cocaine version 0.3.2 is classified as vulnerable

[thesp0nge]

cocaine version 0.3.2 is classified as vulnerable

[thesp0nge]

Hi Florian thank you for the issue. I will check it.

Paolo
Il 03/gen/2014 09:50 "Florian Frank" [email protected] ha scritto:

See dawn's output here:

09:38:41 [!] dawn: Vulnerable cocaine gem version found: 0.3.2

But apparently only some versions >= 0.4 are actually vulnerable, see here:

The Cocaine gem 0.4.0 through 0.5.2 for Ruby allows context-dependent
attackers to execute arbitrary commands via a crafted has object, related
to recursive variable interpolation.

[http://web.nvd.nist.gov/view/vuln/detail?vulnId=CVE-2013-4457]

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/19
.

[thesp0nge]

Should be fixed now. @flori can you confirm this?

[flori]

No, 0.3.2 is still reported as vulnerable.

But I noticed that some of the spec files aren't run, because they're missing the _spec suffix: 389db92

[thesp0nge]

@flori a lame error for spec files. Now the cocaine check should be fixed. Can you please confirm this?
The bug was in the is_vulnerable_version? routine and it affects all dependency checks where the patch level was the one to make the check to be true or false.
So this fix will affect also other checks.

[flori]

A bit late confirmation: This works now.

[thesp0nge]

Great :)
Il 14/gen/2014 17:56 "Florian Frank" [email protected] ha scritto:

A bit late confirmation: This works now.

—
Reply to this email directly or view it on GitHubhttps://github.com//issues/19#issuecomment-32283234
.