVE-2022-23633

Vulnerable Library - actionpack-6.1.3.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-6.1.3.1.gem

Dependency Hierarchy:

  • rspec-rails-5.0.1.gem (Root Library)
    • ❌ actionpack-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Action Pack is a framework for handling and responding to web requests. Under certain circumstances response bodies will not be closed. In the event a response is not notified of a close, ActionDispatch::Executor will not know to reset thread local state for the next request. This can lead to data being leaked to subsequent requests.This has been fixed in Rails 7.0.2.1, 6.1.4.5, 6.0.4.5, and 5.2.6.1. Upgrading is highly recommended, but to work around this problem a middleware described in GHSA-wh98-p28r-vrc9 can be used.

Publish Date: 2022-02-11

URL: CVE-2022-23633

CVSS 3 Score Details (5.9)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: High
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wh98-p28r-vrc9

Release Date: 2022-02-11

Fix Resolution: 5.2.6.2, 6.0.4.6, 6.1.4.6, 7.0.2.2

CVE-2022-3704

Vulnerable Library - actionpack-6.1.3.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-6.1.3.1.gem

Dependency Hierarchy:

  • rspec-rails-5.0.1.gem (Root Library)
    • ❌ actionpack-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A vulnerability classified as problematic has been found in Ruby on Rails. This affects an unknown part of the file actionpack/lib/action_dispatch/middleware/templates/routes/_table.html.erb. The manipulation leads to cross site scripting. It is possible to initiate the attack remotely. The name of the patch is be177e4566747b73ff63fd5f529fab564e475ed4. It is recommended to apply a patch to fix this issue. The associated identifier of this vulnerability is VDB-212319.

Publish Date: 2022-10-26

URL: CVE-2022-3704

CVSS 3 Score Details (5.4)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

image_processing-1.9.3.gem: 1 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - image_processing-1.9.3.gem

Set of higher-level helper methods for image processing.

Library home page: https://rubygems.org/gems/image_processing-1.9.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /2.7.0/cache/image_processing-1.9.3.gem

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (image_processing version) Remediation Possible**
CVE-2022-24720 Critical 9.8 image_processing-1.9.3.gem Direct image_processing - v1.12.2 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-24720

Vulnerable Library - image_processing-1.9.3.gem

Set of higher-level helper methods for image processing.

Library home page: https://rubygems.org/gems/image_processing-1.9.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /2.7.0/cache/image_processing-1.9.3.gem

Dependency Hierarchy:

  • ❌ image_processing-1.9.3.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

image_processing is an image processing wrapper for libvips and ImageMagick/GraphicsMagick. Prior to version 1.12.2, using the #apply method from image_processing to apply a series of operations that are coming from unsanitized user input allows the attacker to execute shell commands. This method is called internally by Active Storage variants, so Active Storage is vulnerable as well. The vulnerability has been fixed in version 1.12.2 of image_processing. As a workaround, users who process based on user input should always sanitize the user input by allowing only a constrained set of operations.

Publish Date: 2022-03-01

URL: CVE-2022-24720

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-cxf7-qrc5-9446

Release Date: 2022-03-01

Fix Resolution: image_processing - v1.12.2

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

active_storage_validations-0.8.9.gem: 44 vulnerabilities (highest severity is: 10.0)

Vulnerable Library - active_storage_validations-0.8.9.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /Gemfile.lock

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (active_storage_validations version) Remediation Possible**
CVE-2022-30123 Critical 10.0 rack-2.2.3.gem Transitive N/A* ❌
CVE-2022-32224 Critical 9.8 activerecord-6.1.3.1.gem Transitive N/A* ❌
CVE-2022-21831 Critical 9.8 activestorage-6.1.3.1.gem Transitive N/A* ❌
WS-2022-0089 High 8.8 nokogiri-1.11.3-x86_64-darwin.gem Transitive N/A* ❌
CVE-2023-22794 High 8.8 activerecord-6.1.3.1.gem Transitive N/A* ❌
CVE-2022-29181 High 8.2 nokogiri-1.11.3-x86_64-darwin.gem Transitive N/A* ❌
WS-2023-0224 High 7.5 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2023-27539 High 7.5 rack-2.2.3.gem Transitive N/A* ❌
CVE-2023-27530 High 7.5 rack-2.2.3.gem Transitive N/A* ❌
CVE-2023-22799 High 7.5 globalid-0.4.2.gem Transitive N/A* ❌
CVE-2023-22796 High 7.5 activesupport-6.1.3.1.gem Transitive N/A* ❌
CVE-2023-22795 High 7.5 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2023-22792 High 7.5 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2022-44572 High 7.5 rack-2.2.3.gem Transitive N/A* ❌
CVE-2022-44571 High 7.5 rack-2.2.3.gem Transitive N/A* ❌
CVE-2022-44570 High 7.5 rack-2.2.3.gem Transitive N/A* ❌
CVE-2022-44566 High 7.5 activerecord-6.1.3.1.gem Transitive N/A* ❌
CVE-2022-30122 High 7.5 rack-2.2.3.gem Transitive N/A* ❌
CVE-2022-24836 High 7.5 nokogiri-1.11.3-x86_64-darwin.gem Transitive N/A* ❌
CVE-2022-23517 High 7.5 rails-html-sanitizer-1.3.0.gem Transitive N/A* ❌
CVE-2022-23516 High 7.5 loofah-2.9.1.gem Transitive N/A* ❌
CVE-2022-23514 High 7.5 loofah-2.9.1.gem Transitive N/A* ❌
CVE-2021-41098 High 7.5 nokogiri-1.11.3-x86_64-darwin.gem Transitive N/A* ❌
CVE-2021-22904 High 7.5 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2021-22902 High 7.5 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2021-22885 High 7.5 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2023-28362 Medium 6.1 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2022-32209 Medium 6.1 rails-html-sanitizer-1.3.0.gem Transitive N/A* ❌
CVE-2022-27777 Medium 6.1 actionview-6.1.3.1.gem Transitive N/A* ❌
CVE-2022-23520 Medium 6.1 rails-html-sanitizer-1.3.0.gem Transitive N/A* ❌
CVE-2022-23519 Medium 6.1 rails-html-sanitizer-1.3.0.gem Transitive N/A* ❌
CVE-2022-23518 Medium 6.1 rails-html-sanitizer-1.3.0.gem Transitive N/A* ❌
CVE-2022-23515 Medium 6.1 loofah-2.9.1.gem Transitive N/A* ❌
CVE-2022-22577 Medium 6.1 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2021-44528 Medium 6.1 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2021-22942 Medium 6.1 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2021-22903 Medium 6.1 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2022-23634 Medium 5.9 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2022-23633 Medium 5.9 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2024-26141 Medium 5.8 rack-2.2.3.gem Transitive N/A* ❌
CVE-2022-3704 Medium 5.4 actionpack-6.1.3.1.gem Transitive N/A* ❌
CVE-2024-26146 Medium 5.3 rack-2.2.3.gem Transitive N/A* ❌
CVE-2024-25126 Medium 5.3 rack-2.2.3.gem Transitive N/A* ❌
CVE-2023-38037 Medium 4.3 activesupport-6.1.3.1.gem Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

Partial details (21 vulnerabilities) are displayed below due to a content size limitation in GitHub. To view information on the remaining vulnerabilities, navigate to the Mend Application.

CVE-2022-30123

Vulnerable Library - rack-2.2.3.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.3.gem

Dependency Hierarchy:

  • active_storage_validations-0.8.9.gem (Root Library)
    • rails-6.1.3.1.gem
      • activestorage-6.1.3.1.gem
        • actionpack-6.1.3.1.gem
          • ❌ rack-2.2.3.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.

Publish Date: 2022-12-05

URL: CVE-2022-30123

CVSS 3 Score Details (10.0)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wq4h-7r42-5hrr

Release Date: 2022-12-05

Fix Resolution: rack - 2.0.9.1,2.1.4.1,2.2.3.1

CVE-2022-32224

Vulnerable Library - activerecord-6.1.3.1.gem

Databases on Rails. Build a persistent domain model by mapping database tables to Ruby classes. Strong conventions for associations, validations, aggregations, migrations, and testing come baked-in.

Library home page: https://rubygems.org/gems/activerecord-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/activerecord-6.1.3.1.gem

Dependency Hierarchy:

  • active_storage_validations-0.8.9.gem (Root Library)
    • rails-6.1.3.1.gem
      • ❌ activerecord-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A possible escalation to RCE vulnerability exists when using YAML serialized columns in Active Record < 7.0.3.1, <6.1.6.1, <6.0.5.1 and <5.2.8.1 which could allow an attacker, that can manipulate data in the database (via means like SQL injection), the ability to escalate to an RCE.

Publish Date: 2022-12-05

URL: CVE-2022-32224

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3hhc-qp5v-9p2j

Release Date: 2022-12-05

Fix Resolution: activerecord - 5.2.8.1,6.0.5.1,6.1.6.1,7.0.3.1

CVE-2022-21831

Vulnerable Library - activestorage-6.1.3.1.gem

Attach cloud and local files in Rails applications.

Library home page: https://rubygems.org/gems/activestorage-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/activestorage-6.1.3.1.gem

Dependency Hierarchy:

  • active_storage_validations-0.8.9.gem (Root Library)
    • rails-6.1.3.1.gem
      • ❌ activestorage-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A code injection vulnerability exists in the Active Storage >= v5.2.0 that could allow an attacker to execute code via image_processing arguments.

Publish Date: 2022-05-26

URL: CVE-2022-21831

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-w749-p3v6-hccq

Release Date: 2022-05-26

Fix Resolution: activestorage - 5.2.6.3,6.0.4.7,6.1.4.7,7.0.2.3

WS-2022-0089

Vulnerable Library - nokogiri-1.11.3-x86_64-darwin.gem

Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for reading, writing, modifying, and querying documents. It is fast and standards-compliant by relying on native parsers like libxml2 (C) and xerces (Java).

Library home page: https://rubygems.org/gems/nokogiri-1.11.3-x86_64-darwin.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /Gemfile.lock

Dependency Hierarchy:

  • active_storage_validations-0.8.9.gem (Root Library)
    • rails-6.1.3.1.gem
      • activestorage-6.1.3.1.gem
        • actionpack-6.1.3.1.gem
          • actionview-6.1.3.1.gem
            • rails-dom-testing-2.0.3.gem
              • ❌ nokogiri-1.11.3-x86_64-darwin.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Nokogiri before version 1.13.2 is vulnerable.

Publish Date: 2022-03-01

URL: WS-2022-0089

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-fq42-c5rg-92c2

Release Date: 2022-03-01

Fix Resolution: nokogiri - v1.13.2

CVE-2023-22794

Vulnerable Library - activerecord-6.1.3.1.gem

Databases on Rails. Build a persistent domain model by mapping database tables to Ruby classes. Strong conventions for associations, validations, aggregations, migrations, and testing come baked-in.

Library home page: https://rubygems.org/gems/activerecord-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/activerecord-6.1.3.1.gem

Dependency Hierarchy:

  • active_storage_validations-0.8.9.gem (Root Library)
    • rails-6.1.3.1.gem
      • ❌ activerecord-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A vulnerability in ActiveRecord <6.0.6.1, v6.1.7.1 and v7.0.4.1 related to the sanitization of comments. If malicious user input is passed to either the annotate query method, the optimizer_hints query method, or through the QueryLogs interface which automatically adds annotations, it may be sent to the database withinsufficient sanitization and be able to inject SQL outside of the comment.

Publish Date: 2023-02-09

URL: CVE-2023-22794

CVSS 3 Score Details (8.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: Low
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hq7p-j377-6v63

Release Date: 2023-02-09

Fix Resolution: activerecord - 6.0.6.1,6.1.7.1,7.0.4.1

CVE-2022-29181

Vulnerable Library - nokogiri-1.11.3-x86_64-darwin.gem

Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for reading, writing, modifying, and querying documents. It is fast and standards-compliant by relying on native parsers like libxml2 (C) and xerces (Java).

Library home page: https://rubygems.org/gems/nokogiri-1.11.3-x86_64-darwin.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /Gemfile.lock

Dependency Hierarchy:

  • active_storage_validations-0.8.9.gem (Root Library)
    • rails-6.1.3.1.gem
      • activestorage-6.1.3.1.gem
        • actionpack-6.1.3.1.gem
          • actionview-6.1.3.1.gem
            • rails-dom-testing-2.0.3.gem
              • ❌ nokogiri-1.11.3-x86_64-darwin.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri prior to version 1.13.6 does not type-check all inputs into the XML and HTML4 SAX parsers, allowing specially crafted untrusted inputs to cause illegal memory access errors (segfault) or reads from unrelated memory. Version 1.13.6 contains a patch for this issue. As a workaround, ensure the untrusted input is a String by calling #to_s or equivalent.

Publish Date: 2022-05-20

URL: CVE-2022-29181

CVSS 3 Score Details (8.2)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-29181

Release Date: 2022-05-20

Fix Resolution: nokogiri - 1.13.6

WS-2023-0224

Vulnerable Library - actionpack-6.1.3.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-6.1.3.1.gem

Dependency Hierarchy:

  • active_storage_validations-0.8.9.gem (Root Library)
    • rails-6.1.3.1.gem
      • ❌ actionpack-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

In actionpack prior to 6.1.5 there is a Possible DOS in app with crashing exceptions_app.

Publish Date: 2023-06-28

URL: WS-2023-0224

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-06-28

Fix Resolution: actionpack - 6.1.5

CVE-2023-27539

Vulnerable Library - rack-2.2.3.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.3.gem

Dependency Hierarchy:

  • active_storage_validations-0.8.9.gem (Root Library)
    • rails-6.1.3.1.gem
      • activestorage-6.1.3.1.gem
        • actionpack-6.1.3.1.gem
          • ❌ rack-2.2.3.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

There is a denial of service vulnerability in the header parsing component of Rack. Carefully crafted input can cause header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse headers using Rack (virtually all Rails applications) are impacted. The issue is fixed versions 2.2.6.4 and 3.0.6.1

Publish Date: 2023-03-03

URL: CVE-2023-27539

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://discuss.rubyonrails.org/t/cve-2023-27539-possible-denial-of-service-vulnerability-in-racks-header-parsing/82466

Release Date: 2023-03-03

Fix Resolution: rack - 2.2.6.4,3.0.6.1

CVE-2023-27530

Vulnerable Library - rack-2.2.3.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.3.gem

Dependency Hierarchy:

  • active_storage_validations-0.8.9.gem (Root Library)
    • rails-6.1.3.1.gem
      • activestorage-6.1.3.1.gem
        • actionpack-6.1.3.1.gem
          • ❌ rack-2.2.3.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A DoS vulnerability exists in Rack <v3.0.4.2, <v2.2.6.3, <v2.1.4.3 and <v2.0.9.3 within in the Multipart MIME parsing code in which could allow an attacker to craft requests that can be abuse to cause multipart parsing to take longer than expected.

Publish Date: 2023-03-10

URL: CVE-2023-27530

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-03-10

Fix Resolution: rack - 2.0.9.3,2.1.4.3,2.2.6.3,3.0.4.2

CVE-2023-22799

Vulnerable Library - globalid-0.4.2.gem

URIs for your models makes it easy to pass references around.

Library home page: https://rubygems.org/gems/globalid-0.4.2.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/globalid-0.4.2.gem

Dependency Hierarchy:

  • active_storage_validations-0.8.9.gem (Root Library)
    • rails-6.1.3.1.gem
      • activestorage-6.1.3.1.gem
        • activejob-6.1.3.1.gem
          • ❌ globalid-0.4.2.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A ReDoS based DoS vulnerability in the GlobalID <1.0.1 which could allow an attacker supplying a carefully crafted input can cause the regular expression engine to take an unexpected amount of time. All users running an affected release should either upgrade or use one of the workarounds immediately.

Publish Date: 2023-02-09

URL: CVE-2023-22799

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-23c2-gwp5-pxw9

Release Date: 2023-02-09

Fix Resolution: globalid - 1.0.1

CVE-2023-22796

Vulnerable Library - activesupport-6.1.3.1.gem

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.

Library home page: https://rubygems.org/gems/activesupport-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/activesupport-6.1.3.1.gem

Dependency Hierarchy:

  • active_storage_validations-0.8.9.gem (Root Library)
    • rails-6.1.3.1.gem
      • ❌ activesupport-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.

Publish Date: 2023-02-09

URL: CVE-2023-22796

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-j6gc-792m-qgm2

Release Date: 2023-02-09

Fix Resolution: activesupport - 6.1.7.1,7.0.4.1

CVE-2023-22795

Vulnerable Library - actionpack-6.1.3.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-6.1.3.1.gem

Dependency Hierarchy:

  • active_storage_validations-0.8.9.gem (Root Library)
    • rails-6.1.3.1.gem
      • ❌ actionpack-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A regular expression based DoS vulnerability in Action Dispatch <6.1.7.1 and <7.0.4.1 related to the If-None-Match header. A specially crafted HTTP If-None-Match header can cause the regular expression engine to enter a state of catastrophic backtracking, when on a version of Ruby below 3.2.0. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.

Publish Date: 2023-02-09

URL: CVE-2023-22795

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-02-09

Fix Resolution: actionpack - 6.1.7.1, 7.0.4.1

CVE-2023-22792

Vulnerable Library - actionpack-6.1.3.1.gem

Web apps on Rails. Simple, battle-tested conventions for building and testing MVC web applications. Works with any Rack-compatible server.

Library home page: https://rubygems.org/gems/actionpack-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/actionpack-6.1.3.1.gem

Dependency Hierarchy:

  • active_storage_validations-0.8.9.gem (Root Library)
    • rails-6.1.3.1.gem
      • ❌ actionpack-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A regular expression based DoS vulnerability in Action Dispatch <6.0.6.1,< 6.1.7.1, and <7.0.4.1. Specially crafted cookies, in combination with a specially crafted X_FORWARDED_HOST header can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability All users running an affected release should either upgrade or use one of the workarounds immediately.

Publish Date: 2023-02-09

URL: CVE-2023-22792

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2023-02-09

Fix Resolution: actionpack - 6.1.7.1,7.0.4.1

CVE-2022-44572

Vulnerable Library - rack-2.2.3.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.3.gem

Dependency Hierarchy:

  • active_storage_validations-0.8.9.gem (Root Library)
    • rails-6.1.3.1.gem
      • activestorage-6.1.3.1.gem
        • actionpack-6.1.3.1.gem
          • ❌ rack-2.2.3.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A denial of service vulnerability in the multipart parsing component of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1 and 3.0.0.1 could allow an attacker tocraft input that can cause RFC2183 multipart boundary parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse multipart posts using Rack (virtually all Rails applications) are impacted.

Publish Date: 2023-02-09

URL: CVE-2022-44572

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-rqv2-275x-2jq5

Release Date: 2023-02-09

Fix Resolution: rack - 2.0.9.2,2.1.4.2,2.2.6.2,3.0.4.1

CVE-2022-44571

Vulnerable Library - rack-2.2.3.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.3.gem

Dependency Hierarchy:

  • active_storage_validations-0.8.9.gem (Root Library)
    • rails-6.1.3.1.gem
      • activestorage-6.1.3.1.gem
        • actionpack-6.1.3.1.gem
          • ❌ rack-2.2.3.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This could allow an attacker to craft an input that can cause Content-Disposition header parsing in Rackto take an unexpected amount of time, possibly resulting in a denial ofservice attack vector. This header is used typically used in multipartparsing. Any applications that parse multipart posts using Rack (virtuallyall Rails applications) are impacted.

Publish Date: 2023-02-09

URL: CVE-2022-44571

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-93pm-5p5f-3ghx

Release Date: 2023-02-09

Fix Resolution: rack - 2.0.9.2,2.1.4.2,2.2.6.2,3.0.4.1

CVE-2022-44570

Vulnerable Library - rack-2.2.3.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.3.gem

Dependency Hierarchy:

  • active_storage_validations-0.8.9.gem (Root Library)
    • rails-6.1.3.1.gem
      • activestorage-6.1.3.1.gem
        • actionpack-6.1.3.1.gem
          • ❌ rack-2.2.3.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.

Publish Date: 2023-02-09

URL: CVE-2022-44570

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-65f5-mfpf-vfhj

Release Date: 2023-02-09

Fix Resolution: rack - 2.0.9.2,2.1.4.2,2.2.6.2,3.0.4.1

CVE-2022-44566

Vulnerable Library - activerecord-6.1.3.1.gem

Databases on Rails. Build a persistent domain model by mapping database tables to Ruby classes. Strong conventions for associations, validations, aggregations, migrations, and testing come baked-in.

Library home page: https://rubygems.org/gems/activerecord-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/activerecord-6.1.3.1.gem

Dependency Hierarchy:

  • active_storage_validations-0.8.9.gem (Root Library)
    • rails-6.1.3.1.gem
      • ❌ activerecord-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A denial of service vulnerability present in ActiveRecord's PostgreSQL adapter <7.0.4.1 and <6.1.7.1. When a value outside the range for a 64bit signed integer is provided to the PostgreSQL connection adapter, it will treat the target column type as numeric. Comparing integer values against numeric values can result in a slow sequential scan resulting in potential Denial of Service.

Publish Date: 2023-02-09

URL: CVE-2022-44566

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-579w-22j4-4749

Release Date: 2023-02-09

Fix Resolution: activerecord - 6.1.7.1,7.0.4.1

CVE-2022-30122

Vulnerable Library - rack-2.2.3.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.3.gem

Dependency Hierarchy:

  • active_storage_validations-0.8.9.gem (Root Library)
    • rails-6.1.3.1.gem
      • activestorage-6.1.3.1.gem
        • actionpack-6.1.3.1.gem
          • ❌ rack-2.2.3.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.

Publish Date: 2022-12-05

URL: CVE-2022-30122

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hxqx-xwvh-44m2

Release Date: 2022-12-05

Fix Resolution: rack - 2.0.9.1,2.1.4.1,2.2.3.1

CVE-2022-24836

Vulnerable Library - nokogiri-1.11.3-x86_64-darwin.gem

Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for reading, writing, modifying, and querying documents. It is fast and standards-compliant by relying on native parsers like libxml2 (C) and xerces (Java).

Library home page: https://rubygems.org/gems/nokogiri-1.11.3-x86_64-darwin.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /Gemfile.lock

Dependency Hierarchy:

  • active_storage_validations-0.8.9.gem (Root Library)
    • rails-6.1.3.1.gem
      • activestorage-6.1.3.1.gem
        • actionpack-6.1.3.1.gem
          • actionview-6.1.3.1.gem
            • rails-dom-testing-2.0.3.gem
              • ❌ nokogiri-1.11.3-x86_64-darwin.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Nokogiri is an open source XML and HTML library for Ruby. Nokogiri < v1.13.4 contains an inefficient regular expression that is susceptible to excessive backtracking when attempting to detect encoding in HTML documents. Users are advised to upgrade to Nokogiri >= 1.13.4. There are no known workarounds for this issue.

Publish Date: 2022-04-11

URL: CVE-2022-24836

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-crjr-9rc5-ghw8

Release Date: 2022-04-11

Fix Resolution: nokogiri - 1.13.4

CVE-2022-23517

Vulnerable Library - rails-html-sanitizer-1.3.0.gem

HTML sanitization for Rails applications

Library home page: https://rubygems.org/gems/rails-html-sanitizer-1.3.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rails-html-sanitizer-1.3.0.gem

Dependency Hierarchy:

  • active_storage_validations-0.8.9.gem (Root Library)
    • rails-6.1.3.1.gem
      • activestorage-6.1.3.1.gem
        • actionpack-6.1.3.1.gem
          • ❌ rails-html-sanitizer-1.3.0.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

rails-html-sanitizer is responsible for sanitizing HTML fragments in Rails applications. Certain configurations of rails-html-sanitizer < 1.4.4 use an inefficient regular expression that is susceptible to excessive backtracking when attempting to sanitize certain SVG attributes. This may lead to a denial of service through CPU resource consumption. This issue has been patched in version 1.4.4.

Publish Date: 2022-12-14

URL: CVE-2022-23517

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5x79-w82f-gw8w

Release Date: 2022-12-14

Fix Resolution: rails-html-sanitizer - 1.4.4

CVE-2022-23516

Vulnerable Library - loofah-2.9.1.gem

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri.

Loofah excels at HTML sanitization (XSS prevention). It includes some nice HTML sanitizers, which are based on HTML5lib's safelist, so it most likely won't make your codes less secure. (These statements have not been evaluated by Netexperts.)

ActiveRecord extensions for sanitization are available in the loofah-activerecord gem.

Library home page: https://rubygems.org/gems/loofah-2.9.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/loofah-2.9.1.gem

Dependency Hierarchy:

  • active_storage_validations-0.8.9.gem (Root Library)
    • rails-6.1.3.1.gem
      • activestorage-6.1.3.1.gem
        • actionpack-6.1.3.1.gem
          • actionview-6.1.3.1.gem
            • rails-html-sanitizer-1.3.0.gem
              • ❌ loofah-2.9.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Loofah is a general library for manipulating and transforming HTML/XML documents and fragments, built on top of Nokogiri. Loofah >= 2.2.0, < 2.19.1 uses recursion for sanitizing CDATA sections, making it susceptible to stack exhaustion and raising a SystemStackError exception. This may lead to a denial of service through CPU resource consumption. This issue is patched in version 2.19.1. Users who are unable to upgrade may be able to mitigate this vulnerability by limiting the length of the strings that are sanitized.

Publish Date: 2022-12-14

URL: CVE-2022-23516

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-3x8r-x6xp-q4vm

Release Date: 2022-12-14

Fix Resolution: loofah - 2.19.1

aws-sdk-s3-1.87.0.gem: 1 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - aws-sdk-s3-1.87.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/jmespath-1.4.0.gem

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (aws-sdk-s3 version) Remediation Possible**
CVE-2022-32511 Critical 9.8 jmespath-1.4.0.gem Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-32511

Vulnerable Library - jmespath-1.4.0.gem

Implements JMESPath for Ruby

Library home page: https://rubygems.org/gems/jmespath-1.4.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/jmespath-1.4.0.gem

Dependency Hierarchy:

  • aws-sdk-s3-1.87.0.gem (Root Library)
    • aws-sdk-core-3.114.0.gem
      • ❌ jmespath-1.4.0.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

jmespath.rb (aka JMESPath for Ruby) before 1.6.1 uses JSON.load in a situation where JSON.parse is preferable.

Publish Date: 2022-06-06

URL: CVE-2022-32511

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5c5f-7vfq-3732

Release Date: 2022-06-06

Fix Resolution: jmespath - 1.6.1

rails-6.1.3.1.gem: 3 vulnerabilities (highest severity is: 6.1)

Vulnerable Library - rails-6.1.3.1.gem

Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.

Library home page: https://rubygems.org/gems/rails-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /2.7.0/cache/rails-6.1.3.1.gem

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (rails version) Remediation Possible**
CVE-2023-28120 Medium 6.1 rails-6.1.3.1.gem Direct rails - 6.1.7.3,7.0.4.3 ✅
CVE-2023-23913 Medium 6.1 rails-6.1.3.1.gem Direct rails - 6.1.7.3,7.0.4.3 ✅
CVE-2024-26144 Medium 5.3 rails-6.1.3.1.gem Direct rails - 6.1.7.7,7.0.8.1 ✅

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-28120

Vulnerable Library - rails-6.1.3.1.gem

Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.

Library home page: https://rubygems.org/gems/rails-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /2.7.0/cache/rails-6.1.3.1.gem

Dependency Hierarchy:

  • ❌ rails-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

A Possible XSS Security Vulnerability was discovered in ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input. ActiveSupport if the new bytesplice method is called on a SafeBuffer with untrusted user input. All versions before 6.1.7.3 and 7.x before 7.0.4.3 are affected.

Publish Date: 2023-03-11

URL: CVE-2023-28120

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://discuss.rubyonrails.org/t/cve-2023-28120-possible-xss-security-vulnerability-in-safebuffer-bytesplice/82469

Release Date: 2023-03-11

Fix Resolution: rails - 6.1.7.3,7.0.4.3

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2023-23913

Vulnerable Library - rails-6.1.3.1.gem

Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.

Library home page: https://rubygems.org/gems/rails-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /2.7.0/cache/rails-6.1.3.1.gem

Dependency Hierarchy:

  • ❌ rails-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

There is a potential DOM based cross-site scripting issue in rails-ujs from 5.1.0 before 6.1.7.3 and 7.0.0 before 7.0.4.3, which leverages the Clipboard API to target HTML elements that are assigned the contenteditable attribute. This has the potential to occur when pasting malicious HTML content from the clipboard that includes a data-method, data-remote or data-disable-with attribute.

Publish Date: 2023-01-20

URL: CVE-2023-23913

CVSS 3 Score Details (6.1)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: Required
    • Scope: Changed
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: Low
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://discuss.rubyonrails.org/t/cve-2023-23913-dom-based-cross-site-scripting-in-rails-ujs-for-contenteditable-html-elements/82468

Release Date: 2023-01-20

Fix Resolution: rails - 6.1.7.3,7.0.4.3

⛑️ Automatic Remediation will be attempted for this issue.

CVE-2024-26144

Vulnerable Library - rails-6.1.3.1.gem

Ruby on Rails is a full-stack web framework optimized for programmer happiness and sustainable productivity. It encourages beautiful code by favoring convention over configuration.

Library home page: https://rubygems.org/gems/rails-6.1.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /2.7.0/cache/rails-6.1.3.1.gem

Dependency Hierarchy:

  • ❌ rails-6.1.3.1.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Rails is a web-application framework. Starting with version 5.2.0, there is a possible sensitive session information leak in Active Storage. By default, Active Storage sends a Set-Cookie header along with the user's session cookie when serving blobs. It also sets Cache-Control to public. Certain proxies may cache the Set-Cookie, leading to an information leak. The vulnerability is fixed in 7.0.8.1 and 6.1.7.7.

Publish Date: 2024-02-27

URL: CVE-2024-26144

CVSS 3 Score Details (5.3)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: Low
    • Integrity Impact: None
    • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8h22-8cf7-hq6g

Release Date: 2024-02-27

Fix Resolution: rails - 6.1.7.7,7.0.8.1

⛑️ Automatic Remediation will be attempted for this issue.

⛑️Automatic Remediation will be attempted for this issue.

rack-mini-profiler-2.3.1.gem: 2 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - rack-mini-profiler-2.3.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.3.gem

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (rack-mini-profiler version) Remediation Available
CVE-2022-30123 High 9.8 rack-2.2.3.gem Transitive N/A* ❌
CVE-2022-30122 High 7.5 rack-2.2.3.gem Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the section "Details" below to see if there is a version of transitive dependency where vulnerability is fixed.

Details

CVE-2022-30123

Vulnerable Library - rack-2.2.3.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.3.gem

Dependency Hierarchy:

  • rack-mini-profiler-2.3.1.gem (Root Library)
    • ❌ rack-2.2.3.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

There is a possible shell escape sequence injection vulnerability in the Lint and CommonLogger components of Rack before 2.0.9.1,2.1.4.1,2.2.3.1

Publish Date: 2022-05-03

URL: CVE-2022-30123

CVSS 3 Score Details (9.8)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: High
    • Integrity Impact: High
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wq4h-7r42-5hrr

Release Date: 2022-05-03

Fix Resolution: rack - 2.0.9.1,2.1.4.1,2.2.3.1

CVE-2022-30122

Vulnerable Library - rack-2.2.3.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Library home page: https://rubygems.org/gems/rack-2.2.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rack-2.2.3.gem

Dependency Hierarchy:

  • rack-mini-profiler-2.3.1.gem (Root Library)
    • ❌ rack-2.2.3.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

There is a possible denial of service vulnerability in the multipart parsing component of Rack before 2.0.9.1,2.1.4.1,2.2.3.1

Publish Date: 2022-05-03

URL: CVE-2022-30122

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hxqx-xwvh-44m2

Release Date: 2022-05-03

Fix Resolution: rack - 2.0.9.1,2.1.4.1,2.2.3.1

capybara-3.35.3.gem: 1 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - capybara-3.35.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/addressable-2.7.0.gem

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Vulnerabilities

CVE Severity CVSS Dependency Type Fixed in (capybara version) Remediation Possible**
CVE-2021-32740 High 7.5 addressable-2.7.0.gem Transitive N/A* ❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-32740

Vulnerable Library - addressable-2.7.0.gem

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. It is flexible, offers heuristic parsing, and additionally provides extensive support for IRIs and URI templates.

Library home page: https://rubygems.org/gems/addressable-2.7.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/addressable-2.7.0.gem

Dependency Hierarchy:

  • capybara-3.35.3.gem (Root Library)
    • ❌ addressable-2.7.0.gem (Vulnerable Library)

Found in HEAD commit: 146b2d95d567dbf802911f1c171f94bd51f77a96

Found in base branch: master

Vulnerability Details

Addressable is an alternative implementation to the URI implementation that is part of Ruby's standard library. An uncontrolled resource consumption vulnerability exists after version 2.3.0 through version 2.7.0. Within the URI template implementation in Addressable, a maliciously crafted template may result in uncontrolled resource consumption, leading to denial of service when matched against a URI. In typical usage, templates would not normally be read from untrusted user input, but nonetheless, no previous security advisory for Addressable has cautioned against doing this. Users of the parsing capabilities in Addressable but not the URI template capabilities are unaffected. The vulnerability is patched in version 2.8.0. As a workaround, only create Template objects from trusted sources that have been validated not to produce catastrophic backtracking.

Publish Date: 2021-07-06

URL: CVE-2021-32740

CVSS 3 Score Details (7.5)

Base Score Metrics:

  • Exploitability Metrics:
    • Attack Vector: Network
    • Attack Complexity: Low
    • Privileges Required: None
    • User Interaction: None
    • Scope: Unchanged
  • Impact Metrics:
    • Confidentiality Impact: None
    • Integrity Impact: None
    • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-jxhc-q857-3j6g

Release Date: 2021-07-06

Fix Resolution: addressable - 2.8.0

Recommend Projects

  • React photo React

    A declarative, efficient, and flexible JavaScript library for building user interfaces.

  • Vue.js photo Vue.js

    🖖 Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.

  • Typescript photo Typescript

    TypeScript is a superset of JavaScript that compiles to clean JavaScript output.

  • TensorFlow photo TensorFlow

    An Open Source Machine Learning Framework for Everyone

  • Django photo Django

    The Web framework for perfectionists with deadlines.

  • D3 photo D3

    Bring data to life with SVG, Canvas and HTML. 📊📈🎉

Recommend Topics

  • javascript

    JavaScript (JS) is a lightweight interpreted programming language with first-class functions.

  • web

    Some thing interesting about web. New door for the world.

  • server

    A server is a program made to process requests and deliver data to clients.

  • Machine learning

    Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.

  • Game

    Some thing interesting about game, make everyone happy.

Recommend Org

  • Facebook photo Facebook

    We are working to build community through open source technology. NB: members must have two-factor auth.

  • Microsoft photo Microsoft

    Open source projects and samples from Microsoft.

  • Google photo Google

    Google ❤️ Open Source for everyone.

  • D3 photo D3

    Data-Driven Documents codes.