codywalker77/docs-travis-ci-com

The Travis CI Documentation

About this repository

This is the documentation site for Travis CI! (https://docs.travis-ci.com/)

How to contribute

Fork the repository, read the rest of this README file and make some changes. Once you're done with your changes send a pull request. Thanks!

How to check your edit before sending PR

You can inspect how your edits will be reflected by the documentation site. Either by clicking on the Netlify preview link in your Pull Request or building the docs locally.

Install dependencies

1. Make sure you have Ruby and RubyGems installed.

2. Install bundler:

   $ gem install bundler

3. Install application dependencies:

   $ bundle install --binstubs

Generate documentation

Run

$ ./bin/jekyll build

Run application server

You are now ready to start your documentation site, using Jekyll or Puma. For documentation edits, Jekyll is sufficient.

Starting and inspecting edits with Jekyll

1. Run Jekyll server:

   $ ./bin/jekyll serve

2. Open localhost:4000 in your browser.

Starting and inspecting edits with Puma

For more programmatical PRs (such as handling webhooks notification via POST), Puma is necessary.

1. Run Puma server:

   $ ./bin/puma

2. Open localhost:9292 in your browser.

API V2 documentation

API V2 (and 2.1) documentation is maintained in slate/source and is generated at build time from source.

License

Distributed under the MIT license; the same as other Travis CI projects.

docs-travis-ci-com's Issues

puma-5.5.2.gem: 3 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - puma-5.5.2.gem

Puma is a simple, fast, threaded, and highly parallel HTTP 1.1 server for Ruby/Rack applications. Puma is intended for use in both development and production environments. It's great for highly parallel Ruby implementations such as Rubinius and JRuby as well as as providing process worker support to support CRuby well.

Library home page: https://rubygems.org/gems/puma-5.5.2.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /7.0/cache/puma-5.5.2.gem

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (puma version)	Remediation Possible**
CVE-2023-40175	Critical	9.8	puma-5.5.2.gem	Direct	puma - 5.6.7,6.3.1	❌
CVE-2024-21647	High	7.5	puma-5.5.2.gem	Direct	puma - 5.6.8,6.4.2	❌
CVE-2022-23634	Medium	5.9	puma-5.5.2.gem	Direct	puma - 4.3.11, 5.6.2; actionpack - 5.2.6.2, 6.0.4.6, 6.1.4.6, 7.0.2.2	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2023-40175

Vulnerable Library - puma-5.5.2.gem

Puma is a simple, fast, threaded, and highly parallel HTTP 1.1 server for Ruby/Rack applications. Puma is intended for use in both development and production environments. It's great for highly parallel Ruby implementations such as Rubinius and JRuby as well as as providing process worker support to support CRuby well.

Library home page: https://rubygems.org/gems/puma-5.5.2.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /7.0/cache/puma-5.5.2.gem

Dependency Hierarchy:

• ❌ puma-5.5.2.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

Puma is a Ruby/Rack web server built for parallelism. Prior to versions 6.3.1 and 5.6.7, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies and zero-length Content-Length headers in a way that allowed HTTP request smuggling. Severity of this issue is highly dependent on the nature of the web site using puma is. This could be caused by either incorrect parsing of trailing fields in chunked transfer encoding bodies or by parsing of blank/zero-length Content-Length headers. Both issues have been addressed and this vulnerability has been fixed in versions 6.3.1 and 5.6.7. Users are advised to upgrade. There are no known workarounds for this vulnerability.

Publish Date: 2023-08-18

URL: CVE-2023-40175

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2023-40175

Release Date: 2023-08-18

Fix Resolution: puma - 5.6.7,6.3.1

Step up your Open Source Security Game with Mend here

CVE-2024-21647

Vulnerable Library - puma-5.5.2.gem

Puma is a simple, fast, threaded, and highly parallel HTTP 1.1 server for Ruby/Rack applications. Puma is intended for use in both development and production environments. It's great for highly parallel Ruby implementations such as Rubinius and JRuby as well as as providing process worker support to support CRuby well.

Library home page: https://rubygems.org/gems/puma-5.5.2.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /7.0/cache/puma-5.5.2.gem

Dependency Hierarchy:

• ❌ puma-5.5.2.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

Puma is a web server for Ruby/Rack applications built for parallelism. Prior to version 6.4.2, puma exhibited incorrect behavior when parsing chunked transfer encoding bodies in a way that allowed HTTP request smuggling. Fixed versions limits the size of chunk extensions. Without this limit, an attacker could cause unbounded resource (CPU, network bandwidth) consumption. This vulnerability has been fixed in versions 6.4.2 and 5.6.8.

Publish Date: 2024-01-08

URL: CVE-2024-21647

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-21647

Release Date: 2024-01-08

Fix Resolution: puma - 5.6.8,6.4.2

Step up your Open Source Security Game with Mend here

CVE-2022-23634

Vulnerable Library - puma-5.5.2.gem

Puma is a simple, fast, threaded, and highly parallel HTTP 1.1 server for Ruby/Rack applications. Puma is intended for use in both development and production environments. It's great for highly parallel Ruby implementations such as Rubinius and JRuby as well as as providing process worker support to support CRuby well.

Library home page: https://rubygems.org/gems/puma-5.5.2.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /7.0/cache/puma-5.5.2.gem

Dependency Hierarchy:

• ❌ puma-5.5.2.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

Puma is a Ruby/Rack web server built for parallelism. Prior to puma version 5.6.2, puma may not always call close on the response body. Rails, prior to version 7.0.2.2, depended on the response body being closed in order for its CurrentAttributes implementation to work correctly. The combination of these two behaviors (Puma not closing the body + Rails' Executor implementation) causes information leakage. This problem is fixed in Puma versions 5.6.2 and 4.3.11. This problem is fixed in Rails versions 7.02.2, 6.1.4.6, 6.0.4.6, and 5.2.6.2. Upgrading to a patched Rails or Puma version fixes the vulnerability.

Publish Date: 2022-02-11

URL: CVE-2022-23634

CVSS 3 Score Details (5.9)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wh98-p28r-vrc9

Release Date: 2022-02-11

Fix Resolution: puma - 4.3.11, 5.6.2; actionpack - 5.2.6.2, 6.0.4.6, 6.1.4.6, 7.0.2.2

Step up your Open Source Security Game with Mend here

middleman-3.4.1.gem: 2 vulnerabilities (highest severity is: 9.8) - autoclosed

Vulnerable Library - middleman-3.4.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/kramdown-1.17.0.gem

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2020-14001	High	9.8	kramdown-1.17.0.gem	Transitive	N/A	❌
CVE-2021-28834	High	9.8	kramdown-1.17.0.gem	Transitive	N/A	❌

Details

CVE-2020-14001

Vulnerable Library - kramdown-1.17.0.gem

kramdown is yet-another-markdown-parser but fast, pure Ruby, using a strict syntax definition and supporting several common extensions.

Library home page: https://rubygems.org/gems/kramdown-1.17.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/kramdown-1.17.0.gem

Dependency Hierarchy:

• middleman-3.4.1.gem (Root Library)
  • ❌ kramdown-1.17.0.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

Publish Date: 2020-07-17

URL: CVE-2020-14001

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14001

Release Date: 2020-07-17

Fix Resolution: kramdown - 2.3.0

Step up your Open Source Security Game with Mend here

CVE-2021-28834

Vulnerable Library - kramdown-1.17.0.gem

kramdown is yet-another-markdown-parser but fast, pure Ruby, using a strict syntax definition and supporting several common extensions.

Library home page: https://rubygems.org/gems/kramdown-1.17.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/kramdown-1.17.0.gem

Dependency Hierarchy:

• middleman-3.4.1.gem (Root Library)
  • ❌ kramdown-1.17.0.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.

Publish Date: 2021-03-19

URL: CVE-2021-28834

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-03-19

Fix Resolution: 2.3.1

Step up your Open Source Security Game with Mend here

middleman-syntax-3.2.0.gem: 3 vulnerabilities (highest severity is: 8.1)

Vulnerable Library - middleman-syntax-3.2.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/activesupport-4.2.11.3.gem

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (middleman-syntax version)	Remediation Possible**
CVE-2022-31163	High	8.1	tzinfo-1.2.9.gem	Transitive	N/A*	❌
CVE-2023-22796	High	7.5	activesupport-4.2.11.3.gem	Transitive	N/A*	❌
WS-2017-0183	Medium	6.5	middleman-core-3.4.1.gem	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-31163

Vulnerable Library - tzinfo-1.2.9.gem

TZInfo provides daylight savings aware transformations between times in different time zones.

Library home page: https://rubygems.org/gems/tzinfo-1.2.9.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/tzinfo-1.2.9.gem

Dependency Hierarchy:

• middleman-syntax-3.2.0.gem (Root Library)
  • middleman-core-3.4.1.gem
    • padrino-helpers-0.12.9.gem
      • padrino-support-0.12.9.gem
        • activesupport-4.2.11.3.gem
          • ❌ tzinfo-1.2.9.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path traversal. With the Ruby data source, time zones are defined in Ruby files. There is one file per time zone. Time zone files are loaded with require on demand. In the affected versions, TZInfo::Timezone.get fails to validate time zone identifiers correctly, allowing a new line character within the identifier. With Ruby version 1.9.3 and later, TZInfo::Timezone.get can be made to load unintended files with require, executing them within the Ruby process. Versions 0.3.61 and 1.2.10 include fixes to correctly validate time zone identifiers. Versions 2.0.0 and later are not vulnerable. Version 0.3.61 can still load arbitrary files from the Ruby load path if their name follows the rules for a valid time zone identifier and the file has a prefix of tzinfo/definition within a directory in the load path. Applications should ensure that untrusted files are not placed in a directory on the load path. As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.

Publish Date: 2022-07-22

URL: CVE-2022-31163

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5cm2-9h8c-rvfx

Release Date: 2022-07-22

Fix Resolution: tzinfo - 0.3.61,1.2.10

Step up your Open Source Security Game with Mend here

CVE-2023-22796

Vulnerable Library - activesupport-4.2.11.3.gem

A toolkit of support libraries and Ruby core extensions extracted from the Rails framework. Rich support for multibyte strings, internationalization, time zones, and testing.

Library home page: https://rubygems.org/gems/activesupport-4.2.11.3.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/activesupport-4.2.11.3.gem

Dependency Hierarchy:

• middleman-syntax-3.2.0.gem (Root Library)
  • middleman-core-3.4.1.gem
    • ❌ activesupport-4.2.11.3.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

A regular expression based DoS vulnerability in Active Support <6.1.7.1 and <7.0.4.1. A specially crafted string passed to the underscore method can cause the regular expression engine to enter a state of catastrophic backtracking. This can cause the process to use large amounts of CPU and memory, leading to a possible DoS vulnerability.

Publish Date: 2023-02-09

URL: CVE-2023-22796

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-j6gc-792m-qgm2

Release Date: 2023-02-09

Fix Resolution: activesupport - 6.1.7.1,7.0.4.1

Step up your Open Source Security Game with Mend here

WS-2017-0183

Vulnerable Library - middleman-core-3.4.1.gem

A static site generator. Provides dozens of templating languages (Haml, Sass, Compass, Slim, CoffeeScript, and more). Makes minification, compression, cache busting, Yaml data (and more) an easy part of your development cycle.

Library home page: https://rubygems.org/gems/middleman-core-3.4.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/middleman-core-3.4.1.gem

Dependency Hierarchy:

• middleman-syntax-3.2.0.gem (Root Library)
  • ❌ middleman-core-3.4.1.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

Affected versions of the package are vulnerable to Cross-Site Request Forgery (CSRF) attacks.

Publish Date: 2016-02-15

URL: WS-2017-0183

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2016-02-15

Fix Resolution: 4.1.2

Step up your Open Source Security Game with Mend here

jekyll-redirect-from-0.16.0.gem: 2 vulnerabilities (highest severity is: 9.8)

Vulnerable Library - jekyll-redirect-from-0.16.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/kramdown-1.17.0.gem

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (jekyll-redirect-from version)	Remediation Possible**
CVE-2021-28834	Critical	9.8	kramdown-1.17.0.gem	Transitive	N/A*	❌
CVE-2020-14001	Critical	9.8	kramdown-1.17.0.gem	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-28834

Vulnerable Library - kramdown-1.17.0.gem

kramdown is yet-another-markdown-parser but fast, pure Ruby, using a strict syntax definition and supporting several common extensions.

Library home page: https://rubygems.org/gems/kramdown-1.17.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/kramdown-1.17.0.gem

Dependency Hierarchy:

• jekyll-redirect-from-0.16.0.gem (Root Library)
  • jekyll-3.8.7.gem
    • ❌ kramdown-1.17.0.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

Kramdown before 2.3.1 does not restrict Rouge formatters to the Rouge::Formatters namespace, and thus arbitrary classes can be instantiated.

Publish Date: 2021-03-19

URL: CVE-2021-28834

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2021-03-19

Fix Resolution: 2.3.1

Step up your Open Source Security Game with Mend here

CVE-2020-14001

Vulnerable Library - kramdown-1.17.0.gem

kramdown is yet-another-markdown-parser but fast, pure Ruby, using a strict syntax definition and supporting several common extensions.

Library home page: https://rubygems.org/gems/kramdown-1.17.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/kramdown-1.17.0.gem

Dependency Hierarchy:

• jekyll-redirect-from-0.16.0.gem (Root Library)
  • jekyll-3.8.7.gem
    • ❌ kramdown-1.17.0.gem (Vulnerable Library)

Found in base branch: master

Vulnerability Details

The kramdown gem before 2.3.0 for Ruby processes the template option inside Kramdown documents by default, which allows unintended read access (such as template="/etc/passwd") or unintended embedded Ruby code execution (such as a string that begins with template="string://<%= `). NOTE: kramdown is used in Jekyll, GitLab Pages, GitHub Pages, and Thredded Forum.

Publish Date: 2020-07-17

URL: CVE-2020-14001

CVSS 3 Score Details (9.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-14001

Release Date: 2020-07-17

Fix Resolution: kramdown - 2.3.0

Step up your Open Source Security Game with Mend here

redcarpet-3.5.0.gem: 1 vulnerabilities (highest severity is: 5.4)

Vulnerable Library - redcarpet-3.5.0.gem

A fast, safe and extensible Markdown to (X)HTML parser

Library home page: https://rubygems.org/gems/redcarpet-3.5.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /7.0/cache/redcarpet-3.5.0.gem

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (redcarpet version)	Remediation Possible**
CVE-2020-26298	Medium	5.4	redcarpet-3.5.0.gem	Direct	redcarpet - 3.5.1	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2020-26298

Vulnerable Library - redcarpet-3.5.0.gem

A fast, safe and extensible Markdown to (X)HTML parser

Library home page: https://rubygems.org/gems/redcarpet-3.5.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /7.0/cache/redcarpet-3.5.0.gem

Dependency Hierarchy:

• ❌ redcarpet-3.5.0.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

Redcarpet is a Ruby library for Markdown processing. In Redcarpet before version 3.5.1, there is an injection vulnerability which can enable a cross-site scripting attack. In affected versions no HTML escaping was being performed when processing quotes. This applies even when the :escape_html option was being used. This is fixed in version 3.5.1 by the referenced commit.

Publish Date: 2021-01-11

URL: CVE-2020-26298

CVSS 3 Score Details (5.4)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-q3wr-qw3g-3p4h

Release Date: 2021-01-11

Fix Resolution: redcarpet - 3.5.1

Step up your Open Source Security Game with Mend here

jquery-1.11.1.min.js: 4 vulnerabilities (highest severity is: 6.1)

Vulnerable Library - jquery-1.11.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.1/jquery.min.js

Path to dependency file: /_includes/head.html

Path to vulnerable library: /_includes/head.html

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (jquery version)	Remediation Possible**
CVE-2020-11023	Medium	6.1	jquery-1.11.1.min.js	Direct	jquery - 3.5.0;jquery-rails - 4.4.0	❌
CVE-2020-11022	Medium	6.1	jquery-1.11.1.min.js	Direct	jQuery - 3.5.0	❌
CVE-2019-11358	Medium	6.1	jquery-1.11.1.min.js	Direct	jquery - 3.4.0	❌
CVE-2015-9251	Medium	6.1	jquery-1.11.1.min.js	Direct	jQuery - 3.0.0	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2020-11023

Vulnerable Library - jquery-1.11.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.1/jquery.min.js

Path to dependency file: /_includes/head.html

Path to vulnerable library: /_includes/head.html

Dependency Hierarchy:

• ❌ jquery-1.11.1.min.js (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

In jQuery versions greater than or equal to 1.0.3 and before 3.5.0, passing HTML containing elements from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11023

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://github.com/jquery/jquery/security/advisories/GHSA-jpcq-cgw6-v4j6,https://github.com/rails/jquery-rails/blob/master/CHANGELOG.md#440

Release Date: 2020-04-29

Fix Resolution: jquery - 3.5.0;jquery-rails - 4.4.0

Step up your Open Source Security Game with Mend here

CVE-2020-11022

Vulnerable Library - jquery-1.11.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.1/jquery.min.js

Path to dependency file: /_includes/head.html

Path to vulnerable library: /_includes/head.html

Dependency Hierarchy:

• ❌ jquery-1.11.1.min.js (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

In jQuery versions greater than or equal to 1.2 and before 3.5.0, passing HTML from untrusted sources - even after sanitizing it - to one of jQuery's DOM manipulation methods (i.e. .html(), .append(), and others) may execute untrusted code. This problem is patched in jQuery 3.5.0.

Publish Date: 2020-04-29

URL: CVE-2020-11022

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-11022

Release Date: 2020-04-29

Fix Resolution: jQuery - 3.5.0

Step up your Open Source Security Game with Mend here

CVE-2019-11358

Vulnerable Library - jquery-1.11.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.1/jquery.min.js

Path to dependency file: /_includes/head.html

Path to vulnerable library: /_includes/head.html

Dependency Hierarchy:

• ❌ jquery-1.11.1.min.js (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

jQuery before 3.4.0, as used in Drupal, Backdrop CMS, and other products, mishandles jQuery.extend(true, {}, ...) because of Object.prototype pollution. If an unsanitized source object contained an enumerable proto property, it could extend the native Object.prototype.

Publish Date: 2019-04-20

URL: CVE-2019-11358

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-11358

Release Date: 2019-04-20

Fix Resolution: jquery - 3.4.0

Step up your Open Source Security Game with Mend here

CVE-2015-9251

Vulnerable Library - jquery-1.11.1.min.js

JavaScript library for DOM operations

Library home page: https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.1/jquery.min.js

Path to dependency file: /_includes/head.html

Path to vulnerable library: /_includes/head.html

Dependency Hierarchy:

• ❌ jquery-1.11.1.min.js (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

jQuery before 3.0.0 is vulnerable to Cross-site Scripting (XSS) attacks when a cross-domain Ajax request is performed without the dataType option, causing text/javascript responses to be executed.

Publish Date: 2018-01-18

URL: CVE-2015-9251

CVSS 3 Score Details (6.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2015-9251

Release Date: 2018-01-18

Fix Resolution: jQuery - 3.0.0

Step up your Open Source Security Game with Mend here

rubocop-0.86.0.gem: 2 vulnerabilities (highest severity is: 7.5)

Vulnerable Library - rubocop-0.86.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rexml-3.2.4.gem

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (rubocop version)	Remediation Possible**
CVE-2021-28965	High	7.5	rexml-3.2.4.gem	Transitive	N/A*	❌
CVE-2024-35176	Medium	5.3	rexml-3.2.4.gem	Transitive	N/A*	❌

*For some transitive vulnerabilities, there is no version of direct dependency with a fix. Check the "Details" section below to see if there is a version of transitive dependency where vulnerability is fixed.

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2021-28965

Vulnerable Library - rexml-3.2.4.gem

An XML toolkit for Ruby

Library home page: https://rubygems.org/gems/rexml-3.2.4.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rexml-3.2.4.gem

Dependency Hierarchy:

• rubocop-0.86.0.gem (Root Library)
  • ❌ rexml-3.2.4.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

The REXML gem before 3.2.5 in Ruby before 2.6.7, 2.7.x before 2.7.3, and 3.x before 3.0.1 does not properly address XML round-trip issues. An incorrect document can be produced after parsing and serializing.

Publish Date: 2021-04-21

URL: CVE-2021-28965

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-8cr8-4vfw-mr7h

Release Date: 2021-04-21

Fix Resolution: rexml - 3.1.9.1, 3.2.5

Step up your Open Source Security Game with Mend here

CVE-2024-35176

Vulnerable Library - rexml-3.2.4.gem

An XML toolkit for Ruby

Library home page: https://rubygems.org/gems/rexml-3.2.4.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/rexml-3.2.4.gem

Dependency Hierarchy:

• rubocop-0.86.0.gem (Root Library)
  • ❌ rexml-3.2.4.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

REXML is an XML toolkit for Ruby. The REXML gem before 3.2.6 has a denial of service vulnerability when it parses an XML that has many <s in an attribute value. Those who need to parse untrusted XMLs may be impacted to this vulnerability. The REXML gem 3.2.7 or later include the patch to fix this vulnerability. As a workaround, don't parse untrusted XMLs.

Publish Date: 2024-05-16

URL: CVE-2024-35176

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-vg3r-rm7w-2xgh

Release Date: 2024-05-16

Fix Resolution: rexml - 3.2.7

Step up your Open Source Security Game with Mend here

middleman-livereload-3.4.7.gem: 4 vulnerabilities (highest severity is: 8.1) - autoclosed

Vulnerable Library - middleman-livereload-3.4.7.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/i18n-0.7.0.gem

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in	Remediation Available
CVE-2022-31163	High	8.1	tzinfo-1.2.9.gem	Transitive	N/A	❌
WS-2017-0183	Medium	6.5	middleman-core-3.4.1.gem	Transitive	N/A	❌
WS-2022-0334	Medium	5.5	nokogiri-1.13.6-x86_64-linux.gem	Transitive	N/A	❌
CVE-2014-10077	Medium	5.3	i18n-0.7.0.gem	Transitive	N/A	❌

Details

CVE-2022-31163

Vulnerable Library - tzinfo-1.2.9.gem

TZInfo provides daylight savings aware transformations between times in different time zones.

Library home page: https://rubygems.org/gems/tzinfo-1.2.9.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/tzinfo-1.2.9.gem

Dependency Hierarchy:

• middleman-livereload-3.4.7.gem (Root Library)
  • middleman-core-3.4.1.gem
    • activesupport-4.2.11.3.gem
      • ❌ tzinfo-1.2.9.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

TZInfo is a Ruby library that provides access to time zone data and allows times to be converted using time zone rules. Versions prior to 0.36.1, as well as those prior to 1.2.10 when used with the Ruby data source tzinfo-data, are vulnerable to relative path traversal. With the Ruby data source, time zones are defined in Ruby files. There is one file per time zone. Time zone files are loaded with require on demand. In the affected versions, TZInfo::Timezone.get fails to validate time zone identifiers correctly, allowing a new line character within the identifier. With Ruby version 1.9.3 and later, TZInfo::Timezone.get can be made to load unintended files with require, executing them within the Ruby process. Versions 0.3.61 and 1.2.10 include fixes to correctly validate time zone identifiers. Versions 2.0.0 and later are not vulnerable. Version 0.3.61 can still load arbitrary files from the Ruby load path if their name follows the rules for a valid time zone identifier and the file has a prefix of tzinfo/definition within a directory in the load path. Applications should ensure that untrusted files are not placed in a directory on the load path. As a workaround, the time zone identifier can be validated before passing to TZInfo::Timezone.get by ensuring it matches the regular expression \A[A-Za-z0-9+\-_]+(?:\/[A-Za-z0-9+\-_]+)*\z.

Publish Date: 2022-07-22

URL: CVE-2022-31163

CVSS 3 Score Details (8.1)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: High
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-5cm2-9h8c-rvfx

Release Date: 2022-07-22

Fix Resolution: tzinfo - 0.3.61,1.2.10

Step up your Open Source Security Game with Mend here

WS-2017-0183

Vulnerable Library - middleman-core-3.4.1.gem

A static site generator. Provides dozens of templating languages (Haml, Sass, Compass, Slim, CoffeeScript, and more). Makes minification, compression, cache busting, Yaml data (and more) an easy part of your development cycle.

Library home page: https://rubygems.org/gems/middleman-core-3.4.1.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/middleman-core-3.4.1.gem

Dependency Hierarchy:

• middleman-livereload-3.4.7.gem (Root Library)
  • ❌ middleman-core-3.4.1.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

Affected versions of the package are vulnerable to Cross-Site Request Forgery (CSRF) attacks.

Publish Date: 2016-02-15

URL: WS-2017-0183

CVSS 3 Score Details (6.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: Low
  • Integrity Impact: Low
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2016-02-15

Fix Resolution: 4.1.2

Step up your Open Source Security Game with Mend here

WS-2022-0334

Vulnerable Library - nokogiri-1.13.6-x86_64-linux.gem

Nokogiri (鋸) makes it easy and painless to work with XML and HTML from Ruby. It provides a sensible, easy-to-understand API for reading, writing, modifying, and querying documents. It is fast and standards-compliant by relying on native parsers like libxml2 (C) and xerces (Java).

Library home page: https://rubygems.org/gems/nokogiri-1.13.6-x86_64-linux.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/nokogiri-1.13.6.gem

Dependency Hierarchy:

• middleman-livereload-3.4.7.gem (Root Library)
  • middleman-core-3.4.1.gem
    • capybara-2.4.4.gem
      • ❌ nokogiri-1.13.6-x86_64-linux.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

nokogiri up to and including 1.13.8 is affected by several vulnerabilities (CVE-2022-40303, CVE-2022-40304 and CVE-2022-2309) in the dependency bundled libxml2 library. Version 1.13.9 of nokogiri contains a patch where the dependency is upgraded with the patches as well.

Publish Date: 2022-10-18

URL: WS-2022-0334

CVSS 3 Score Details (5.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: Required
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-2qc6-mcvw-92cw

Release Date: 2022-10-18

Fix Resolution: nokogiri - 1.13.9

Step up your Open Source Security Game with Mend here

CVE-2014-10077

Vulnerable Library - i18n-0.7.0.gem

New wave Internationalization support for Ruby.

Library home page: https://rubygems.org/gems/i18n-0.7.0.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /home/wss-scanner/.gem/ruby/2.7.0/cache/i18n-0.7.0.gem

Dependency Hierarchy:

• middleman-livereload-3.4.7.gem (Root Library)
  • middleman-core-3.4.1.gem
    • ❌ i18n-0.7.0.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

Hash#slice in lib/i18n/core_ext/hash.rb in the i18n gem before 0.8.0 for Ruby allows remote attackers to cause a denial of service (application crash) via a call in a situation where :some_key is present in keep_keys but not present in the hash.

Publish Date: 2018-11-06

URL: CVE-2014-10077

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://nvd.nist.gov/vuln/detail/CVE-2014-10077

Release Date: 2018-11-06

Fix Resolution: 0.8.0

Step up your Open Source Security Game with Mend here

rack-1.6.13.gem: 10 vulnerabilities (highest severity is: 10.0)

Vulnerable Library - rack-1.6.13.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Also see http://rack.github.io/.

Library home page: https://rubygems.org/gems/rack-1.6.13.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /7.0/cache/rack-1.6.13.gem

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Vulnerabilities

CVE	Severity	CVSS	Dependency	Type	Fixed in (rack version)	Remediation Possible**
CVE-2022-30123	Critical	10.0	rack-1.6.13.gem	Direct	rack - 2.0.9.1,2.1.4.1,2.2.3.1	❌
CVE-2020-8161	High	8.6	rack-1.6.13.gem	Direct	2.2.0,2.1.3	❌
CVE-2023-27539	High	7.5	rack-1.6.13.gem	Direct	rack - 2.2.6.4,3.0.6.1	❌
CVE-2022-44571	High	7.5	rack-1.6.13.gem	Direct	rack - 2.0.9.2,2.1.4.2,2.2.6.2,3.0.4.1	❌
CVE-2022-44570	High	7.5	rack-1.6.13.gem	Direct	rack - 2.0.9.2,2.1.4.2,2.2.6.2,3.0.4.1	❌
CVE-2022-30122	High	7.5	rack-1.6.13.gem	Direct	rack - 2.0.9.1,2.1.4.1,2.2.3.1	❌
CVE-2020-8184	High	7.5	rack-1.6.13.gem	Direct	rack - 2.1.4, 2.2.3	❌
CVE-2024-26141	Medium	5.8	rack-1.6.13.gem	Direct	rack - 2.2.8.1,3.0.9.1	❌
CVE-2024-26146	Medium	5.3	rack-1.6.13.gem	Direct	rack - 2.0.9.4,2.1.4.4,2.2.8.1,3.0.9.1	❌
CVE-2024-25126	Medium	5.3	rack-1.6.13.gem	Direct	rack - 2.2.8.1,3.0.9.1	❌

**In some cases, Remediation PR cannot be created automatically for a vulnerability despite the availability of remediation

Details

CVE-2022-30123

Vulnerable Library - rack-1.6.13.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Also see http://rack.github.io/.

Library home page: https://rubygems.org/gems/rack-1.6.13.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /7.0/cache/rack-1.6.13.gem

Dependency Hierarchy:

• ❌ rack-1.6.13.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

A sequence injection vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 which could allow is a possible shell escape in the Lint and CommonLogger components of Rack.

Publish Date: 2022-12-05

URL: CVE-2022-30123

CVSS 3 Score Details (10.0)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: High
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-wq4h-7r42-5hrr

Release Date: 2022-12-05

Fix Resolution: rack - 2.0.9.1,2.1.4.1,2.2.3.1

Step up your Open Source Security Game with Mend here

CVE-2020-8161

Vulnerable Library - rack-1.6.13.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Also see http://rack.github.io/.

Library home page: https://rubygems.org/gems/rack-1.6.13.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /7.0/cache/rack-1.6.13.gem

Dependency Hierarchy:

• ❌ rack-1.6.13.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

A directory traversal vulnerability exists in rack < 2.2.0 that allows an attacker perform directory traversal vulnerability in the Rack::Directory app that is bundled with Rack which could result in information disclosure.

Publish Date: 2020-07-02

URL: CVE-2020-8161

CVSS 3 Score Details (8.6)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: High
  • Integrity Impact: None
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Release Date: 2020-07-02

Fix Resolution: 2.2.0,2.1.3

Step up your Open Source Security Game with Mend here

CVE-2023-27539

Vulnerable Library - rack-1.6.13.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Also see http://rack.github.io/.

Library home page: https://rubygems.org/gems/rack-1.6.13.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /7.0/cache/rack-1.6.13.gem

Dependency Hierarchy:

• ❌ rack-1.6.13.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

There is a denial of service vulnerability in the header parsing component of Rack. Carefully crafted input can cause header parsing in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that parse headers using Rack (virtually all Rails applications) are impacted. The issue is fixed versions 2.2.6.4 and 3.0.6.1

Publish Date: 2023-03-03

URL: CVE-2023-27539

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://discuss.rubyonrails.org/t/cve-2023-27539-possible-denial-of-service-vulnerability-in-racks-header-parsing/82466

Release Date: 2023-03-03

Fix Resolution: rack - 2.2.6.4,3.0.6.1

Step up your Open Source Security Game with Mend here

CVE-2022-44571

Vulnerable Library - rack-1.6.13.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Also see http://rack.github.io/.

Library home page: https://rubygems.org/gems/rack-1.6.13.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /7.0/cache/rack-1.6.13.gem

Dependency Hierarchy:

• ❌ rack-1.6.13.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

There is a denial of service vulnerability in the Content-Disposition parsingcomponent of Rack fixed in 2.0.9.2, 2.1.4.2, 2.2.4.1, 3.0.0.1. This could allow an attacker to craft an input that can cause Content-Disposition header parsing in Rackto take an unexpected amount of time, possibly resulting in a denial ofservice attack vector. This header is used typically used in multipartparsing. Any applications that parse multipart posts using Rack (virtuallyall Rails applications) are impacted.

Publish Date: 2023-02-09

URL: CVE-2022-44571

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-93pm-5p5f-3ghx

Release Date: 2023-02-09

Fix Resolution: rack - 2.0.9.2,2.1.4.2,2.2.6.2,3.0.4.1

Step up your Open Source Security Game with Mend here

CVE-2022-44570

Vulnerable Library - rack-1.6.13.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Also see http://rack.github.io/.

Library home page: https://rubygems.org/gems/rack-1.6.13.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /7.0/cache/rack-1.6.13.gem

Dependency Hierarchy:

• ❌ rack-1.6.13.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

A denial of service vulnerability in the Range header parsing component of Rack >= 1.5.0. A Carefully crafted input can cause the Range header parsing component in Rack to take an unexpected amount of time, possibly resulting in a denial of service attack vector. Any applications that deal with Range requests (such as streaming applications, or applications that serve files) may be impacted.

Publish Date: 2023-02-09

URL: CVE-2022-44570

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-65f5-mfpf-vfhj

Release Date: 2023-02-09

Fix Resolution: rack - 2.0.9.2,2.1.4.2,2.2.6.2,3.0.4.1

Step up your Open Source Security Game with Mend here

CVE-2022-30122

Vulnerable Library - rack-1.6.13.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Also see http://rack.github.io/.

Library home page: https://rubygems.org/gems/rack-1.6.13.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /7.0/cache/rack-1.6.13.gem

Dependency Hierarchy:

• ❌ rack-1.6.13.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

A possible denial of service vulnerability exists in Rack <2.0.9.1, <2.1.4.1 and <2.2.3.1 in the multipart parsing component of Rack.

Publish Date: 2022-12-05

URL: CVE-2022-30122

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: High

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-hxqx-xwvh-44m2

Release Date: 2022-12-05

Fix Resolution: rack - 2.0.9.1,2.1.4.1,2.2.3.1

Step up your Open Source Security Game with Mend here

CVE-2020-8184

Vulnerable Library - rack-1.6.13.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Also see http://rack.github.io/.

Library home page: https://rubygems.org/gems/rack-1.6.13.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /7.0/cache/rack-1.6.13.gem

Dependency Hierarchy:

• ❌ rack-1.6.13.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

A reliance on cookies without validation/integrity check security vulnerability exists in rack < 2.2.3, rack < 2.1.4 that makes it is possible for an attacker to forge a secure or host-only cookie prefix.

Publish Date: 2020-06-19

URL: CVE-2020-8184

CVSS 3 Score Details (7.5)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: High
  • Availability Impact: None

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://groups.google.com/forum/#!topic/rubyonrails-security/OWtmozPH9Ak

Release Date: 2020-06-19

Fix Resolution: rack - 2.1.4, 2.2.3

Step up your Open Source Security Game with Mend here

CVE-2024-26141

Vulnerable Library - rack-1.6.13.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Also see http://rack.github.io/.

Library home page: https://rubygems.org/gems/rack-1.6.13.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /7.0/cache/rack-1.6.13.gem

Dependency Hierarchy:

• ❌ rack-1.6.13.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

Rack is a modular Ruby web server interface. Carefully crafted Range headers can cause a server to respond with an unexpectedly large response. Responding with such large responses could lead to a denial of service issue. Vulnerable applications will use the Rack::File middleware or the Rack::Utils.byte_ranges methods (this includes Rails applications). The vulnerability is fixed in 3.0.9.1 and 2.2.8.1.

Publish Date: 2024-02-29

URL: CVE-2024-26141

CVSS 3 Score Details (5.8)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Changed
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-26141

Release Date: 2024-02-29

Fix Resolution: rack - 2.2.8.1,3.0.9.1

Step up your Open Source Security Game with Mend here

CVE-2024-26146

Vulnerable Library - rack-1.6.13.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Also see http://rack.github.io/.

Library home page: https://rubygems.org/gems/rack-1.6.13.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /7.0/cache/rack-1.6.13.gem

Dependency Hierarchy:

• ❌ rack-1.6.13.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

Rack is a modular Ruby web server interface. Carefully crafted headers can cause header parsing in Rack to take longer than expected resulting in a possible denial of service issue. Accept and Forwarded headers are impacted. Ruby 3.2 has mitigations for this problem, so Rack applications using Ruby 3.2 or newer are unaffected. This vulnerability is fixed in 2.0.9.4, 2.1.4.4, 2.2.8.1, and 3.0.9.1.

Publish Date: 2024-02-29

URL: CVE-2024-26146

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: https://www.cve.org/CVERecord?id=CVE-2024-26146

Release Date: 2024-02-29

Fix Resolution: rack - 2.0.9.4,2.1.4.4,2.2.8.1,3.0.9.1

Step up your Open Source Security Game with Mend here

CVE-2024-25126

Vulnerable Library - rack-1.6.13.gem

Rack provides a minimal, modular and adaptable interface for developing web applications in Ruby. By wrapping HTTP requests and responses in the simplest way possible, it unifies and distills the API for web servers, web frameworks, and software in between (the so-called middleware) into a single method call.

Also see http://rack.github.io/.

Library home page: https://rubygems.org/gems/rack-1.6.13.gem

Path to dependency file: /Gemfile.lock

Path to vulnerable library: /7.0/cache/rack-1.6.13.gem

Dependency Hierarchy:

• ❌ rack-1.6.13.gem (Vulnerable Library)

Found in HEAD commit: 1e3f41f567efc94b726bb551e7ca5af662bbed03

Found in base branch: master

Vulnerability Details

Rack is a modular Ruby web server interface. Carefully crafted content type headers can cause Rack’s media type parser to take much longer than expected, leading to a possible denial of service vulnerability (ReDos 2nd degree polynomial). This vulnerability is patched in 3.0.9.1 and 2.2.8.1.

Publish Date: 2024-02-29

URL: CVE-2024-25126

CVSS 3 Score Details (5.3)

Base Score Metrics:

• Exploitability Metrics:
  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope: Unchanged
• Impact Metrics:
  • Confidentiality Impact: None
  • Integrity Impact: None
  • Availability Impact: Low

For more information on CVSS3 Scores, click here.

Suggested Fix

Type: Upgrade version

Origin: GHSA-22f2-v57c-j9cx

Release Date: 2024-02-29

Fix Resolution: rack - 2.2.8.1,3.0.9.1

Step up your Open Source Security Game with Mend here